Allergen Cross-Contact in Food Manufacturing: What FDA's FSMA Rules Actually Require

FDA’s own recall records tell a consistent story: year after year, undeclared allergens are the leading cause of Class I food recalls — the agency’s most serious category, reserved for situations where there’s a reasonable probability of serious adverse health consequences or death. Recent analyses of FDA recall data put allergen-related recalls at roughly 40% of all Class I food product recalls. That figure has barely moved in a decade.

The persistence of the problem isn’t surprising once you understand what’s actually driving it. It’s rarely a labeling typo. The mechanism, in the vast majority of cases, is allergen cross-contact during manufacturing — protein transfer between production runs on shared equipment that ends up in a product carrying no allergen declaration on the label.

Most food manufacturers know cross-contact is a risk. The gap isn’t awareness. It’s that the testing programs in place aren’t structured to catch it before the product ships — and frequently don’t align with what FDA actually expects to find documented in a FSMA food safety plan.

Cross-Contact Is a Chemical Hazard, Not a Sanitation Problem

This distinction matters more than it sounds. Cross-contamination — the term most food manufacturers are more familiar with — typically refers to microbial transfer. A cutting board used for raw protein contaminates a ready-to-eat surface. The control is sanitation, and verification is often environmental microbiological swabbing.

Allergen cross-contact works differently, and FDA’s FSMA framework reflects that. Under 21 CFR Part 117 (Preventive Controls for Human Food), allergens are explicitly classified as a chemical hazard in the hazard analysis. That means your allergen cross-contact risk must be evaluated and documented as a chemical hazard requiring a preventive control — not bundled under your sanitation prerequisite program and left there.

We see this misclassification regularly when reviewing food safety plans at facilities that haven’t had recent third-party audits. Allergen controls are listed as GMPs or sanitation programs. Under FDA’s interpretation of 21 CFR Part 117, that’s typically insufficient if cross-contact is a reasonably foreseeable hazard for your operation. A preventive control — with monitoring, verification, and documented corrective action — is what the rule requires.

And critically: your cleaning procedure, however thorough, does not substitute for testing. Cleaning is a control. Testing is the verification that the control worked.

What 21 CFR Part 117 Actually Requires From Your Testing Program

FSMA doesn’t prescribe specific testing frequencies or numerical detection thresholds the way some international frameworks do. What the rule does require is this: if you’ve identified allergen cross-contact as a hazard requiring a preventive control, you must verify that those preventive controls are consistently implemented and effective.

Per 21 CFR 117.165, verification activities for preventive controls must include one or more of the following — calibration of monitoring instruments, product testing, environmental monitoring, or records review. For allergen controls specifically, finished product testing and environmental allergen swabbing are the two verification methods FDA investigators most commonly expect to see supported by records during inspections.

The FASTER Act changed the compliance landscape effective January 1, 2023, adding sesame as the 9th major food allergen under U.S. law. The current list: milk, eggs, fish, Crustacean shellfish, tree nuts, peanuts, wheat, soybeans, and sesame. Any facility producing sesame-containing products on shared equipment — or receiving sesame-containing ingredients from suppliers who run allergen-containing products alongside — should have updated its hazard analysis to evaluate sesame cross-contact. In our experience, a surprising number of manufacturers haven’t. That’s a documentation gap FDA investigators will flag on the next inspection.

More than 32 million Americans live with food allergies, according to FARE (Food Allergy Research & Education). Approximately 200,000 require emergency medical treatment each year due to allergic reactions. Sesame allergies alone affect an estimated 1.6 million Americans. These aren’t abstract numbers — they’re the reason allergen recalls consistently earn Class I designations.

What a Food Safety Testing Lab Actually Uses to Detect Cross-Contact

Understanding the available methods helps you make better decisions about what to test, at what frequency, and when each method is appropriate.

ELISA (enzyme-linked immunosorbent assay) remains the primary quantitative method used in accredited food safety testing laboratories. ELISA detects allergen proteins with high sensitivity — typically in the range of 1–5 parts per million (ppm) depending on the allergen and food matrix — and commercial validated kits exist for all major U.S. allergens. Because ELISA is allergen-specific, testing for peanut and testing for tree nuts are separate analyses. If your facility runs multiple allergen-containing products, your testing matrix needs to reflect each one individually.

Lateral flow devices (LFDs) are rapid screening tools well-suited for at-line allergen testing, particularly for equipment swabs during production changeovers. LFDs produce a qualitative pass/fail result in minutes rather than days. Most food safety testing labs use LFDs as a first-pass screening step, then confirm or quantify positive results using ELISA. The combination makes operational sense and manages cost without sacrificing rigor where it counts.

PCR-based methods detect allergen DNA rather than protein. This is particularly useful in highly processed foods where heat treatment has denatured proteins to the point where ELISA sensitivity is compromised — baked goods are the classic example, and sesame and gluten testing in cooked matrices frequently benefit from PCR. The interpretation caveat: the absence of detectable DNA doesn’t always mean absence of allergenic protein, and not all commercially available PCR kits carry the same method validation rigor.

Any allergen testing data you use as FSMA verification evidence should come from an ISO 17025 accredited laboratory. Accreditation means the lab’s methods are validated, staff qualifications are documented, and measurement uncertainty is accounted for. That matters when your test results need to hold up during an FDA inspection or — in a worse scenario — in a product liability proceeding.

Building an Allergen Testing Program That Matches Your Risk Profile

A testing program that works is one calibrated to your specific hazards, not a generic template. Here’s how we typically structure programs for food manufacturers across different risk profiles.

Environmental allergen swabbing after cleaning, before production. This is cleaning validation in practice. Swab high-risk equipment surfaces — filling heads, conveyors, hoppers, any surface with complex geometry that resists cleaning — and verify that allergen protein is not detectable before the next production run begins. A positive result is a corrective action trigger, not just an observation. Production stops until root cause is identified, the equipment is recleaned, and a re-swab confirms it’s clean.

First-product-off-the-line testing after product changeovers. This tests whether your cleaning procedure actually removed the prior allergen from a production standpoint, not just from a surface swab standpoint. We’ve seen this catch residual cross-contact that post-cleaning environmental swabbing missed — especially in equipment with dead legs, crevices, or recirculating lines where allergen residue can persist. It’s a straightforward practice that more facilities should build into their changeover SOPs.

Finished product testing at a risk-appropriate frequency. FDA doesn’t mandate a universal frequency. What’s defensible depends on your specific hazard analysis: a dedicated allergen-free line with no shared equipment and rigorous supplier controls warrants less frequent finished product testing than a facility running peanut-containing and peanut-free products on shared equipment within the same shift. If your risk exposure is high and your testing cadence is low, expect an investigator to ask you to justify the gap.

Incoming ingredient testing for high-risk suppliers. Cross-contact doesn’t only happen inside your four walls. Ingredients can arrive already cross-contacted if your supplier runs allergen-containing products on shared equipment without robust verification. Under FSMA’s supply chain program provisions (21 CFR Part 117 Subpart G), if you’re relying on a supplier to control an allergen hazard before ingredients reach your facility, you need documented verification of their controls. That can include reviewing their testing records, requiring COAs with allergen test data, or conducting independent incoming ingredient testing on high-risk lots.

The Corrective Action Question Nobody Plans For

Most allergen testing discussions focus on what to test and how often. The harder part — and the part your FSMA food safety plan must explicitly address — is what happens when a result comes back positive.

Your corrective action procedure needs to answer, in writing: who gets notified immediately, what happens to product manufactured since the last verified-clean state, how root cause is determined, and what verification steps are required before production resumes. “We will investigate and take corrective action” is not a corrective action procedure. FDA investigators reviewing food safety plan records look for specificity — step-by-step procedures, responsibility assignments, and evidence that the procedure was actually followed when an out-of-spec result occurred.

The absence of positive results in your testing history isn’t automatically evidence that your program is working. It might mean your testing frequency is appropriate and your controls are effective. Or it might mean your swab locations aren’t capturing the actual contamination pathway, your detection method isn’t sensitive enough for the allergen loads in your facility, or your sampling plan is missing the highest-risk steps in the production sequence. A periodic program review — examining not just results but the program’s design and its ability to detect cross-contact if it occurs — is a reasonable part of responsible verification practice.

What consistently distinguishes facilities that pass FDA allergen-related inspections from those that receive 483 observations is that their testing data tells a coherent, documented story: clean equipment before production, first-product confirmations after changeovers, finished product results consistent with the environmental data, and corrective action records for the occasional positive that demonstrate the system worked as designed. That documentation is what your food safety plan needs to produce. And building a testing program that generates it is, ultimately, the goal.

---

Written by Nour Abochama, Vice President of Operations, Qalitex Laboratories. Learn more about our team

Talk to our team about your testing needs. Contact us

Related from our network

• FSMA Documentation and FDA Inspection Readiness — Aurora TIC helps food and supplement manufacturers build defensible FSMA compliance systems and prepare for FDA regulatory inspections.
• Raw Ingredient and Supplier Qualification Testing — Ayah Labs provides contract testing services for raw materials and incoming ingredient verification, including allergen screening for supplier qualification programs.