NYC Allergen Law Compliance Checklist for Restaurants

If you operate a restaurant, café, food truck, or catering business in New York City, allergen compliance isn't optional — it's the law, and the penalties for getting it wrong are serious. The NYC Department of Health and Mental Hygiene conducts regular inspections, and a single violation related to allergen labeling or staff training can result in fines starting at $200 and escalating to thousands of dollars per violation. Beyond the legal risk, serving a guest with an undisclosed allergen can have devastating consequences — hospitalization, anaphylaxis, and in tragic cases, death. Food business owners are rightly feeling the pressure to tighten their systems.

What makes allergen compliance particularly challenging is that it spans multiple areas of your operation simultaneously. It isn't just about printing an allergen menu or adding a disclaimer to your website. It covers staff certification, written documentation, point-of-sale disclosures, and supplier verification — all of which need to be maintained and updated as your menu evolves. Many operators discover gaps only when a health inspector walks through the door, which is far too late.

This checklist covers everything New York City food businesses need to address to meet current allergen requirements. Whether you're running a single-location restaurant or managing multiple sites through Shopify, you'll walk away with a clear, actionable plan to protect your customers and your business.

Understanding the NYC Allergen Law Requirements

New York City Local Law 31 of 2017, which took effect in August 2019, requires that food service establishments take concrete steps to inform customers about the presence of major food allergens in menu items. The law mandates that restaurants post a notice informing customers that they can request allergen information, and that staff be equipped to provide accurate responses. This is not the same as requiring a full allergen menu to be published — but the practical implication is that you need documented allergen information for every dish you serve.

The 14 major allergens recognised under New York regulations align closely with federal FDA guidance and include milk, eggs, fish, shellfish, tree nuts, peanuts, wheat, soybeans, sesame, and others. As of January 2023, sesame was formally added to the US list under the FASTER Act, making it the ninth major allergen under federal law — a change that directly affects NYC businesses. If your menu hasn't been reviewed since before 2023, this update alone could put you out of compliance.

Operators also need to understand that allergen law applies differently to pre-packaged food sold at your premises versus freshly prepared dishes. If you sell pre-packaged sandwiches, salads, or baked goods directly to consumers, your labeling requirements follow FDA packaging rules, which are more prescriptive than the verbal disclosure model used for made-to-order items. Knowing which category each product falls into is an essential first step before building the rest of your compliance framework.

Staff Training and Food Handler Certification

One of the most commonly cited failures during NYC health inspections is inadequate allergen training for front-of-house staff. Local Law 31 requires that at least one certified food protection manager be on duty during all hours of operation, and this person must be capable of answering detailed allergen questions about the menu. However, best practice — and what inspectors increasingly look for — is training across the entire team, including servers, hosts, and kitchen staff.

The NYC Health Department offers a Food Protection Certificate program, and allergen awareness is a core component of the curriculum. Staff should be trained not just to identify which dishes contain allergens, but to understand cross-contact risks — for example, a fryer used for both battered fish and chips poses a cross-contact risk for gluten-sensitive or fish-allergic customers even if the chips themselves contain no allergens. This kind of nuanced knowledge can only come from structured, regular training, not a one-time onboarding session.

Document every training session. Keep a log that includes the date, the topics covered, which staff attended, and who delivered the training. This documentation serves as evidence during an inspection and also helps you identify gaps — if a staff member hasn't completed their refresher training in 12 months, your log will catch that before the inspector does. Aim to run formal allergen training quarterly, and supplement it with brief shift briefings whenever the menu changes.

Building an Accurate Allergen Matrix for Your Menu

An allergen matrix is a structured document — typically a table — that maps every menu item against the 14 major allergens to show whether each one is present, absent, or a potential cross-contact risk. This is the operational backbone of your allergen compliance programme. Without one, your staff cannot give accurate answers to guest questions, and you cannot demonstrate due diligence if a complaint is made against your business.

Building your matrix requires working closely with your kitchen team and, critically, with your suppliers. Ingredient lists from suppliers can change without notice — a spice blend that was previously gluten-free may be reformulated by the manufacturer. This means your matrix is only as accurate as your most recent supplier review. Establish a protocol where any change to ingredients, recipes, or supplier sourcing triggers an immediate update to the matrix. Many restaurants choose to review their full matrix at least every six months even without known changes.

For food businesses managing their menus through Shopify — particularly those selling food products online, running pop-ups, or offering catering packages — tools like Allergen Matrix make it significantly easier to maintain accurate allergen data and surface it clearly at the point of sale. A dynamic digital matrix is far easier to update than a printed document, and it creates an auditable trail of changes, which is valuable if you ever need to demonstrate compliance after an incident.

Point-of-Sale and Menu Disclosure Requirements

Your physical and digital menus are legal documents in the context of allergen law — treat them accordingly. Under NYC requirements, your premises must display a clear notice informing customers that they can request allergen information before ordering. The notice must be posted in a visible location such as the entrance, the menu itself, or at the point of payment. The exact wording of compliant notices is available through the NYC Health Department, and deviating from approved language is itself a violation.

If you operate an online ordering system — whether through your own Shopify storefront, a third-party delivery platform, or a combination — allergen disclosures must also be present on your digital ordering interface. This is an area where many operators have significant gaps, particularly those who set up online ordering quickly during the pandemic and never revisited the compliance details. A customer ordering online has the same legal right to allergen information as one standing at your counter.

Bold allergen callouts in menu descriptions are not legally required in NYC for made-to-order items, but they represent excellent practice and reduce the volume of verbal queries your staff need to handle during service. Many restaurants that have added allergen icons or highlighted text to menus report a measurable reduction in allergen-related complaints and a higher level of customer trust. Consider conducting a full audit of both your printed menus and your digital ordering pages as a priority task this quarter.

Managing Supplier Changes and Ingredient Verification

Supplier management is one of the most overlooked elements of allergen compliance, and it's where some of the most serious incidents originate. A kitchen that has correctly documented its allergen matrix can still cause harm if a supplier changes a product formulation without the business being informed. Specification sheets — formal documents from suppliers that detail every ingredient and potential allergen in a product — should be held on file for every ingredient you use, and you should have a process for requesting updated specs at least annually.

When onboarding a new supplier, request a full ingredient specification before using any of their products in dishes. Ask explicitly whether their products are manufactured on equipment shared with any of the 14 major allergens, as this determines whether cross-contact warnings apply. Reputable suppliers will have this information readily available; if a supplier cannot or will not provide it, that is a significant red flag for your compliance programme.

Create a simple supplier communication log that tracks the date you last received updated specifications for each product, and set calendar reminders to request renewals. If a supplier informs you of a recipe change mid-contract, update your allergen matrix immediately — before that ingredient is used in service. This level of diligence is what separates businesses that manage allergen incidents reactively from those that prevent them entirely.

Handling Allergen Requests During Service

Even with perfect documentation and a well-trained team, how your staff respond in real time to allergen queries determines whether your compliance framework actually protects your guests. When a customer discloses an allergy, that disclosure should trigger a defined protocol — not a general assurance that "we can check." Standard operating procedures for allergen requests should be written, posted in the kitchen, and rehearsed regularly as part of team training.

A practical protocol might look like this: the server takes the allergen request, does not guess, goes directly to the kitchen manager or head chef, consults the allergen matrix for the specific dish requested, and returns with a written or confirmed verbal answer before the order is placed. If the dish cannot be prepared safely due to cross-contact risk, the customer must be told clearly — offering an alternative is good hospitality, but obscuring the risk to make a sale is both dangerous and legally indefensible.

Consider introducing a simple allergen request card system at the table or point of order. These cards allow customers to write down their allergens, which can then accompany the order ticket into the kitchen, creating a documented trail for that specific service interaction. This system has been adopted by a growing number of independent restaurants and chains as a low-cost, high-impact measure that also demonstrates to customers that you take their safety seriously.

Conclusion

Allergen compliance in New York City requires you to address training, documentation, supplier management, menu disclosures, and service protocols simultaneously. No single action is sufficient on its own — a comprehensive approach that is maintained and reviewed as your menu evolves is the only reliable way to protect your guests and your business.

The key takeaways from this checklist: train your entire team, not just your certified manager; build and maintain an accurate allergen matrix; ensure disclosures appear on both physical and digital menus; verify supplier specifications regularly; and establish a clear service protocol for allergen requests. Each of these steps reduces risk measurably.

If you're managing your food business through Shopify, compliance doesn't need to be a manual, error-prone process. Start by centralising your allergen data and making it accessible where customers order.

Try Allergen Matrix free at saltai.app — no credit card required.