Can a Hotel AI Concierge Answer Guest Allergen Questions? What UK Food Allergen Rules Require First

Direct answer: a hotel, villa, or restaurant AI concierge **can** help guests with allergen questions in the UK — but only as a **retrieval and routing layer** over allergen information your food business already holds and keeps accurate, never as the source of that information, and never as the final word on whether a dish is safe for a specific guest. The Food Standards Agency is explicit that food businesses **must** tell consumers if any of the 14 regulated allergens are used as ingredients, and that mandatory allergen information must be **accurate, available and easily accessible** — including for food given away free (FSA best-practice guidance for non-prepacked food, published 24 February 2025). The same guidance says allergen information is best provided **in writing and supported by a conversation**, and that staff must not guess. A large language model that answers “does the risotto contain nuts?” from a menu description is guessing. That is the control problem this article solves.

Kaize is a UK AI product studio for travel and hospitality. This is **not legal or food-safety advice** and it is not a substitute for your allergen management policy, your local authority’s trading standards or environmental health officers, the FSA technical guidance, or counsel. Scope: the FSA best-practice guidance applies to England, Wales and Northern Ireland; Scotland has its own regulator (Food Standards Scotland). Legal references below are to the Food Information Regulations 2014 and assimilated Regulation (EU) No 1169/2011 as they apply in England. We do not claim any client results here — this is a control-stack for operators deciding whether, and how, to let an AI assistant anywhere near allergen conversations.

What UK allergen rules actually require — and what is best practice

Most hospitality teams know “the 14 allergens”. The failure mode with generative assistants is subtler: the model blurs the line between what the law requires, what the FSA recommends, and what the kitchen actually did today. Encode these facts before you design any AI flow:

• **Disclosure is mandatory** — food businesses must tell consumers if any of the 14 allergens are used as ingredients or processing aids (FSA; Annex II).
• **Accuracy is a legal requirement**, not a style choice — the FSA calls accurate allergen information “a legal requirement as well as being vital to ensure the safety of consumers”, and it applies to complimentary food too (welcome amenities, canapés, turndown treats).
• **For non-prepacked food the legal minimum is “any means”** — allergen information can be given orally by staff, provided there is a readily discernible statement telling customers where to get it (FSA technical guidance paras 80–81, referencing FIR 2014 regulation 5(4); national measures under Article 44).
• **Best practice since February 2025 is written information plus a conversation** — the FSA says this is a change in best practice; the minimum legal requirement “has not changed” (FSA para 23). At the time of writing that remains guidance rather than statute in England; the FSA scheduled a review of the guidance for September 2026, so check for updates before you build.
• **Distance selling has timing rules** — for non-prepacked food sold by telephone or online, mandatory allergen information must be available free of charge **before the purchase is concluded and at the moment of delivery** (FSA technical guidance para 86, Article 14).
• **Pre-orders are not the end of the conversation** — for group pre-orders the FSA says allergens should be discussed with individuals on the day, before the food is served, because ingredients change and details get missed.
• **Beyond the 14, do not guess** — for other ingredients, staff must check records or say they cannot provide accurate information; “it is important that staff do not guess or make assumptions”.
• **“Free from” is a guarantee** — a free-from claim means the allergen is absent for everyone with that hypersensitivity, which requires strict cross-contamination controls. Precautionary “may contain” statements are a different thing.

Where hotel AI actually touches allergen conversations

In hospitality the allergen question rarely arrives at the restaurant table first. It arrives in the **pre-arrival WhatsApp or web chat** (“my son is coeliac — can you do breakfast?”), the **in-room dining QR menu or app**, the **restaurant reservation bot** that captures “dietary notes”, the **wedding, event or group pre-order** flow, the **villa private-chef menu** sent a week ahead, and the **CRM guest-preference profile** that the concierge model reads before every reply. Each of those surfaces is an AI product decision, and each has a different allergen risk. If you are scoping AI for a hotel group, our boutique hotel groups page and villa management page describe where we see these assistants deployed; this article is about the controls they need first.

The core rule: the model is never the source of allergen truth

A general-purpose model has read thousands of risotto recipes. It has not read **your** risotto recipe, this week’s substituted stock, or the pesto supplier change the kitchen made on Tuesday. The FSA’s accuracy controls — recipe records, checking whether ingredients have changed, managing last-minute substitutions, supplier assurances — exist precisely because allergen truth is local and time-sensitive. So the design rule is simple: the assistant may only **retrieve** allergen facts from a maintained, versioned allergen record keyed to the dish as served, and must say it does not know when that record is missing or stale. Anything else is the machine equivalent of the staff guesswork the guidance warns against. This is the same principle we apply to AI agents that touch booking and customer systems: systems of record stay outside the model.

Six controls before an AI concierge talks about allergens

Control 1 — A versioned allergen matrix is the only source

Before any guest-facing answer, bind each dish (and each component, if you offer adaptations) to a structured allergen record covering all 14 allergens, with the specific nut or cereal named, a recipe version, a last-verified timestamp and an owner (head chef or F&B manager). The FSA recommends comprehensive information on all 14 allergens rather than a subset, and suggests component-level breakdowns so guests can ask for adaptations. Control 1 fails if the assistant answers from menu prose, marketing copy, a PDF it scraped last season, or model memory; if the record is older than your menu-change cadence; or if a dish exists on the live menu with no allergen record. In those cases the only allowed answer is a handoff.

Control 2 — State what a dish contains; never promise it is safe for this guest

The assistant may say “the chicken salad contains milk, egg and mustard” when that is what the verified record says. It must not say “that’s safe for you”, “no allergens”, “nut free”, or “we can definitely make that gluten free” unless your business has a verified free-from claim and the controls behind it. It should surface your kitchen’s cross-contact statement where you use one (for example, that nuts and wheat are handled in the kitchen) and invite the guest to speak to trained staff. The FSA’s own suggested wording — “Please talk to us if you have a food allergy, intolerance or coeliac disease. We want to cater safely for everyone” — is a good default closing line for any allergen-adjacent answer.

Control 3 — An allergen requirement triggers a human conversation, not an AI decision

The FSA describes a conversation that, as a minimum, covers what the guest must avoid, whether they have seen the written information, the risk of cross-contact, and whether they have enough information to choose. It also says businesses should decide **who** is best placed to hold that conversation — for example a supervisor or head chef. Encode that as a routing rule: once a guest discloses an allergy, intolerance or coeliac disease, the AI’s job becomes collecting the facts, showing the written allergen information, and handing off to the designated human with a structured summary. Control 3 fails if the model negotiates dish adaptations on its own, or if the handoff silently drops when no trained person is on shift. Be clear with guests that they are talking to an AI; see our note on AI disclosure in guest chat.

Control 4 — Online, app and pre-order flows: written information before ordering and again at delivery

Where food is ordered online or by telephone, the FSA technical guidance says mandatory allergen information must be available before the purchase is concluded and at the moment of delivery, at no extra cost. If your in-room dining app, QR menu or delivery partner listing is AI-assisted, the allergen information must appear before checkout — ideally on the menu itself, or no more than “one click away” — and travel with the order (labels or a menu with allergen information on delivery). Whether a specific in-house flow such as in-room QR ordering counts as distance selling is a question to settle with your enforcement officer; following the written-before-and-at-delivery pattern is the safer design either way. For wedding and event pre-orders, the AI may collect dietary needs weeks ahead, but the FSA expects allergens to be rechecked with individuals on the day — so the system should schedule that reconfirmation rather than treat the pre-order as final.

Control 5 — The kitchen receives allergen requirements in writing, and acknowledges them

The guidance is specific: if an order is made digitally, the allergen information should be passed **directly to the person preparing the food in writing**, with confirmation that they have received and understood it. In AI terms that means a structured allergen field on the kitchen ticket or KDS — not a sentence buried in a free-text “notes” box the model summarised — plus an acknowledgement step, and a serving step where the dish is identifiable and the server confirms it verbally. Control 5 fails if an AI-generated order can reach the kitchen without the structured field populated, or if a summarisation step can rewrite or drop the guest’s stated allergen. This is one of the places travel AI usually breaks in production: the demo answers correctly, but the integration loses the field.

Control 6 — Treat guest allergy details as health data

An allergy, intolerance or coeliac diagnosis tied to an identifiable guest is very likely to be **data concerning health**, which UK GDPR treats as special category data. The ICO stresses that the health category is framed broadly — even a broken leg counts — and that you should identify special category data and handle it carefully even if it does not feel sensitive (ICO: what is special category data?). Practically: identify your lawful basis and Article 9 condition, decide retention (does this stay for one stay or follow the guest for years?), restrict which models and staff can read it, and stop a general “guest preferences” memory from quietly accumulating medical details. Control 6 fails if the concierge model can write allergy information into an unrestricted CRM profile or reuse it in marketing.

What the assistant may say — and what it must hand off

• **May:** read out the allergens a dish contains from the verified, in-date record, naming specific nuts or cereals.
• **May:** point to where the written allergen menu or matrix is, and send it in writing.
• **May:** collect a guest’s stated requirement and route it to the designated person with a structured summary.
• **May:** show your kitchen’s cross-contact statement and invite a conversation with staff.
• **Must hand off:** any question about whether a dish is safe for this guest, adaptations, cross-contamination for a specific order, or allergens outside the 14.
• **Must hand off:** any dish with a missing, stale or unverified allergen record — answer “I can’t confirm that; let me connect you with our team.”
• **Must never:** invent ingredients, infer allergens from a recipe name, make free-from claims you have not verified, or store allergy details in an unrestricted profile.

Operator checklist before go-live

• Allergen matrix for every live dish and component, all 14 allergens, specific nuts/cereals named, recipe version, last-verified date and owner.
• Menu-change and supplier-change events invalidate the record until a human re-verifies it.
• Retrieval-only answering over that matrix; the model’s own knowledge is blocked for allergen claims.
• Banned phrases list: “safe for you”, “allergen free”, “definitely gluten free”, “no nuts in our kitchen” unless a verified claim exists.
• Designated human owner per shift for allergen conversations, with a fallback when nobody is available.
• Structured allergen field and acknowledgement on every AI-originated kitchen ticket; servers confirm on delivery.
• Online and app ordering shows written allergen information before checkout and with the delivered order.
• Event and group pre-orders schedule an on-the-day allergen reconfirmation.
• Allergy data classified as special category data: lawful basis, Article 9 condition, retention and access controls documented.
• Monthly review of transcripts where allergens were mentioned, owned by F&B, not the AI vendor.

What this is not

• Not food-safety or legal advice — your allergen management policy, enforcement officers and counsel decide.
• Not a claim that written allergen information is now mandatory for non-prepacked food in England — at the time of writing it is FSA best practice; the legal minimum is accurate information by any means with clear signposting.
• Not guidance on prepacked for direct sale (PPDS) labelling, which has its own rules (often called Natasha’s Law).
• Not Scotland-specific — check Food Standards Scotland guidance.
• Not a claim that any AI vendor’s product is or is not compliant.

Kaize point of view

Allergens are the clearest example of a rule we apply everywhere in travel and hospitality AI: **the model may speak, but the record decides**. A concierge that can say what a dish contains — from a verified matrix — and then hand the guest to a trained person quickly is genuinely useful; it reduces friction for guests who live with allergies every day. A concierge that improvises reassurance is a liability with a friendly tone. If you run hotel dining, villa chefs or event catering, build the allergen record, the handoff and the kitchen acknowledgement first, then let the AI sit on top. The same discipline applies to inventory, where AI must not own overbooking decisions.

If you want a control-stack review of how an AI concierge, in-room dining flow or event pre-order tool handles guest allergen questions, discuss a project with Kaize.