“May contain traces”: when should you actually write it?

On many packs, “may contain traces of…” has become a reflex: you write it because you cannot quantify the risk. Allergic consumers end up ignoring it, or giving up products they could safely eat. Regulators and international standards are now pushing the other way: a precautionary statement that rests on a calculation, product by product. The question is where the numbers come from.

Why blanket precautionary labeling no longer holds

Regulation (EU) No 1169/2011 governs the declaration of allergens that are intentionally part of a recipe. On precautionary allergen labeling (PAL) it sets a single rule: like any voluntary information, the statement must not mislead the consumer (Article 36). The implementing rules the Commission was meant to adopt have never been adopted. So every manufacturer has set its own rule: an internal threshold, a precautionary principle, or a default statement as soon as a line is shared.

The United States follows the same logic: the law does not regulate “may contain”, but the FDA requires it to be truthful and not misleading, and it is never a substitute for preventive controls. See our post on US food allergen labeling.

Several pieces of work changed that:

• the FAO/WHO expert consultation established reference doses per allergen, expressed in milligrams of protein;
• the Allergen Bureau adopted them in 2024 in VITAL 4.0, which replaces VITAL 3.0;
• in the Netherlands, industry and retail (FNLI, CBL) published cross-contact guidelines with the NVWA, and the reference doses are set in a national policy rule that applies to everything produced since 1 January 2026;
• in July 2026, the Codex Alimentarius Commission adopted international guidelines on precautionary labeling, based on risk assessment.

The common principle: a precautionary statement is only justified if the amount of allergen likely to be eaten on one occasion exceeds a reference dose.

Two contaminations, two different calculations

Unintended presence takes two forms, and mixing them up breaks the whole reasoning:

• homogeneous contamination: flour dust, residues on a shared line, rinse water. It is expressed in ppm and it dilutes in the recipe;
• particulate contamination: a whole seed lost in a batch of oats, a fragment of nut. It does not dilute: the consumer either bites into it or does not.

So the supplier declares two different things. On the seed topping in our example, gluten is an intentional ingredient at 60 %, sesame is declared as a 0.0026 g particle containing 18 % protein, and soy as homogeneous contamination at 5 ppm. To keep things simple, the finished product in the example contains only this topping, so the concentrations are not diluted.

The action limit belongs to the product, not to the plant

This is what surprises people most: there is no single threshold. The limit above which the statement is justified depends on how much of the product is eaten on one occasion, which is not necessarily the serving on the nutrition label.

Action limit (ppm) = reference dose (mg) ÷ amount eaten (kg).

For a 250 g baguette eaten at one meal, the action limit for soy is 2 ppm with the former VITAL 3.0 dose (0.5 mg), and 40 ppm with the ED05 dose of VITAL 4.0 and the Dutch grid (10 mg). If the finished product carries 5 ppm of soy, it exceeds the first limit and stays far below the second. A product eaten 10 g at a time would have a completely different limit.

In beCPG PLM, those two parameters live on the finished product record: the amount eaten, and the reference dose grid that applies to the target market (VITAL 4.0, the former VITAL 3.0 grid, the Dutch grid or a company grid). The formulation engine derives the rest from data already captured on the raw materials.

One product, two reference doses, two labels

Here is the same baguette, with the same raw material and the same contaminations, assessed against two grids. Under the former VITAL 3.0 grid, based on the ED01 dose, both sesame and soy are retained as unintended presence to declare.

Under ED05 doses, those of the Dutch grid (below) as well as VITAL 4.0, neither is. The sesame seed brings 0.47 mg of protein: above the former VITAL 3.0 dose (0.1 mg), well below the ED05 dose (2 mg).

This is not a contradiction; it is a level of protection. ED01 is the dose at which 1 % of allergic people would show objective symptoms; ED05, 5 %. The FAO/WHO experts chose ED05: going lower does not meaningfully reduce the risk, as reactions at that dose are mild to moderate, but needlessly deprives allergic consumers of products. Where no grid is mandated, the choice stays with the company, market by market, and it needs to be dated and documented; in the Netherlands, ED05 doses have applied since 1 January 2026.

What you need in place

Moving from a precautionary statement by default to a calculated one takes three things, and no more:

• a usable supplier declaration: a concentration in ppm, or the mass and protein content of a particle;
• the amount eaten recorded on every finished product;
• an explicitly chosen reference dose grid, with its effective date.

This is why the calculation belongs in the product repository rather than in a spreadsheet: when a supplier revises a declaration or a grid changes, the affected products can be reformulated and re-assessed, and the decision can be replayed in front of an auditor. It is the direct extension of tracking allergens from raw material to finished product: the data is already there, it now decides.

The question is no longer “should we write may contain?”, but “what does the calculation say, and against which grid?”. If you want to see what that looks like on your own recipes, let’s talk.