Allergens on the menu and website: what Swedish restaurants must show (2026)

The basic rule: fourteen allergens, always

The EU food information regulation (1169/2011) lists fourteen allergens in its Annex II: cereals containing gluten, crustaceans, eggs, fish, peanuts, soy, milk, nuts, celery, mustard, sesame, sulphur dioxide and sulphites, lupin and molluscs. For food that is not prepacked it is in practice the only information you must always be able to give, but it applies without exception, including to ingredients derived from them, such as wheat starch or soy lecithin.

How you give it is up to you. In writing on the menu or a sign by the dish, or orally. If you choose oral information and only on request, there must be a clear notice that the information is available. The Swedish Food Agency’s own example is a line on the menu: "Is there anything you cannot tolerate? Talk to us." The agency recommends written information because it reduces the risk of mistakes, but it is not a requirement. If the dish is named after its only allergen, like celery soup, the name is enough.

When the guest orders online, the rule changes

This is where most get it wrong. A takeaway ordered on the website, a pre-ordered cake, a catering order by phone: that is distance selling, and the sign in the premises is not enough. The Swedish Food Agency writes that information about allergenic ingredients must always be given before the purchase is concluded, and must also be available at delivery. It can be given on the web page or through a phone number with stated phone hours. At an inspection the question is simple: is it clear that the guest can get the allergen information before ordering?

On an order page this means in practice that the allergens are shown with each dish, visible before the dish goes into the basket, not in a PDF three clicks away. A free text box for "allergies and special diets" in the order is good, but it does not replace the information before the purchase. It is the guest’s question, not your answer. The same reasoning applies to catering quotes, where allergies can also be captured in writing in the order, and to the web shop if you sell food there.

The box has a trap I found in a review of the takeaway checkout I built for a bar. A guest wrote "Allergies: nuts" with a salad containing nuts in the basket, and the order went through without a word. Now the checkout reads the allergy box for the fourteen allergens and compares it with the dishes’ declared allergens, and on a clash a warning appears before the guest sends: remove the dish or call, and the kitchen will say what can be changed. The warning never promises that anything is free from anything; no clash only means that nothing the guest wrote is among the dishes’ allergens. And "nötkött", Swedish for beef, does not count as nuts.

"Gluten-free" is a promise, not a description

Saying what a dish contains is a requirement. Claiming it is free from something is voluntary, and for exactly that reason tightly regulated. The Swedish Food Agency is clear on four points that affect every menu and website:

• Only two expressions about gluten are allowed: "gluten-free" and "very low gluten", with the limit of 20 milligrams per kilo for gluten-free under EU regulation 828/2014. "Baked without gluten", "naturally free from gluten" and "contains no gluten" are not allowed.
• Free from and "may contain traces of" do not go together. A dish claimed to be free from an allergen must be safe for someone who cannot tolerate it, and so cannot at the same time warn of traces.
• General signs mislead. The agency advises against "suitable for people with allergies" or a heading such as "gluten-free dishes", because people with allergies are a mixed group and an ordinary dish easily ends up under the wrong heading.
• The promise requires routines in the kitchen. To call a dish suitable for people with allergies, the restaurant must have routines from goods reception to serving. Flour dust from the pizza next to it makes the gluten-free pizza unsafe.

The practical advice is therefore the same as the Swedish Food Agency’s: state which allergens are included, consistently with every dish, and let the guest see for themselves what is missing. That is allowed, safe and enough for the vast majority. "Free from" is for those who have the kitchen and the routines for it.

Where the promise slips out: the website and the AI chat

When I tested the AI chat on a konditori site I am building, I asked the question that sooner or later comes for real: "Is the Kiddevipp gluten-free? My daughter has coeliac disease." A chat that searches the site’s texts finds the cake’s description with high confidence and replies with it, a text that answers a different question but reads exactly like an answer to this one. So allergy questions are caught before the search runs at all. The chat never answers yes or no. It says the labelling is shown with every cake, that everything is baked in the same bakery where gluten, nuts, milk and eggs are present, and hands the question to the staff, who get it in their email and can reply to the guest directly.

Two more gates sit in the code and not in the chat’s instructions, because instructions are usually followed and code always is. A reply in which the model says something is free from an allergen is never shown, whatever the site’s texts say, because a model’s promise cannot be stood behind. When the owner writes "gluten-free" about their own cake it is not blocked, but it must be confirmed with a click, and who and when is saved. The same principle as in the newsletter, where the words "free from" may never leave the building in an AI-written mailing.

The most uncomfortable finding came in a review. The check for free-from claims ran on the fields someone had listed by hand, and seven fields on three screens were missing. "Free from gluten" typed into a product’s origin field was shown on the order page in three languages and also read into the chat’s knowledge. The fix was to make it impossible to forget: every field a guest can read must now be declared, or the site will not build. The lesson holds whoever builds your site. Do not only ask whether the menu has allergens, ask where else text can be written that the guest sees.

What to do: seven points for the menu and website

1. Allergens with every dish, as text. Not in a PDF or an image. Text can be read by the guest on a phone, by a screen reader and by Google.
2. The same fourteen names, the same order, everywhere. Consistency lets the guest quickly see what is missing, which is the whole point.
3. The line about asking. "Is there anything you cannot tolerate? Talk to us" on the menu and on the site, with phone number and hours when you take orders.
4. Allergens before the basket. On the order page they must be visible before the dish is added, not only on the receipt.
5. A box for the guest’s allergies in the order, which travels with the order to the kitchen and shows on the slip at pickup.
6. One source. The dish and its allergens are entered once and drive the menu, the order page and the chat. Two lists drift apart the first time the recipe changes.
7. No free from without routines. And never from an AI, whether in the chat, the translation or the newsletter.

When I build a site for a restaurant, a café or a konditori, this is in the foundation: an order page that shows the allergens with every dish before the purchase, a chat that hands allergy questions to you, and gates against free-from promises in code. How the rest of a restaurant site fits together is in that guide, what it costs is listed openly under services, and you can read who builds it under about me.