The environmental health officer is going to ask one question. Not whether the team knows the fourteen allergens. Not whether the head chef briefed everyone after Natasha's Law passed. The question is: show me the record. And specifically, show me, for the person who took this allergen question yesterday, the named, dated, version-stamped record that they were trained, what they were trained on, and how you assessed it stuck.
Most UK food businesses can answer that question for their head chef and their general manager. Almost none can answer it confidently for the casual front-of-house staff member who took the call to confirm whether the crab cakes were nut-free on a busy Saturday night. That is the gap. And in the post-Pret era, with active coronial recommendations and a regulatory environment that increasingly treats allergens as a safeguarding question, that gap is the difference between a documented business that had a bad day and a business in front of a coroner.
This is a piece about the records. The training content itself is largely solved — the Food Standards Agency runs free, well-built allergen training that anyone can complete. What is not solved, and what most operators get wrong, is the evidence layer underneath the training. That is what we are going to walk through.
What the law actually requires
UK food law requires that food business operators make sure staff handling food are supervised and instructed or trained in food hygiene matters commensurate with their work activity. The specific allergen language is contained in EU Regulation 1169/2011, retained in UK law, which requires accurate allergen information be made available to consumers for the fourteen named allergens. Natasha's Law, which came into force in October 2021, extends labelling requirements to pre-packed for direct sale (PPDS) food.
Nowhere in this legislation does it say “all staff must complete the FSA allergen training annually.” What it says, in effect, is that the operator is responsible for ensuring staff are competent for their role. The question of how that competence is evidenced is left to the operator. Inspectors, insurers, and ultimately coroners then interpret what “evidence of competence” means in practice. The interpretation has been getting stricter year on year.
The mistakes that look fine until they don't
Three patterns dominate UK food businesses. All three feel like compliance and none of them is.
The handout signed in a group session. The shift manager hands out a printed copy of the fourteen allergens at the pre-shift briefing. Everyone signs a single attendance sheet at the bottom. The sheet goes into a drawer in the office. Six months later, when a casual member of staff who started two months after that session has served an allergen incident, there is no per-individual record showing what they were trained on. There is a sheet from before they were employed.
The free FSA training, untracked.The general manager sends round a link to the FSA allergen training and asks the team to complete it “by end of next week.” A few do. Most do not. There is no central record of who completed which module. The FSA training is excellent — but the platform does not, on its own, give the operator a defensible audit trail across their team.
The Word document acknowledgment.Each new starter is given a Word document titled “Allergen Awareness Acknowledgment” that they sign with a typed name at the bottom and email back. The document lives in a folder. There is no timestamp from a server, no version control on the document itself, no proof the person read it before signing. An inspector will accept it as a gesture and discount it as evidence.
What an inspector — and a coroner — actually looks for
The standard rises depending on who is asking. An environmental health officer doing a routine inspection will look for evidence the operator is taking allergens seriously. A coroner reviewing an incident is going to take that same evidence apart on the witness stand. It is worth building for the harder standard from the start.
Four components are non-negotiable.
Per-individual completion record. Each member of staff has a discrete record showing they completed the allergen training. Not a group sign-up. Not a shared sheet. A record that includes their name, the date and time they engaged with the material, what platform or document they engaged with, and a server-side timestamp that was not generated by them.
Version stamp on the content.The training content has a version number. If the operator updates the allergen content because, for example, the menu now includes PPDS items, the new version is dated and tagged, and the training record links the staff member to a specific version. “Trained on allergens” is not a record. “ Completed Allergen Training v3.2 (updated 2026-03-14 to reflect PPDS additions) on 2026-03- 19 at 14:32” is a record.
Knowledge check with judgment.Completion is not training. A staff member watching a video to the end is not proof of competence. A short knowledge check with scenario-based questions — “a customer says their child is severely allergic to nuts and asks if the brownies are safe; what do you do?” — gives the operator a defensible piece of evidence that the person actually understood the material. Aim for a first-attempt pass rate around 70 to 80 percent on judgment questions; if everyone passes first time, the check is too easy to be evidence.
Refresher cadence. A single completion is not a permanent qualification. The standard cited in industry guidance is a refresher every three months. The legal position is less prescriptive, but inspectors and insurers will treat anything beyond twelve months from last completion as substandard. Three months is gold; twelve months is the defensible ceiling.
Natasha's Law and the PPDS-specific evidence problem
Natasha's Law materially raised the standard for pre-packed for direct sale food. A sandwich made on the premises, labelled in-house, and put on a shelf for direct sale now requires full allergen and ingredient labelling. Staff who handle PPDS food need to be trained not just on the fourteen allergens but on the labelling process itself.
The evidence implication is that operators with PPDS food can no longer rely on a generic allergen training record. The record needs to show the staff member has been trained on the PPDS labelling procedure specifically — how to read the recipe, how to identify which allergens are in the specific product, how to write or print the label, and what to do when the recipe changes. A coronial inquiry into a PPDS-related incident is going to examine this specifically, and a generic “FSA allergen training completed” record will not be sufficient.
The 90-day refresher: where it comes from
The 90-day or 3-month refresher cycle is widely cited in food industry guidance. It has no statutory force. It originated in industry best practice and has been adopted by Allergy UK, Anaphylaxis UK, and a number of insurance industry guidance documents. The reasoning is that in high-turnover environments, allergen procedures drift quickly, new menu items introduce new allergen profiles, and even trained staff lose detail over time.
For most operators, 90 days is more frequent than is practical. A pragmatic position is: full training on induction, knowledge-check at induction, and a five-minute refresher plus knowledge-check every twelve months minimum, with an out-of-cycle refresher triggered by any material menu change or PPDS introduction. The record needs to show each of these events per individual.
What a defensible training register looks like
Pulled together, the register for a single staff member should show their name, role, and start date; the version of the allergen training they completed at induction with a server-side timestamp; their first-attempt knowledge check result with the questions retained; any subsequent menu-change refreshers tagged to the specific menu version; the last twelve-month refresher with knowledge check; and any incident-related learning events if they occurred.
Retrieval matters too. An inspector arriving for a routine visit will accept that records exist somewhere; they will not accept being kept waiting twenty minutes while the manager hunts through Drive folders. The defensible position is that any individual's full training history can be produced in under sixty seconds.
A spreadsheet on a shared drive can technically meet this standard. In practice it rarely does, because the cells get overwritten, the version control breaks, and nobody is tracking refresher dates against named staff. A structured system that links each staff member to a training record per version per date is the lower-friction path.
What this means in practice
The FSA allergen training is the easy half. The records are the hard half. If your current state is a folder of signed attendance sheets, a shared drive with PDFs, and a general sense that “the team has been trained,” the gap is not the training, it is the evidence. Closing it is a one-week project for a small operation and a longer project for a multi-site one, but it is doable and the cost-benefit is asymmetric.
Operators with our hospitality industry pack already have the allergen training register, refresher cadence, and PPDS-specific procedures wired into their training records. If you are starting from a blank sheet, the post on what auditors commonly ask for sets out the broader evidence model. The allergen piece is a high-stakes special case of that broader pattern, with the added twist that the audience asking the questions can include a coroner.