13.7% of reactions: menu declared it and staff were told

The single most-quoted allergen statistic in restaurant writing is that 53.9% of reactions in restaurants happened after the guest told the staff. It comes from a 2021 study in The Journal of Allergy and Clinical Immunology: In Practice analyzing 2,827 reported reactions.

Two numbers from the same study almost never get quoted, and they're the ones that should change what you do:

• 26.6% of reactions occurred where the allergen was declared on the menu.
• 13.7% occurred where the menu declared it and the guest told the staff.

Both safeguards in place, and roughly one time in seven it still went wrong. Which means signage and disclosure are not the protocol. They are the first two links in a chain, and the failures happen further down it.

This post follows one disclosure from the guest's sentence to the plate, because every documented failure mode is a break somewhere along that path.

Where the risk actually sits

Dining out accounts for 21% of all reported reactions — 13% for children, 31% for adults. Home is still first at 44%, but for adults restaurants are the dominant out-of-home risk, more than double the school figure for kids.

The venue mix is not what people assume:

High-volume, high-turnover, counter-service formats lead. Fine dining is not the concentration.

Severity, from the same data: 28.0% of restaurant reactions required one dose of epinephrine, 6.2% required two, 6.2% resulted in hospitalization, 1.8% in an ICU admission.

And the allergen driving the most epinephrine use in restaurants is tree nuts, not peanuts. The study's authors attribute it to lower staff awareness and hidden substitutions — their example is pesto made with walnuts or cashews rather than pine nuts. Your kitchen knows peanut is an allergen. It may not think of the pesto.

For prevalence: national health survey data published in January 2026 puts diagnosed food allergy at 6.7% of US adults and 5.3% of children, with a notable disparity — 9.9% among Black non-Hispanic adults versus 6.4% among White non-Hispanic adults. These are self-reported diagnoses, so don't read 6.7% as 6.7% at risk of anaphylaxis.

Cross-contact is not cross-contamination

This is the distinction that decides whether a protocol works, and it gets collapsed constantly.

Cross-contamination is the transfer of pathogens. Heat kills them. Every instinct your kitchen has about food safety is built on that.

Cross-contact is the unintentional transfer of allergenic protein. Cooking does not destroy it. A grill hot enough to make chicken safe does nothing whatsoever to peanut protein sitting on it.

Which means the entire mental model your staff learned in food safety training points the wrong way here. "It's been through the fryer, it's fine" is correct for salmonella and dangerous for a wheat allergy.

Worth knowing: "cross contact" has no codified definition in the FDA Food Code. It's defined in federal regulation at 21 CFR 117.3 — which governs manufacturers and processors, not restaurants. The Conference for Food Protection formally raised that gap at its 2023 biennial meeting. So the central concept in restaurant allergen safety is one the model code your health department uses doesn't actually define.

What the law does and doesn't require of you

Start with the correction most operators need: federal allergen law does not reach your menu.

FALCPA — and the FASTER Act that added sesame as the ninth major allergen effective 1 January 2023 — governs packaged food labels. There is no federal requirement that a restaurant disclose allergens on a menu. Whatever duty you have comes from your state.

The FDA Food Code does require the person in charge to demonstrate knowledge of the major allergens and the symptoms they cause. But the Food Code is a model with no force of its own, enforceable only where a state adopts it — and as of the most recent adoption report, 11 agencies across 7 states, covering about 16% of the US population, were on the 2022 edition containing that provision.

State law is where the real obligations are, and 2026 is the year they changed:

Two of those need detail because the coverage of them has been sloppy.

California's ADDE Act took effect on 1 July 2026 — and it applies only to chains with 20 or more locations operating under the same name with substantially the same menu. Covered operators must identify all nine allergens known, or that reasonably should be known, to be in each item, either adjacent to the item on the menu or digitally via QR code — with a non-digital alternative always available. Most coverage says "California now requires allergen menus" without the twenty-location gate. An independent California restaurant has no such duty.

New York's premises-packing law takes effect 12 November 2026 and is the first of its kind: allergen labels on deli, bakery and café grab-and-go packed on site. It does not cover food packed after the customer orders, so a made-to-order sandwich is out and the pre-made case is in.

One to ignore: Michigan HB 5402 is not law. It was introduced in December 2025 and referred to committee. Several vendor articles report it as effective November 2026. It isn't.

The sesame problem, which is the opposite of what you'd expect

Adding sesame as the ninth major allergen made things worse for a chunk of the food supply, and this is the operational fact most likely to bite a kitchen that thinks it's careful.

Rather than validate cross-contact controls on their lines, a number of large commercial bakeries began deliberately adding sesame flour to breads that never contained it, and declaring it — technically compliant, and cheaper than cleaning. Named companies include Flowers Foods and Bimbo Bakeries, and suppliers to Olive Garden, Wendy's and Chick-fil-A acknowledged the practice. The Center for Science in the Public Interest petitioned the FDA in January 2023 to bar it. The FDA denounced the practice and issued guidance pointing industry toward real controls in September 2023 — but did not prohibit it.

The operational consequence is specific: because it goes in as flour, not seeds, it is invisible. You cannot look at a bun and tell. A hamburger bun, hoagie roll or dinner roll that was sesame-free in 2022 may contain sesame in 2026 with no visible change and no notification to you.

You will see claims about how many products this affected. I couldn't find a source for any of those numbers, so I'm not giving you one. What I am confident saying is that bread is now the highest-risk unverified ingredient in a typical American kitchen, and that a "no sesame" assurance given from memory is unreliable until someone re-reads the spec sheet.

The controls almost nobody has

The best data on what US restaurants actually do comes from CDC environmental health surveillance. It's published from 2014 fieldwork, so treat the vintage honestly — but nothing suggests it has transformed:

A quarter of restaurants have no documentation of what is in anything. You cannot verify an allergen you have no document for, and every downstream control depends on that one.

The training numbers are the same story: 44.4% of managers, 40.8% of food workers, and 33.3% of servers had received any food-allergy training. And more than 10% of managers and staff believed a person with a food allergy could safely eat a small amount of their allergen. That belief is what produces "I just scraped the cheese off."

The shared fryer deserves its own mention because it's the most common single failure: gluten-free fries cooked in oil that also fries wheat-breaded chicken are not gluten-free, and only one restaurant in ten with a fryer has a dedicated one.

On which — a "gluten-free" menu claim is a voluntary claim that becomes a consumer-protection exposure. The federal standard of under 20 parts per million applies to packaged foods; for menus the FDA recommends consistency with it rather than requiring it. But that 20 ppm figure is what a plaintiff's expert will measure against. With a shared fryer, shared pasta water, or flour in the air, it is not achievable. "We don't have a gluten-free kitchen — here is what we can do" is both more honest and more defensible than a GF flag on the menu.

Following the disclosure to the plate

The 2021 study names the mechanism behind the failures directly: communication breakdowns between patron, server and kitchen — language barriers, perceptual differences, distraction and noise in a busy room.

That is a transmission problem at least as much as a preparation problem. Guest to server, server to expo, expo to line: three verbal handoffs in a loud room, each one lossy, and the 53.9% figure is what that produces.

I should be straight about my position here. I work at a POS company, so I have an obvious interest in the conclusion that this information belongs in a system rather than in someone's head. There is also no authoritative standard for how allergen flags should work in a POS or kitchen display — the published guidance on it is all vendor material, including material from companies like mine. So take the following as reasoning from the failure data rather than as sourced best practice:

If the allergen exists only in the server's memory between the table and the terminal, it has already survived a hop it didn't need to. Capturing it as structured data at the point of order — a modifier, not a free-text note — is what makes it routable, reportable, and capable of forcing an acknowledgment. It needs to attach to the item, not the ticket, because a table-level note doesn't tell the sauté station which plate. It should surface at every station that touches the dish plus expo, not only the first. And it has to survive a re-fire, because the remake is a classic failure point: the original ticket carried the flag and the replacement didn't. If you run a kitchen display, this is the argument for it that isn't about ticket times — I wrote about the rest of that case in the KDS post.

A protocol that holds up

1. Supplier ingredient documentation for every purchased item, in writing, re-verified on any supplier or formulation change. This is the sesame-flour catch, and a quarter of restaurants have nothing.
2. A master ingredient list per menu item, maintained and available — the same standard Massachusetts and Rhode Island attach to their voluntary "food allergy friendly" designations.
3. Dedicated utensils and boards, and a dedicated fryer where the volume justifies it.
4. Order of preparation — allergen-free orders made first, on cleaned surfaces, before allergen-containing production runs.
5. Named manager verification before the plate leaves, logged. This is the step that later proves the protocol ran.
6. Written procedures for a reaction: who intervenes, whether epinephrine is stocked, when to call 911. Not required by the 2022 Food Code; recommended by the Conference for Food Protection; and required in substance by Connecticut's poster content.
7. Training past the certificate. Illinois's 2026 gluten and celiac requirement — 30 days from hire, renewed every three years — applies to managers only, not to the line cook plating the dish or the server answering the question. The certificate on the wall is not a trained staff. This belongs in onboarding, not in an annual class.
8. Change control. Any supplier swap, recipe change, or new sauce base triggers allergen re-verification. This is what catches the bun that quietly gained sesame flour.

One last thing about liability, because it shapes how staff should be trained to speak. In the litigation that has followed restaurant allergen deaths, the pleaded theory is typically not that the restaurant failed to post a notice. It is that staff affirmatively assured the guest the meal was safe. An assurance converts a general duty of care into a specific undertaking.

Which argues for teaching a different sentence. Not "you'll be fine" — "here is exactly what we can and cannot control in this kitchen." That is a harder thing to say to a guest, and it's the honest one.

Related Katalyst products

• See Katalyst KDS