The Nine Major Food Allergens (And Why Sesame Still Bites)

Introduction

On 1 January 2023, sesame became the ninth major food allergen in the United States. Within months, parents of sesame-allergic children were finding sesame in bread that had never contained it.

Not by accident. Commercial bakers had run the numbers: adding sesame flour to a recipe and declaring it on the label costs less than cleaning a line well enough to keep sesame out. A law meant to give allergic families more safe choices left them with fewer.

That is the whole problem in miniature. Undeclared allergens account for 85 of the 237 FDA food recalls logged so far in 2026, more than any other single cause. Milk alone was missed on twenty labels. And a recall doesn't stay on paper — it empties shelves and freezes shipments, the way the blueberry recall did earlier this year.

Almost every food business can recite the nine. Far fewer can say where each one enters the building, what it touches on the way through, and who confirmed it was gone. That gap is what food safety culture looks like in practice.

The Nine at a Glance

Why these nine and not others

"Major food allergen" is a legal category, not a medical one. More than 160 foods have been documented to cause allergic reactions in the United States. Nine of them carry a mandatory declaration.

Congress drew the first line in 2004 with the Food Allergen Labeling and Consumer Protection Act. FALCPA named eight — milk, eggs, fish, crustacean shellfish, tree nuts, peanuts, wheat and soybeans — on the basis that they accounted for more than 90 percent of documented food allergies in the country at the time. The ninth took another seventeen years. The FASTER Act was signed in April 2021, and sesame's requirements took effect on 1 January 2023.

Everything outside that list is unregulated by name. Mustard, celery, lupin, and molluscs such as clams and oysters can all send someone to hospital, and none of them triggers a declaration in the US. The EU regulates fourteen. A product that is perfectly legal on a shelf in Ohio can be non-compliant in Dublin.

Which rulebook applies to you

Three federal agencies split the work, and operators read the wrong one more often than you would expect.

• FDA covers packaged food and dietary supplements. FALCPA lives here.
• USDA's Food Safety and Inspection Service covers meat, poultry and processed egg products. A frozen chicken pot pie is FSIS territory; the frozen vegetable pot pie beside it is FDA's.
• TTB covers most alcoholic beverages, where allergen labelling is largely voluntary.

FALCPA also carves out raw agricultural commodities, highly refined oils, and any food not pre-packaged with a label.

That last exclusion is the one that catches people. FALCPA does not govern the sandwich your line cook assembles to order. Something else does, and we will get to it.

The Ninth One: How a Law Meant to Help Backfired

Sesame allergy affects more than 1.5 million Americans, and roughly half of them are children. The FASTER Act was supposed to make their lives easier.

The bill was signed in April 2021, giving manufacturers twenty months to prepare. Sesame is genuinely hard to remove from a bakery. The seeds are small, they travel, and a line that has run sesame buns for thirty years has sesame in places nobody thinks to look. Getting it out means dedicated equipment, revised schedules and validated cleaning, and all of that costs money.

There was a cheaper option. Add sesame flour to the recipe, declare it on the label, and you are compliant by definition. You cannot fail to control an allergen you have deliberately made an ingredient.

By late 2022, weeks before the deadline, bakers had started doing exactly that. Products that had never contained sesame began carrying it. FARE's vice president of regulatory affairs called the practice "malicious compliance". Olive Garden switched bakery suppliers in October 2023 so its breadsticks would be sesame-free again.

On 2 May 2023, Senator Ron Wyden and Representatives Doris Matsui and Patrick McHenry led a letter to the American Bakers Association, cosigned by five other members of Congress. Manufacturers were adding trace sesame, they wrote, apparently "to avoid the costs associated with the processes and systems controls necessary" for safe baking.

Then it escalated. On 17 June 2024, after inspections at plants in Phoenix and Topeka, the FDA issued a warning letter to Bimbo Bakeries USA — the country's largest commercial baker — for listing sesame and tree nuts on four Sara Lee breads and a Brownberry loaf that did not contain them at all. Misbranded, either way.

Bimbo did not back down. In a response obtained under FOIA, the company argued that uniform national labelling was the "most protective approach for sesame-allergic consumers", since the same product is baked at different facilities under different conditions.

Here is the part that matters for your operation. CSPI petitioned the FDA to ban the practice outright. The FDA declined. It can stop a false ingredient declaration. It has no authority to stop a company adding a real one.

So the law will not make this decision for you. Adding the allergen is legal. Controlling it is harder, costs more, and is the answer an inspector, a plaintiff's attorney and a customer will all judge you by. It is also, in the end, a hazard like any other — one you either find in your own building or discover when someone else does.

Cross-Contact Is Not Cross-Contamination

Most food safety training spends its time on pathogens. Sanitiser, temperature, time. That training builds an instinct, and the instinct is wrong for allergens.

Sanitiser kills bacteria because bacteria are alive. An allergen is a protein. It is not alive, so there is nothing to kill. A quat solution at the correct concentration and contact time will pass every verification you run, and the peanut protein on that surface will be exactly where it was before you started. Heat does not reliably destroy it either. A fryer at 175°C does not denature peanut protein into something a sensitive customer can safely eat.

This is why cross-contact has its own name. Cross-contamination is a microbe moving from one food to another, and you kill it. Cross-contact is an allergen protein moving, and you can only physically remove it — wash with detergent, apply mechanical action, rinse, and get it off the surface and out of the room.

That distinction rewrites four things in a working kitchen or plant.

Run order becomes a control. Schedule allergen-free product first, when the line is at its cleanest, and run allergen-containing product last. Within a shift, sequence from fewest allergens to most. A full wet clean between changeovers takes time you have to build into the schedule rather than hope for.

Dedicated equipment beats cleaned equipment. Separate slicers, fryers, utensils and colour-coded tools remove the failure mode instead of managing it. That is simply the hierarchy of hazard control applied to a protein: eliminate where you can, substitute and segregate where you cannot, and fall back on procedure only when there is nothing better left.

"It looks clean" is not a result. Visual inspection cannot detect allergen residue. Validate with protein swabs or allergen-specific test kits, record the result, and treat a failed swab the way you would treat a failed temperature log.

Allergens travel through the air. Flour is the one people miss. Wheat flour and sesame flour both aerosolise, settle on surfaces two rooms away, and land on product that never went near the bag. The same is true of shared fryer oil, which carries protein between every basket that touches it.

None of this is knowledge a manager can hold alone. The person who decides the run order is rarely the person who wipes the slicer at 11pm, and the control only works if both of them understand why it exists. That is what allergen awareness training is actually for — not the list, which anyone can memorise, but the reasoning that tells a cook why the sanitiser bucket is not the answer.

What the Law Actually Requires of You

If you package food, FALCPA gives you two legal ways to declare an allergen, and only two.

Name the source in parentheses immediately after the ingredient — lecithin (soy), whey (milk), flour (wheat). Or put a "Contains" statement directly after the ingredient list: Contains wheat, milk and soy. One or the other, at least once on the label. An ingredient whose common name already carries the source, like buttermilk, satisfies the rule on its own.

Three of the nine demand more detail. Tree nuts, fish and crustacean shellfish must be declared by species — almond rather than tree nut, cod rather than fish, shrimp rather than shellfish. "Contains tree nuts" on a product made with cashews is a labelling violation, not a shortcut.

Several things sit outside FALCPA entirely: raw agricultural commodities, highly refined oils, most alcoholic beverages, and any food not pre-packaged with a label.

"May contain" is not a legal statement

Advisory statements — may contain peanuts, produced in a facility that also processes sesame — are voluntary. The FDA does not define them, does not set a threshold behind them, and has never established an action level for any allergen. Two products carrying identical advisory wording can represent completely different levels of risk.

The FDA's position is that these statements must be truthful and must not substitute for good manufacturing practice. Printing "may contain" instead of cleaning the line is not a control. It is a disclosure of a control you did not build, and it will be read that way in an inspection and in a courtroom.

If you serve food rather than package it

FALCPA does not reach the sandwich made to order. The FDA Food Code does. It makes allergen knowledge a duty of the Person in Charge, who must be able to identify the major allergens in the food their establishment serves. Most states adopt the Food Code into their retail food regulations, which means your health inspector can already ask.

State law goes further in places. FARE tracks six states with restaurant food allergy laws — California, Maryland, Massachusetts, Michigan, Rhode Island and Virginia — while Illinois, New York, New Jersey and Minnesota have their own requirements, alongside cities including New York City and St. Paul. Requirements range from a poster in the staff area to a menu notice to a trained certified manager on duty whenever you are open. Illinois specifies accreditation standards for the training itself.

Registered manufacturing facilities carry a further obligation. Under FSMA, allergen preventive controls sit alongside process and sanitation controls in your food safety plan — which is one of the practical places HARPC and HACCP diverge. And because allergen information has to reach the people handling the product, the same discipline that governs a hazard communication program applies here: the label is only useful if it is read.

Building Allergen Control Into Your Food Safety Program

Allergens are not a labelling problem that happens at the end of the line. They are a hazard, and they belong in your hazard analysis alongside pathogens and metal fragments.

That framing matters because of where allergens sit in the seven HACCP principles. Most plans classify them as a chemical hazard. If yours doesn't name them at all — and plenty of older plans don't, because they were written before sesame and before FSMA — the gap isn't a paperwork issue. It means nobody has formally asked where the allergens are.

Six steps close it.

1. Map every allergen by ingredient and by line. Go through each spec sheet, not each label. Then map where those ingredients physically travel: receiving, storage, prep, the specific equipment, rework, packaging. You cannot control what you have not located.
2. Identify every cross-contact point. Shared equipment, shared utensils, shared oil, rework, airborne flour, staff moving between stations. This is ordinary hazard analysis applied to protein instead of bacteria.
3. Write the control. Dedicated equipment where possible, sequencing and full wet cleans where not. Name the person, the frequency and the record. A control that exists only as an understanding is not a control.
4. Validate the cleaning. Prove the procedure removes the allergen before you rely on it, using protein swabs or allergen-specific kits. Validation happens once, when you design it. Verification happens continually, after.
5. Train every shift, not just the manager. The certified manager is one person on one shift. The closing cook who wipes the slicer at 11pm is the control. If they don't know why sanitiser isn't enough, the plan fails at the point it matters.
6. Verify, then verify again. Swab results, label checks at changeover, supplier spec reviews when a formulation changes without notice. Suppliers reformulate quietly and often, and a spec sheet from 2023 is not evidence about what arrived this week.

None of this is unfamiliar territory if you already run a HACCP plan — it's the same discipline, pointed at a different hazard. What makes it hold is whether people follow it when nobody is watching, which is what a strong food safety culture looks like in practice rather than on paper.

Key Understanding

Sesame is still on bread that never needed it. Three years after the deadline, that decision stands — legal, disclosed, and still narrowing the shelf for 1.5 million people.

The nine are easy. You could name them from the cards at the top of this page. What separates a compliant operation from a lucky one is everything the list doesn't tell you: which line the tahini travels down, who cleans the slicer at close, and whether the swab was taken or just recorded.

That part isn't on the label. It's in how your kitchen runs on a Tuesday when nobody is watching.