Why allergen recalls are still a version control problem

Every allergen recall starts the same way. Not with a rogue ingredient or a careless supplier — but with two files that should have been the same file.

A product reformulation is approved. R&D updates the ingredient declaration. Someone in packaging coordinates the artwork change. The designer makes the update. The correct file exists. And then, somewhere between that moment and the moment the file goes to the printer, the wrong version takes over. No one notices. The product ships. The recall follows.

This is not a rare edge case. It is the dominant mechanism behind food allergen recalls on both sides of the Atlantic — and it has nothing to do with not knowing the rules.

The Numbers Are Not Getting Better

Allergen contamination is responsible for nearly 40% of all US food recalls — making it the single leading cause, ahead of bacterial contamination and foreign objects. In 2023 alone, 49% of all food recalls stemmed from undeclared allergens — a 27% increase from 2022. F

The EU picture is consistent. RASFF registered a 12% increase in notifications in 2024, reaching 5,250 total — and undeclared allergens remain a persistent category year over year. 

What makes these numbers striking is not their size — it is their stubbornness. Regulatory requirements around allergen labelling have been tightening for years. Brands are aware of the stakes. Yet the recalls keep happening. The logical conclusion is that the problem is not knowledge of the rules. The problem is operational.

Where the Gap Actually Happens

Research into FDA recall data puts this precisely. 70% of all food allergen-related recalls from 2013 to 2019 were due to labelling errors — and the leading root cause was product labels not being updated after an ingredient change or reformulation.

That finding deserves a closer look, because "labels not updated after reformulation" covers several distinct failure modes — and each one looks different inside a packaging team.

The parallel file problem. A designer works on the current version of an artwork file. Meanwhile, a colleague pulls an older version from a shared folder — "just to check something" — and that version quietly becomes the file that gets sent downstream. No one made a mistake. No one was negligent. There was simply no single place where "current" was unambiguous.

The approval timing gap. Artwork goes through review and gets signed off. But the ingredient declaration from R&D wasn't finalised yet at the time of approval. The approval is real — it just captured a file that was incomplete. The record says approved. The file was not ready.

The disconnected workstream. A recipe change is handled by regulatory. The corresponding artwork update is handled by design. These two processes run in parallel, in separate tools, with separate communication threads. The artwork ships with copy that no longer matches the formula.

The handoff failure. The correct, fully approved file exists. But the person sending to print doesn't have clear visibility into which file carries the sign-off. They look at a folder. They see several versions. They pick the one that looks right.

None of these failures require incompetence. They require only the conditions that exist in most mid-market FMCG companies: multiple people working on the same artwork, no single authoritative location for the current version, and approvals recorded somewhere other than on the file itself.

This Is an Infrastructure Problem, Not a Training Problem

The instinctive response to allergen recall incidents is to add review steps. More sign-offs. More checklists. More training.

The problem with this response is that the failure usually happens after the review process — at the point of file handoff, where no checklist applies. You can have a perfect approval workflow and still send the wrong file to print if there is no structural connection between the approval and the file.

What actually prevents this failure is simpler and more durable than additional process: a shared workspace where the file, the review, and the approval record all live in the same place, attached to the same version.

When annotations and feedback happen directly on the artwork file — not in a parallel email thread — there is no translation layer where information can get lost. When version history is built into the file itself rather than reconstructed from timestamps in someone's inbox, "which version is current" has a single answer. When the approval is attached to a specific version of a specific file, there is no ambiguity about what was actually signed off.

Equally important is what this does not need to be: it does not need to be a compliance engine that reads regulatory requirements and validates artwork content against them. Regulatory teams already know what the label needs to say. The structural problem is not expertise — it is that when the regulatory reviewer signs off, that sign-off needs to be permanently and visibly attached to the exact file that will go to print. Not to a record in a separate system. Not to an email. To the file.

The Access Control Layer That Most Teams Underestimate

One operational pattern that consistently appears in allergen recall investigations is this: the person who initiated the print job had access to all versions of the file. There was nothing stopping them from pulling version 11 instead of version 14. The wrong choice was easy to make because it was available to make.

Access controls and audit logs are often treated as security features — something that matters for compliance audits but not for day-to-day operations. In practice, they are part of the operational infrastructure that makes version confusion structurally harder. When you can see exactly who accessed which version and when, incidents become diagnosable. When you can control who can act on which files at which stage, the wrong version cannot quietly become the file that goes to print.

What This Looks Like in Practice

Brands that have reduced allergen-related errors and rework tend not to describe a dramatic operational overhaul. The change is simpler: they stopped managing artwork in shared drives and email threads, and moved to a single environment where the current file is always unambiguous.

That shift — from "the file is somewhere in our folder structure, ask around" to "the file is here, this version is approved, here is the complete history" — is the structural fix. Product labels not being updated after an ingredient change stops being an invisible risk when the artwork, the change history, and the approval are all visible in one place to everyone who needs to act on them.

The recalls in the data are not a mystery. They are the predictable output of a coordination infrastructure that was never designed for the volume and pace of change that modern FMCG packaging now requires. Every sustainability claim, every recyclability update, every regional language variant, every reformulation — each one is a potential version control event. And the more SKUs a brand manages across more markets, the more often that event happens.

The brands that manage this well are not the ones with the most rigorous review processes. They are the ones where "which file is current" has only one answer.