A regular walks in, picks up a pre-made chicken sandwich from the counter fridge, and asks the Saturday girl, "is this dairy-free?" She flips the label over, squints, and says, "I think so, yeah." She's guessing.

That's most cafés, four years after Natasha's Law came in. The labels went on once. The matrix got printed. Nobody's touched either since the recipes changed last autumn.

A quick recap, without labouring it

Natasha's Law came into force in October 2021. It requires full ingredient lists and allergen labelling on any Pre-Packed for Direct Sale (PPDS) food - the sandwich you wrap and put in the fridge, the traybake you pre-portion into cellophane, the salad bowl with the lid on ready for the lunch rush.

Fourteen named allergens, all flagged on the label. Full ingredient list, in descending order by weight. No exceptions for small operators.

That bit, most cafés got right the first time. It's what happened next that's the problem.

You passed the one-off audit. You're failing the ongoing one.

Here's what I see when I walk into café kitchens. There's a folder on the shelf. Inside the folder, an allergen matrix - a grid of recipes down one side, the fourteen allergens across the top, ticks and crosses in between.

The matrix was printed in October 2024. It's April 2026. The menu has changed four times since then.

The wrap supplier swapped from a standard tortilla to a multi-seed one. There's now sesame in the chicken Caesar wrap. Nobody updated the grid.
The new oat milk brand uses a different thickener. Whether that matters depends on the spec sheet you never asked for.
Your chef started adding a splash of Worcestershire sauce to the cottage pie. Worcestershire sauce contains fish (anchovies) and often gluten. It's not on the label.
The gluten-free flour blend you buy in bulk changed formula. The supplier's email went to a dormant inbox.

Every single one of those is a labelling failure. Not because you're careless - because your system is a piece of paper, and paper doesn't know when an invoice changes.

The 14 allergens - and the ones that trip cafés up

The list itself is well known: celery, cereals containing gluten, crustaceans, eggs, fish, lupin, milk, molluscs, mustard, nuts, peanuts, sesame, soya, sulphites.

The trip-up allergens are the sneaky ones. The ones you'd never think to declare because they live inside something else.

Mustard in seeded bread. A lot of multi-grain and seeded loaves contain mustard flour. If you've built a recipe around "brown bread", the allergen inherits from the bread spec - and most café teams never check.
Celery in stock cubes. Your tomato soup is vegan. Your tomato soup also contains a vegetable stock cube, which almost certainly contains celery.
Sulphites in dried fruit. The raisins in your breakfast bar. The apricots in the tagine.
Soya lecithin in chocolate. Most standard chocolate chips. Most standard couverture.
Fish in Worcestershire sauce and some Caesar dressings. Anchovies.
Egg in pasta. Fresh pasta usually contains egg. Some dried pasta doesn't. If you've swapped supplier mid-year, you may have swapped allergens mid-year without noticing.

Cross-contamination is the other one. Even if your flapjack recipe has no nuts, if it shares a worktop and a spatula with your Snickers brownie, you need to flag "may contain". Most cafés do this. Fewer update it when the production flow changes.

What a good system actually looks like

A live allergen matrix, tied to your recipes, where the source of truth is the ingredient - not the label.

Think about it like this. If your allergen data lives on a printed sheet, updating it means:

Someone notices the supplier changed.
That someone tells the chef.
The chef tells whoever prints the matrix.
The matrix gets reprinted.
The old one gets thrown out (usually doesn't).
New labels get printed and applied.

Six steps, six places it breaks. In practice, step one almost never happens, because the person who unpacks the delivery is rarely the person who owns the matrix.

Now flip it. If your allergen data is pulled from the ingredient records that already underpin your recipes, the moment an ingredient changes, everything downstream updates. Every recipe. Every label. Every sub-recipe that uses it.

That's the only system that keeps up with a menu that changes weekly.

How SafetyBrik handles this

SafetyBrik is our free food safety tool. Diaries, checklists, fridge temperatures, cleaning rotas - the usual day-to-day stuff that replaces the clipboard. Allergen matrix sits inside it.

Here's what makes it different. The matrix doesn't live on its own. It pulls directly from CostingBrik - the Brik where your ingredients and recipes are held. Each ingredient has a set of allergen tags. Each recipe inherits those tags from its ingredients. Each sub-recipe inherits from its parents.

Change the allergen flag on one ingredient, and every recipe using it updates instantly. Including nested ones - so if you've got a house béchamel that goes into three dishes, flagging milk on the béchamel's butter updates the béchamel, the lasagne, the fish pie and the cauliflower cheese, all in one move.

You don't need CostingBrik to use SafetyBrik's allergen matrix - but once you've got your ingredients in one, the other does the heavy lifting for free. That's the point.

A five-step audit you can do this afternoon

You don't need software to start. You need an hour and a pen.

Pull your current allergen matrix. Whatever form it's in - spreadsheet, folder, laminated sheet.
Check the date on it. If it's more than three months old, treat everything on it as suspect until proven otherwise.
Pick five recipes at random. Get the actual product specs from your suppliers - the ones on the invoice for last week's delivery, not the ones from when you onboarded them. Cross-check every ingredient against the matrix.
Walk the kitchen. Look at the things you've started doing that aren't written down anywhere. The splash of soy in the marinade. The pinch of mustard powder in the dressing. The new garnish on the breakfast bap. Write them down.
Update the matrix. Reprint the labels. Diary a reminder for three months' time.

If you've got more than one or two mismatches from step three, that's your answer to the "are we compliant?" question. You weren't. You are now. Book the next audit before you forget.

The bigger picture

Allergen labelling sits in the same bucket as hygiene ratings and paper food safety diaries. They're all things that reward systems over one-off effort.

The café that prints a matrix once a year and hopes is the same café that writes fridge temperatures on a clipboard the morning of the inspection. It works until it doesn't. And when it doesn't, the stakes aren't a bad review - they're a customer in A&E and a phone call you never want to make.

You don't need to solve this with a big IT project. You need to solve it by making the ingredient - not the label - the source of truth. Everything else follows.

The takeaway

Natasha's Law compliance isn't a one-off task; it's an ongoing sync problem.
Paper matrices go stale the moment a supplier swaps a product, and nobody tells you.
Tie your allergen data to your ingredients, not your labels, and it updates itself.
Do the five-step audit this afternoon. You'll learn more in an hour than you will from a year of hoping.

Your customers trust the label on the sandwich. Make the label something you can trust back.

Ed O'Brien has run Hunters Cake Company for 17 years across cafés in Witney, Burford, and a bakery in Carterton, Oxfordshire. He's building Brikly - modular tools that give independent café owners the same data the big chains have, without the big chain price tag.