A vegan customer points at the brownie and asks if it's egg-free. Your 17-year-old Saturday team member looks at the cake stand, looks at the sign that says Contains: gluten, eggs, milk, nuts, and says "I don't think so, no". Two minutes later your kitchen confirms there are eggs in it.

That's the gap.

The sign was technically right. The staff member was wrong. And the only thing standing between an honest answer and a guess was whether anyone had built a proper allergen matrix and trained the team to use it.

Natasha's Law (2021) made PPDS labelling non-negotiable. Most independent cafés have done the bare minimum since: print the 14 allergens on a sticker, stick it on the box, move on. That cleared the legal floor. It didn't clear the bar that customers, inspectors, and the ongoing Owen's Law conversation are now setting.

This post is about doing it properly.

Why "contains nuts" stopped being enough

A wall sign tells someone what's in a brownie. It doesn't tell them what isn't. And increasingly, that's the question being asked.

A vegan asks if the chai loaf is egg-free.
A coeliac asks if the chocolate cookies are made on the same surface as the sourdough.
A parent asks if the kids' babyccino topping has soya.
A wedding party asks for a full allergen breakdown for 40 guests by Friday.

None of those are answered by a 14-allergen tick list on a stand-up card. They're answered by an ingredient-level matrix - one that lets any member of staff look up any item and read out the truth.

The dangerous answer in a café is "I don't think so". The safe answer is "let me check".

What an ingredient-level allergen matrix actually is

The matrix isn't a poster on a wall. It's a lookup.

Every ingredient you buy gets a profile: which of the 14 allergens it contains, and which it may contain (the cross-contact statement on the packaging). Then every recipe inherits the union of its ingredients automatically.

So your "vanilla brownie" recipe doesn't have allergens declared by hand. It has them because:

Plain flour: contains gluten, may contain mustard
Caster sugar: nothing
Butter: contains milk
Eggs: contains eggs
Dark chocolate: contains milk (cross-contact), may contain nuts, soya
Vanilla extract: nothing

Roll that up and the brownie correctly carries: contains gluten, milk, eggs; may contain mustard, nuts, soya.

Now change the chocolate supplier. The matrix updates the chocolate row once, and every recipe using it inherits the new profile instantly. That's the bit a sticker on a cake stand will never give you.

This is the model CostingBrik uses: ingredients carry the data, recipes inherit it, and the ingredient-level inheritance that makes accurate costing possible does the same job for allergens. One data spine, two operational outputs.

Even a spreadsheet works if it's properly maintained. One row per ingredient, 14 columns for the allergens, two more for "may contain" notes and the supplier reference. The mechanism matters less than the discipline of keeping it current.

Staff judge omissions, not just declarations

Here's the bit that most operators miss when they read the law.

Customers don't only ask "what's in it". They ask "is X not in it". And those are completely different cognitive jobs for a 17-year-old on shift.

Declaring what's in a product is reading a label. Confirming what's not in a product is making a judgement about the entire ingredient list, including the cross-contact section, including the modifier the customer is about to add, including the oat milk swap they asked for. That judgement should never live in a staff member's head.

It should live in the matrix. Staff just need to know how to read it.

The safe phrase to drill into every new starter is "let me check". Not "I don't think so". Not "I'm pretty sure". Let me check. Then they go to the matrix, on a tablet or a printed binder behind the counter, and they read it.

That's not a failure of confidence. That's the correct answer. Empower it. The customer who hears "let me check" trusts you more than the one who hears a guess.

The hardest part: supplier swaps

A new flour brand arrives because your wholesaler ran out of the usual one. The packaging looks identical at a glance. The "may contain" line on the new bag now says mustard, sesame. The old one didn't.

Nothing about your recipes changed. Nothing about your menu changed. But every product made with that flour has a different allergen profile this week than it did last week.

This is the silent risk that catches good operators out.

The fix is procedural, not technical:

When a delivery contains a substitution, the person putting it away checks the allergen panel against the existing matrix entry before it goes on the shelf
If the new pack says anything the old one didn't, that ingredient row gets updated before the next prep run
Anything urgent (a new "contains" rather than a new "may contain") gets flagged to whoever owns recipes that day

Some software can warn you - if you've logged invoices and your ingredient catalogue has allergen profiles, the swap shows up as a mismatch. But the human check at delivery is what catches it first.

Practical setup in a small café

You don't need an enterprise food-safety platform. You need three things working together:

1. The ingredient sheet. One row per ingredient, columns for the 14, a "may contain" column, and a supplier reference. Live in a shared spreadsheet, in your costing software, or in a binder if you must. Keep it in one place only.

2. The recipe roll-up. For each menu item, work out the union of its ingredients' allergens. If you're using software, this happens automatically. If you're on a spreadsheet, do it once and update it whenever a recipe changes.

3. The counter copy. A printed lookup, a laminated card, or an iPad with the file open. Whatever staff can reach in under ten seconds while a customer is standing in front of them.

The matrix lives where the question gets asked. Not in the office. Not on the server. Behind the till.

Training: induction beats posters

A poster in the back is for the EHO. The training is for the customer.

When a new starter comes on, the allergen walk-through is part of induction:

Show them the matrix
Show them how to find a specific menu item
Show them the "may contain" column and explain what it means
Practice the phrase: "Give me one second, I'll check that for you"
Show them what to do if the item isn't on the matrix (find a manager, don't guess)

Five minutes. Done in induction, refreshed when the menu changes. Same energy you'd put into a closing checklist that staff actually follow - it's the daily routine that makes the policy real, not the policy itself.

The EHO will ask about your system. The customer will ask about a specific cake. Train for both, but optimise for the cake. The things that move the needle on hygiene ratings overlap heavily with what makes you genuinely safe, and confident allergen handling is right at the top of that overlap.

Common failure modes

These are the ones that catch otherwise-decent operations:

Modifier extras. A latte with chocolate sprinkles is a different allergen profile than a plain latte. Oat milk swaps don't remove milk traces if the steam wand isn't purged. The matrix needs to cover the modifiers, not just the base item.
Shared equipment. One fryer for the halloumi fries and the breaded chicken means cross-contact. One grill for the cheese toastie and the BLT means cross-contact. If your matrix doesn't reflect equipment, it's lying.
Kids' menu shortcuts. The kids' babyccino, the toast, the little ice-cream. Often slapped onto the menu without going through the matrix. Children also have the highest rate of severe food allergies. Worth saying out loud.
Summer specials and pop-ups. The peach-and-burrata salad that ran for three weeks in July and never made it into the matrix. If it's on the menu, it's on the matrix. No exceptions.
Bakery from a local producer. "We don't make those, the bakery does" is not an answer. Get their declarations in writing and put them in your matrix.

The bar is moving

Owen's Law conversations are pushing toward mandatory written allergen disclosure on menus, not just on PPDS labels. Whether or not the legislation lands in its current form, customer expectation is already there. A guest with an allergy walks in expecting clarity, and the cafés that have built proper systems will win that custom.

Doing this well isn't expensive. It isn't even particularly hard. It's a one-off investment in ingredient data and a small ongoing discipline around supplier swaps and induction training.

The cafés still relying on "contains nuts" on a stand-up sign aren't lazy. They just haven't seen the work that closes the gap. Once you have, you can't unsee it. And the moment a customer asks the specific question and your team gives them the specific, correct answer, you'll know the matrix is doing its job.

That's the bar. It's higher than the law. That's the point.

Ed O'Brien has run Hunters Cake Company for 17 years across cafés in Witney, Burford, and a bakery in Carterton, Oxfordshire. He's building Brikly - modular tools that give independent café owners the same data the big chains have, without the big chain price tag.