Virginia restaurants must disclose nine major allergens in writing beginning Sept. 10

Richmond —

Restaurants and other Virginia Department of Health-permitted food establishments will be required to give customers written notice of the nine major food allergens used as ingredients in unpackaged food beginning Thursday, Sept. 10, under the most consequential change in a wide-ranging update to Virginia’s food regulations.

The regulation covers milk, eggs, fish, Crustacean shellfish, tree nuts, peanuts, wheat, soybeans and sesame. Sesame became the ninth major allergen under federal law in 2023, and Virginia’s update partially adopts the U.S. Food and Drug Administration’s 2022 Food Code.

The obligation is broader than answering an allergy question when a guest asks. The permit holder must make the disclosure in writing for unpackaged foods served or sold to consumers. VDH says operators may use words, icons or numbers accompanied by a legend. A printed handout or a QR code that opens written allergen information can satisfy the requirement, so businesses do not have to reprint every menu before the effective date.

State economic-impact documents say approximately 31,000 VDH-permitted food establishments are subject to the regulations. The category includes traditional restaurants, mobile food units, temporary vendors, caterers, food banks, hospital and nursing-facility food service, schools and institutional kitchens. Most are expected to qualify as small businesses.

What restaurants must disclose

The new section, 12VAC5-421-910(C), requires written notification when a major food allergen is present as an ingredient in an unpackaged food item. That means the rule is directed at intentional ingredients, not merely at packaged products carrying a manufacturer’s label.

A practical compliance system can be simple, but it must be complete and maintainable. VDH’s guidance permits a separate allergen list, an electronic document reached through a QR code, or menu notation using symbols or numbers with a clear legend. FDA guidance for jurisdictions adopting the 2022 Food Code also identifies brochures, deli-case or menu notices, labels, table tents, placards and other effective written methods.

For each menu item, operators will need to identify allergens not only in the principal food but also in sauces, marinades, batters, dressings, garnishes, cooking fats, spice blends and other components. Sesame may be easy to miss because it can appear in tahini, hummus, buns, seasoning mixes, dressings, oils and Asian sauces. The required declaration for tree nuts, fish and Crustacean shellfish should be specific enough to identify the source, such as almond, cod or shrimp, consistent with the Food Code’s labeling framework.

Bulk foods available for customer self-service receive separate treatment. They must be prominently labeled in plain view with the food source of each major allergen unless that source is already part of the food or ingredient’s common name.

The text appears to reach cocktails and other beverages

Bars, coffee shops and restaurants should include beverage recipes in their allergen review. Virginia’s regulatory definition of food expressly includes a beverage, and the disclosure section applies to unpackaged food items served or sold to consumers. Read together, those provisions appear broad enough to cover made-to-order drinks.

That matters for cocktails and specialty beverages containing milk or cream, egg whites, nut-based syrups or liqueurs, soy products, sesame ingredients, or garnishes made with wheat or nuts. VDH’s public FAQ does not separately discuss alcoholic beverages, so an operator with an unusual beverage program should confirm the application of the rule with its local health department. The safer operational approach is to place food and drink recipes in the same ingredient-control system.

Ingredient disclosure is not the same as a cross-contact guarantee

The regulation requires disclosure of allergens that are ingredients. It does not, by itself, turn a shared kitchen into an allergen-free environment or require a restaurant to promise that cross-contact cannot occur. Cross-contact can happen through shared fryers, grills, utensils, cutting boards, mixers, storage bins, gloves, towels and prep surfaces.

Operators should avoid using a written allergen chart as a substitute for kitchen controls. Ingredient information should be connected to standardized recipes, current supplier labels, substitution procedures and employee training. If a product or recipe changes, the customer-facing disclosure must change with it. A menu disclaimer also should not contradict specific claims such as gluten-free or allergen-free.

How the requirement is likely to be treated during inspections

Virginia classifies food-code provisions as Priority, Priority Foundation or Core. The baseline expectation is correction at the time of inspection. Beyond that, the department may agree to or specify a longer window, capped at 72 hours for Priority items, 10 calendar days for Priority Foundation items and HACCP-plan deviations, and, for Core items, a date agreed to or specified by the department no later than 90 calendar days after the inspection. Temporary food establishments get 24 hours for Priority items.

The new written-allergen-disclosure paragraph is not marked with a Priority or Priority Foundation superscript in the final regulatory text. Under the code’s definitions, an unmarked provision is a Core item. That classification describes the outer limit for correcting an observed violation after an inspection. It is not a grace period that delays the legal effective date, and an inspector may set an earlier correction date.

Other changes operators should not overlook

Operational area	What changes Sept. 10
Manufacturer cooking instructions	Commercially packaged food carrying manufacturer cooking instructions must be cooked according to those instructions before it is used in ready-to-eat food or offered unpackaged, unless the instructions say it may be consumed without cooking. This is a Priority requirement.
Handwashing sinks	The minimum hot-water temperature falls from 100 F to 85 F. Operators do not need to lower a sink that already reaches 100 F, but the new minimum may reduce energy use in some facilities.
Thawing	The person in charge is expressly responsible for daily oversight of employee monitoring of time/temperature control for safety food during thawing. Several thawing requirements move from Core to Priority Foundation.
Patio animals	Food employees may not handle dogs or other animals allowed in outdoor dining areas while working, except for narrow circumstances involving an employee’s own service animal or aquatic display animals. Required handwashing still applies.
Shellfish	Molluscan shellfish with different certification numbers, harvest dates or harvest areas may not be commingled before a customer orders. The 90-day retention period for source records is not new; what changes is that an invoice now counts alongside a tag or label.
Sous vide and cook-chill	The revised code adds a 48-hour option for certain reduced-oxygen-packaged foods without a HACCP plan when time labeling, refrigeration and package-removal conditions are met. Operations outside that exception remain subject to HACCP-plan and recordkeeping requirements.
Time as a public-health control	Certain ready-to-eat cut fruits and vegetables, and certain foods that become temperature-controlled after a sealed package is opened, may start at no more than 70 F and remain under time control for up to four hours if marking and disposal rules are followed.
Ill employees	An employee diagnosed with non-typhoidal Salmonella who has no symptoms may be restricted instead of excluded. Restricted employees cannot work with exposed food, clean equipment, utensils, linens or unwrapped single-service items.
Nicotine products	Existing tobacco-use restrictions are clarified to cover electronic cigarettes, vaping devices, nicotine pouches and other nicotine products in food-preparation, service, equipment-washing and storage areas.
Food donation	The code now expressly states that food may be donated when it is stored, prepared, packaged, displayed and labeled in compliance with the regulations.

A limited exemption for low-risk operations

The update allows VDH to exempt a food establishment that poses minimal foodborne-illness risk from the usual requirement to have a person in charge onsite during all operating hours. The exemption is not automatic. VDH says the establishment needs approval from its local health department, and the state’s economic analysis says the provision is expected to apply primarily to vending-machine operations.

Restaurants and retail food stores do not always answer to the same agency

The Sept. 10 regulation is VDH’s food code. Businesses should follow the agency that issued their food permit. VDH generally regulates restaurants and food-service operations, while the Virginia Department of Agriculture and Consumer Services regulates many grocery stores, convenience stores, markets and other retail food establishments.

VDACS-regulated retail food establishments have already been subject to an equivalent written-disclosure rule for unpackaged food since Feb. 13, 2025, under 2VAC5-585-910. Breweries and distilleries can fall under different regulatory arrangements depending on their alcohol license and the scope of food preparation. A taproom, tasting room or production facility that has expanded its food program should verify which agency has jurisdiction rather than assume the VDH effective date is the only applicable deadline.

Do not confuse the Sept. 10 rule with Virginia’s separate 2027 allergy mandates

The food-code update taking effect Sept. 10 is separate from three food-allergy bills enacted during Virginia’s 2026 legislative session. House Bill 373 and Senate Bill 248 are identical companion bills, signed as Chapters 124 and 125, and together they produced a single new statute. Senate Bill 183, Chapter 939, is a separate measure directing the Board of Health to write rules on delivery and carryout markers.

VDH says it is still drafting regulations under all three and expects those requirements to take effect in 2027. Its guidance states plainly that no new requirements will be enforced until the regulations are in effect, and that no changes to establishment operations are required at this time.

That position deserves a closer look, because the statute and the agency’s guidance do not say quite the same thing. House Bill 373 and Senate Bill 248 became Va. Code § 35.1-14.01, which took effect July 1, 2026. Its text is not conditioned on any rulemaking. It requires a permitted restaurant to carry, conspicuously, on each menu or on a posted sign, the words “If you have a food allergy, please notify us,” and it requires a restaurant with a menu on the internet to include an allergy notification and a way for a customer to indicate an allergy. Only Senate Bill 183 actually directs the Board of Health to promulgate regulations.

So an operator relying on VDH’s timeline should understand what that timeline is: a statement about enforcement, from the agency that would do the enforcing, and not a suspension of a statute that is already in the Code. The sign and menu line are cheap. An operator who wants to be indifferent to how that tension resolves can post them now.

The future rulemaking will address employee and customer notices, standardized online-menu language and standardized markers for delivery or carryout orders altered because of an allergy, intolerance or sensitivity. Senate Bill 183 requires the board to set a marker for each common allergy or sensitivity, including each major allergen in the food code and gluten.

For operators, the distinction that matters most is this: written disclosure of the nine major allergens used as ingredients begins Sept. 10, 2026. The standardized signs, online-menu functions and takeout identification system belong to the separate rulemaking expected in 2027.

A Sept. 10 compliance checklist

• Build a master ingredient and allergen record for every food and beverage recipe, including sauces, garnishes and prep components.
• Choose a written disclosure method that customers can access before ordering. A handout or QR-linked written list can avoid an immediate full-menu reprint.
• Add sesame to existing allergen charts, employee references and packaged-food reviews.
• Create a rule for updating disclosures whenever suppliers, packaged ingredients, recipes or substitutions change.
• Review manufacturer cooking instructions for frozen and other commercially packaged foods used in ready-to-eat dishes.
• Confirm thawing logs and employee monitoring are part of the person-in-charge routine.
• Review patio-service instructions so employees do not handle customers’ animals while working with food or clean service items.
• Audit shellfish separation and 90-day record retention, including the use of invoices where appropriate.
• Check sous vide, cook-chill and other reduced-oxygen packaging against HACCP, labeling, refrigeration and 48-hour package-removal rules.
• Train managers on the new inspection classifications and document corrections by the date set by the local health department.

The business impact

Virginia’s Department of Planning and Budget concluded that allergen notification will add costs, though it described them as likely small relative to the public-health benefit. The National Restaurant Association similarly characterized the expected costs as minor. The real burden will vary by concept. A small restaurant with a short, stable menu can maintain a simple chart. A bar with seasonal cocktails, a bakery with rotating specials or a multiunit group with frequent substitutions will need tighter version control.

The most important operational decision is not the format of the disclosure. It is who owns the information. Someone must be responsible for collecting supplier labels, mapping every component to a recipe, approving substitutions and updating the guest-facing record before a changed item is sold. Without that process, even a well-designed allergen guide can become inaccurate quickly.

VDH’s updated food regulations take effect Sept. 10. Establishments with questions about their disclosure method, beverage program, reduced-oxygen packaging or agency jurisdiction should contact their local health department before an inspection exposes a gap.