New York Allergen Law Documentation: Records You Must Keep

Running a food business in New York means navigating one of the most demanding regulatory environments in the United States. Whether you operate a restaurant, a catering company, or a food retail operation, New York State and New York City have specific allergen-related requirements that go well beyond simply listing ingredients on a menu. The stakes are high — allergic reactions can be life-threatening, and regulators have increasingly scrutinized how businesses document their compliance efforts, not just whether they display the right signage.

The challenge for most food operators is that the documentation side of allergen compliance is rarely explained in plain terms. Health inspectors may ask to see training records, ingredient logs, or supplier declarations during a routine visit, and many businesses are caught off guard. Without proper records, even a well-intentioned kitchen can face violations, fines, or worse — a preventable allergic reaction that leads to legal liability.

In this post, you will learn exactly which records you are required to keep under New York allergen law, what format those records should take, how long you need to retain them, and what best practices look like for food businesses that sell both in-person and through platforms like Shopify. This is practical, specific guidance — not a summary of legislation you could find on any government website.

Understanding New York's Allergen Disclosure Requirements

New York's allergen rules operate at two levels: state law and New York City administrative code. Under New York State's Food Labeling Law, packaged foods sold in retail settings must declare the presence of the nine major allergens recognized by the FDA — milk, eggs, fish, shellfish, tree nuts, peanuts, wheat, soybeans, and sesame, which was added to the federal list in January 2023. For restaurants and food service establishments, the New York City Health Code requires that menus or menu boards include a written allergen disclosure statement, and staff must be trained to handle allergen inquiries accurately.

What surprises many operators is that the disclosure obligation generates a documentation obligation. If your business claims a dish is free from a particular allergen, you need records that substantiate that claim. A verbal assurance from a chef is not a compliance record. You need written evidence — ingredient specifications, supplier declarations, or a cross-contact prevention protocol — that proves your claim was based on verifiable information rather than assumption.

For Shopify-based food businesses selling packaged goods into New York, the same federal and state labeling standards apply to product pages and packaging alike. If a customer in New York purchases your product online and suffers an allergic reaction, regulators will want to see the ingredient documentation that informed your online listings. Treating your Shopify store as a separate compliance environment from your physical product is a common and costly mistake.

Ingredient Records and Supplier Documentation

The foundation of any allergen compliance program is a clear, current record of every ingredient in every product you sell. This means maintaining ingredient specification sheets — documents that list not only the ingredients in a recipe or formulation but the exact suppliers, lot numbers, and any allergen declarations those suppliers provide. If you change a supplier mid-season because of pricing or availability, you need a new specification sheet and a new supplier declaration before that ingredient enters your production process.

Supplier allergen declarations are formal written statements from your ingredient supplier confirming whether a product contains, may contain, or is manufactured on shared equipment with any of the major allergens. Reputable suppliers issue these automatically, but smaller or artisan suppliers may need to be asked explicitly. Keep these declarations on file in a format that links them to specific purchase orders or delivery records, so you can trace back any ingredient to its source at any given point in time.

Practically speaking, this means organizing your records in a date-sensitive system. A folder labeled "supplier declarations" with no version control is not sufficient. If your almond supplier updated their facility in March and you have a declaration dated February, that February document may not reflect current cross-contact risks. Auditors and inspectors will look at dates carefully, and outdated documentation can be treated as no documentation at all when it comes to substantiating a specific allergen-free claim.

Staff Training Records You Must Maintain

New York City requires that food service establishments have at least one certified food protection manager on site, but allergen-specific training goes beyond general food safety certification. Under the NYC Health Code, staff must be capable of identifying menu items that contain major allergens and communicating accurately with customers about those items. Documenting that this training has taken place is your legal protection if an incident occurs.

Your staff training records should include the date of training, the name of the trainer or training provider, a summary of the content covered, and a signed acknowledgment from each employee who completed the training. Generic food handler certificates do not substitute for allergen-specific training records. If a customer reports an allergic reaction and a lawsuit follows, courts and regulators will look for evidence that the specific employee who served that customer had received specific allergen training — not just general hygiene instruction.

Training should be repeated whenever a significant menu or product change occurs, whenever a new supplier is introduced, and at minimum annually for all front-of-house and kitchen staff. Many businesses conduct quarterly refreshers and document those separately. A simple spreadsheet tracking employee names, training dates, topics covered, and signatures is legally adequate in most circumstances, but purpose-built documentation systems are more defensible because they create time-stamped, tamper-evident records that are harder to dispute.

Menu and Product Labeling Records

Every iteration of your menu, product label, or online product description that makes or implies an allergen claim should be archived. This includes digital versions of Shopify product pages — screenshot or export records of what your listings said on any given date are valuable if a customer dispute arises months after a sale. Regulators and courts are increasingly sophisticated about the fact that digital content changes frequently, and showing that your product page said "contains peanuts" on the date of a transaction requires documentary evidence, not just your recollection.

For physical menus and printed labels, keep at least one copy of each version with a notation of the date it was in use. If you use a menu allergen matrix — a grid showing which dishes contain which allergens — that matrix should be version-controlled and archived every time it changes. Our Allergen Matrix app is specifically designed to help Shopify merchants manage this kind of structured allergen data in a format that is both customer-facing and internally documentable.

Label records are particularly important if you sell products through retail channels in New York, where the FDA's Food Allergen Labeling and Consumer Protection Act and its 2023 sesame amendment are both in force. If your product label does not declare sesame but the formulation includes it — even as a component of a compound ingredient — you are in violation. Your records should demonstrate that you reviewed every compound ingredient for hidden allergen sources, not just the primary ingredients listed in your recipe.

Cross-Contact Prevention Protocols

Documentation of your cross-contact prevention procedures is one of the most frequently overlooked categories of allergen records, yet it is one of the most important. Cross-contact occurs when an allergen is unintentionally transferred from one food to another — through shared equipment, utensils, surfaces, or improper handling — and it is the source of many serious allergic reactions in food service environments. If you claim a product is allergen-free, your cross-contact prevention protocol is the evidence that supports that claim.

Your written protocol should describe how equipment is cleaned between uses, what sequence allergen-containing products are prepared in relative to allergen-free ones, how staff change gloves and wash hands between handling different ingredients, and what physical separation exists in your kitchen or production space. Date your protocol and review it whenever your kitchen layout, equipment, or menu changes significantly. A protocol written three years ago that describes equipment you no longer use provides no compliance protection.

For businesses producing packaged goods, cross-contact prevention documentation should also address your storage procedures. Are allergen-containing raw materials stored separately from allergen-free ingredients? Are they at lower shelf levels to prevent spillage contamination? These details matter to inspectors and they matter in litigation. Writing them down — and updating them — is what transforms a food safety intention into a demonstrable compliance record.

Record Retention: How Long Is Long Enough?

New York does not prescribe a single universal retention period for allergen records, which leads many operators to keep records longer than necessary or to discard them too early. A practical standard used by many food law practitioners is three years for training records, supplier declarations, and labeling archives, and five years for any records related to a specific allergen-related incident, complaint, or near-miss. These timeframes align with New York's general statute of limitations for personal injury claims and give you adequate documentation coverage if litigation arises.

Digital records are easier to retain and organize than paper, but they must be backed up systematically. A training record stored only on a laptop that is later replaced or damaged is effectively lost. Cloud-based storage with access controls, version history, and regular exports is the minimum viable standard for a food business with serious compliance intentions. Many operators now use document management systems or food safety platforms that maintain audit logs automatically, which is particularly valuable if you are managing records across multiple locations or production sites.

Whatever format you use, the key principle is that your records must be retrievable on short notice. A health inspector arriving for a routine visit may ask to see training records or supplier declarations on the spot. If your answer is "I'll need a few days to pull those together," you are in a weaker position than if you can produce them immediately. Accessibility is not a secondary consideration — it is part of what makes a record system legally and operationally effective.

Conclusion

New York allergen compliance is not a single task — it is an ongoing documentation practice that covers ingredients, suppliers, staff training, product labeling, cross-contact prevention, and record retention. Each category requires specific records in specific formats, and those records must be current, accessible, and version-controlled to be genuinely useful when regulators or customers come asking.

The businesses that handle allergen compliance well are not necessarily the ones with the most elaborate systems. They are the ones who treat documentation as a routine operational habit rather than a panic-driven response to an inspection or incident. Start with your ingredient records and supplier declarations, build out your training logs, and create a simple archive system for every version of every label and menu item that makes an allergen claim. Review and update regularly — compliance is not a one-time event.

Try Allergen Matrix free at saltai.app — no credit card required.