Allergens in a chicken restaurant: menu disclosure and preventing cross-contact

Many chicken-restaurant operators assume the allergen file belongs to bakeries, dessert shops and seafood restaurants, because chicken meat itself is not among the ingredients that must be declared. That is true in the letter and misleading in the result: the plate you serve is not chicken alone — it is chicken inside a flour coating, soaked in buttermilk, dipped in egg, between two halves of a sesame-topped bun, next to a sauce containing mustard or tahini, fried in oil it shares with other items. Every one of those stations is either an ingredient that must be declared or a potential cross-contact point, and together they make a chicken kitchen one of the most allergen-dense kitchens there is, not one of the lightest.
Menu disclosure is a legal obligation, not a courtesy#
Saudi technical regulation SFDA.FD 56, "Disclosure of allergens in the menus of food establishments serving food outside the home", requires every out-of-home food establishment to disclose, and the Saudi Food & Drug Authority began enforcing it on 1 October 2019. Its scope is wider than most people assume: restaurants, cafés, bakeries, dessert shops and cafeterias; outlets inside shops, supermarkets, amusement parks, universities and government bodies; fixed and mobile food kiosks; food-delivery service companies; childcare and healthcare centres; and even charities handing out free meals. It also applies to establishments that supply other food establishments rather than the final consumer — that is, to the central kitchen feeding your branches.
The form of the disclosure is specified too: allergen information must be easy to reach and in a place clearly visible to the consumer, legible and easy to understand, written in Arabic — it may be translated into another language alongside it provided the wording does not differ from the Arabic — and it must appear on every type of menu you operate. In practice: the printed menu, the board above the till, the drive-through menu and your page inside the delivery app must all carry the same information, not divergent versions of it.
The list you must declare#
The ingredients the Authority's guide requires you to declare whenever a meal contains them are:
- Gluten-containing cereals: wheat, barley, oats and rye, whether original varieties, hybrids or their products.
- Crustaceans and their products: shrimp, crab and lobster.
- Fish and fish products, such as fish flesh and fish oil.
- Eggs and egg products, such as mayonnaise.
- Peanuts and peanut products, such as peanut butter.
- Tree nuts and their products, such as cashews and pistachios.
- Milk and lactose-containing dairy products.
- Sesame seeds and their products, such as sesame oil.
- Mustard and its products: mustard seed, mustard oil and mustard sauce.
- Soybeans and their products, such as soy milk.
- Celery and its products, such as celery seed and celery salt.
- Molluscs and their products: squid, sea snail, mussels and scallops.
- Lupin and its products, such as lupin oil.
- Sulphites at a concentration of 10 ppm or more.
Where those ingredients hide in a chicken kitchen#
The common mistake is to read a menu item by its name rather than by its components. "Broasted chicken" is a name that discloses nothing, while in practice it may carry four allergens at once. Read your menu this way:
- Coating, breadcrumbs and dredge flour: wheat, i.e. gluten — the most common allergen in a chicken restaurant.
- Buttermilk or yoghurt soaks, or milk powder inside a dry rub: milk.
- The wet dip before breading: egg, in most recipes.
- Buns and bread: wheat, and usually sesame scattered on top.
- Sauces: mayonnaise (egg), garlic sauce or tahini (sesame), honey-mustard and mustard sauces (mustard), and soy sauce in Asian marinades (soy, and usually wheat with it).
- Stock cubes, bouillon powders and ready-made spice blends: celery is common in them, sometimes soy and wheat too.
- Pickles, prepared salads and made-up drinks: sulphites.
- Neighbouring items on the same line: seafood dishes, or nuts in a dessert prepared on the same surface.
Watch sesame in particular in the Saudi context. A systematic review published in Frontiers in Public Health in 2026 notes that sesame allergy is more common in Saudi Arabia than in Western countries, likely linked to early and frequent exposure to local foods containing it such as tahini and halwa. In a chicken restaurant sesame enters through two doors that are rarely noticed: the seeds on the bun, and tahini inside a white or garlic sauce.
Cooking does not remove an allergen#
This is the point that separates the allergen file from the rest of food safety. The Codex Alimentarius Code of Practice on Food Allergen Management (CXC 80-2020) states that treatments lethal to pathogenic microorganisms — heat, high pressure and the like — generally do not destroy allergenic proteins. The 74°C that kills Salmonella does nothing to a milk or wheat protein. This hazard is therefore not managed by cooking, but by separation, cleaning and disclosure.
The code narrows cross-contact during preparation down to four routes, all of them present in a chicken kitchen: food to food, by contact or dripping; food to hand to food, when a hand moves between containers of different ingredients without washing in between; food to equipment, utensil or surface to food, such as using the same board or pan for two different items; and food to cooking medium, such as shared fryers or boiling vats. That last route is the famous one in chicken restaurants, and the code gives it the sharpest example: do not use the same oil to fry battered fish and potatoes, because the coating particles end up in the potatoes.
The Authority's guide settles the same case with two explicit examples: potatoes fried in peanut oil — the warning here is mandatory, because the oil itself is an allergen; and a vegetable oil that contains no allergen but was previously used to fry fish — here too, naming fish is mandatory, using the precautionary form "may contain". Apply the same logic to your own vat: if one fryer cooks flour-coated chicken and potatoes, your fries are not gluten-free whatever their ingredient list says.
Two forms, not one: "contains" and "may contain"#
The guide sets out two forms: "contains …" when the product actually contains an allergen, and "may contain …" or similar wording to flag the possibility of cross-contact. The difference is not cosmetic: the first is an ingredient statement, the second is a warning about a transfer route. The guide adds an important constraint that is often broken: a precautionary statement such as "may contain" or "meals are prepared in a facility that handles …" does not substitute for the allergen warnings required by SFDA.FD 56. You cannot write one blanket sentence at the bottom of the menu and consider the file closed.
Different channels have specified forms too. At a buffet, allergens are shown for each dish separately and beside it. For orders placed electronically or by phone, disclosure must reach the consumer before the food is ordered, and again on delivery, verbally or in writing. For drive-through, the information must be in the drive-through menu before the order is handed over. Pre-packaged wrapped foods that already carry an ingredient statement need not have the disclosure repeated in the menu. And there is one logical exemption: if the dish's own name carries the allergen — "grilled fish" — it need not be repeated, but if the dish carries other allergens not visible in its name — "breaded fried fish" — all of them must be stated.
What to do when a customer says: I have an allergy#
This moment is the test of the whole system, and it cannot be left to the judgement of whoever is standing at the till. The Codex code states that front-of-house personnel serving food should be knowledgeable about the allergens in menu items and about preparation practices that may cause cross-contact — or know how to obtain that information. It adds an explicit rule that is often dodged: where the operator and their personnel cannot ensure that a food does not contain an allergen, this should be clearly communicated to the customer. A polite "we cannot guarantee it" is safer than a promise you cannot keep.
- Listen and record: ask exactly which allergy it is, and never assume it is "mild".
- Go back to the written allergen file — not to memory, and not to the cook's guess.
- Tell the kitchen about the order explicitly before preparation starts, not alongside the rest of the tickets.
- Prepare on a clean surface with clean utensils, and change gloves after washing hands before starting.
- Separate the cooking medium: a dedicated pan or fryer where feasible; where it is not, say so and do not promise what you cannot guarantee.
- Do not substitute one ingredient for another outside the recipe unless you are certain it adds no new allergen.
- Hand the plate over deliberately, with a clear statement of what was done and what could not be guaranteed.
The file that makes all of this possible#
A front-of-house employee cannot answer correctly unless there is a file behind them. The basis of that file is a simple matrix: a row for every menu item, a column for each of the fourteen allergens, and a mark at the intersection whose source is the ingredient labels, not memory. The Codex code advises retail and food-service operators to purchase ingredients whose allergen profile is known, and gives a decisive example: if a ready-made mix does not list its contents, it should not be used. It also advises inspecting raw materials on receipt and checking that containers are intact, rejecting or properly disposing of an ingredient when a container is damaged or shows evidence of cross-contact, and storing allergen-containing ingredients so that transfer is prevented — for instance below those that contain no allergen.
The code also specifies the records worth keeping in a restaurant: the allergenic ingredients associated with each menu item, written cleaning procedures, procedures for handling orders from customers with allergies, and a training log naming who was trained, on what and when. It further stresses that restaurants must keep allergen information current both on site and online — the exact point where most restaurants fall down: the branch menu is current and the delivery-app page is two seasons old.
The greatest risk to this file is not building it but letting it age silently. A supplier changes a sauce formulation, or a buyer picks up a substitute brand on a day something ran out, and the matrix becomes wrong without anyone noticing. Make reviewing the file conditional on two specific events: any change to a recipe, and any change of supplier or brand for an ingredient — however small the change looks.
Training: who knows, inside your kitchen#
The code states that all personnel involved in the production, preparation, handling and service of food should understand their role in allergen management and the food-safety implications of an undeclared allergen — explicitly including temporary and maintenance personnel. This is a natural extension of what your kitchen already knows about cross-contamination and staff hygiene: the same skills, aimed here at a protein that cooking does not kill. Make allergen training part of onboarding rather than a separate annual course, and repeat it at every menu change.
Seven steps to set the file up this week#
- Collect the ingredient labels for every material entering your kitchen, and reject any ready-made mix without an ingredient statement.
- Build the matrix: menu item × fourteen allergens, filled from the labels rather than from memory.
- Map the contact points: which two items share a board, a utensil, a fryer or an oil.
- Dedicate what can be dedicated: colour-marked boards, utensils and containers, and a separate fryer if capacity allows.
- Write the disclosure across every channel — printed menu, board, drive-through menu and delivery-app page — in the same wording and in Arabic.
- Train front-of-house and kitchen on the seven-step allergy-order procedure, and log the training with names and dates.
- Tie review to change: every recipe or supplier amendment opens the file before it reaches the kitchen.
Frequently asked questions
Is chicken meat itself an allergen that must be declared?
No. Chicken meat is not among the ingredients the Saudi Food & Drug Authority's guide requires to be declared — fourteen entries covering gluten cereals, milk, eggs, sesame, soy and the rest. That does not take a chicken restaurant outside the regulation, because the hazard in your kitchen comes from what surrounds the chicken: the coating and dredge flour, the buttermilk soak, the wet dip, the bun, the sauces and the shared frying medium.
Is one blanket line at the bottom of the menu enough, such as "our dishes may contain allergens"?
It is not enough. The guide states that a precautionary disclosure in the form "may contain …" or "meals are prepared in facilities that handle …" does not substitute for the allergen warnings required by SFDA.FD 56. The two forms do different jobs: "contains …" is an actual ingredient statement required for every item that contains it, while "may contain …" warns of possible cross-contact. A blanket line covering the whole menu also destroys its own informational value, because it gives the customer no way to tell a safe item from a dangerous one.
We have one fryer. Is changing or filtering the oil between items enough?
Shared oil is one of the four cross-contact routes identified by the Codex code, which explicitly advises against frying a breaded item and an item assumed to be free of that allergen in the same oil, because coating particles carry over. The Authority's guide settles it with the example of oil previously used to fry fish: declaring fish remains mandatory, in the "may contain" form. Filtering does not solve it, because it removes particles rather than protein dissolved in the oil. The practical answer is one of two: a dedicated vat for uncoated items, or an explicit statement that all fried items are prepared in oil shared with wheat-containing products.
Is disclosure required on delivery apps and in the drive-through?
Yes, and each channel has its form. For orders placed electronically or by phone, allergens must be disclosed to the consumer before the food is ordered, and again on delivery, verbally or in writing. For drive-through orders, the information must be provided in the drive-through menu before the order is handed over. The Codex code adds the currency requirement: restaurants must ensure allergen information is current both on site and online — the commonest gap of all, a current menu in the branch and a stale page in the app.
Related articles

Food-safety records in a chicken restaurant: what an inspector asks for, and why you need them first
10 min read
Chicken shawarma safety: what happens inside the cone while the outside looks perfectly cooked
11 min read