Every small business site I have worked on makes the same modelling mistake: it treats "the shop's information" as one thing. A bakery makes the mistake visible, because three of its lists change at three completely different speeds — and one of them is fixed to the package by law.
- The label. Name of the food, ingredients, allergens. Changes when the recipe changes. Must be on the package or on a label attached to it, readable without opening anything.
- Today. Which bakes came out at 7:00, what sold out at 11:20, what the next batch is. Changes hourly.
- The order. The whole cake someone wants for Saturday. Does not exist when they ask.
Treat those as one content type and you get the familiar mess: a printable "whole cakes from $38" card with no way to say what is available, an allergen list that lives only on a website because it is easier to edit there, and a QR code doing a job that a label is legally required to do.
This post is about the model, plus the two or three places where a well-meaning "put a QR code on it" idea goes wrong.
Sorting by clock speed
The rule that survived contact with actual shops: give each fact the medium its change rate deserves.
| Clock | Example | Medium | Why |
|---|---|---|---|
| Years | Shop name, address, the recipe | Printed label, signage | Cheapest to keep correct when it rarely changes |
| Hours | Bake times, sold out, "6 left" | Page behind a code | A board is wrong by lunch |
| Per customer | Cake size, filling, inscription, collection | Form + confirmation | Nothing exists to label until the order is placed |
The interesting column is the "why". It is not nostalgia for paper. It is that the cost of being wrong is not the same in each row. A stale sold-out line annoys someone. A stale allergen line can put someone in hospital — and in the UK and US, it is also the shop's legal exposure.
What the label actually has to carry
Two systems cover most English-language markets, and they are not interchangeable.
United States. FALCPA (2004) requires packaged food to declare each major food allergen by the name of its food source. The FASTER Act added sesame as the ninth, effective 1 January 2023. The nine: milk, eggs, fish, crustacean shellfish, tree nuts, peanuts, wheat, soybeans, sesame. The declaration goes in the ingredient list (flour (wheat)) or in a Contains statement printed immediately after or adjacent to the ingredient list — and if you use Contains, it must list all major allergens present, not just the ones named in the product. Specific nuts and fish species have to be named: "tree nuts" fails, "almonds" passes.
The part engineers tend to miss: the requirement reaches retail and food-service establishments that package and label food for sale, but not food placed in a wrapper in response to a customer's order. A slice boxed at the counter is not the same object, legally, as a sandwich made up in the morning and put in the chiller with a label. That distinction is a data-modelling distinction, not a legal technicality: it tells you which items need a generated label and which need only an answer.
United Kingdom. Since 1 October 2021 ("Natasha's Law"), food prepacked for direct sale — packed before the customer orders it, on the same premises — needs the name of the food and a full ingredients list with the 14 allergens emphasised (bold, caps, colour, underline). The 14 include celery, mustard, lupin, molluscs and sulphites over 10 ppm, which surprises people who built a US-shaped list.
Loose food — a loaf from a tray, a pastry the customer points at — does not need a label, but the 14 allergens must still be available. The FSA permits that orally if there is clear signposting telling people to ask, and recommends written information backed by a conversation.
So the same shop can legitimately need two different artefacts for two counters. If your data model has one allergens field and one template, you will get one of them wrong.
Where the QR idea breaks
This is the bit worth being blunt about, because "just put it behind a QR code" is the default suggestion in every small-business thread.
For UK prepacked-for-direct-sale food, the requirement is that the particulars appear on the package or on a label attached to it. Local authority guidance answers the QR question in one line: "No. A QR code will not suffice." In the US, the declaration must be on the label as well; a code is not one of the permitted methods.
A code is also a single point of failure in the least forgiving place: a customer in a shop, holding a cake, deciding whether to buy it. It needs a charged phone, a working camera, a connection, and a shop that has not let the page go stale.
Where the code is the right tool, and does real work:
- The matrix. Forty items × fourteen allergens, one table. A label answers "what is in this bun". The matrix answers "which buns have no sesame", across the whole counter, in ten seconds — for a customer and for a new staff member. For non-prepacked food, written information is the FSA's best practice; a page is the version that stays current.
- Today. Bake rhythm (
out of the oven around 7:00, 9:30, 13:00), what is out, what sold out, how many are left. - The order that is not a product yet. Whole cake, size, filling, inscription, collection window, deposit.
The FSA adds a systems requirement that is easy to skip: if allergen information is provided digitally, there should be an alternative route for people who cannot use the digital version. A code on a bag with nothing behind the counter is exactly the single point of failure the guidance is trying to avoid.
The three statements that create liability
If you build the content model, these are the fields that need validation, not just formatting.
"May contain". In the US, allergen advisory statements are not addressed by the labelling section of the law at all, and FDA's 2025 Q&A says an advisory statement is not a substitute for good manufacturing practices or allergen preventive controls, and must be truthful and not misleading. UK guidance: precautionary labelling only after a risk assessment identifies a real risk. A blanket "may contain nuts" on everything is not caution; it is noise that trains customers to ignore the line.
"Free from". There is no defined condition for an allergen-free claim in the US; FDA expects that "milk-free" means no milk allergen including cross-contact, and a product should not carry both "may contain milk" and "milk-free". Two fields that contradict each other should fail a constraint, not ship.
"Gluten-free". Defined in 21 CFR 101.91: no gluten-containing grain, no unprocessed gluten-derived ingredient, unavoidable gluten below 20 ppm. It is a production claim. A shop with one bench and one mixer either has the separation and the record, or it does not get the checkbox.
Where a bakery item hides its allergens
Most wrong labels are omissions, not lies. The places they hide are stable enough to encode as hints in the editor:
| Item | Usually present | Where it hides |
|---|---|---|
| Croissant, brioche, milk bread | wheat, milk, egg | butter layers; egg wash; milk powder in improvers |
| Bagel, burger bun, seeded loaf | wheat, sesame, egg | seeds on top and in the dough; egg wash |
| Marzipan, frangipane, praline | tree nuts (almond, hazelnut), egg, milk | sold as a flavour, not as a nut; praline is hazelnut |
| Ganache, glaze | milk, soy | soy lecithin in chocolate; cream and butter |
| Fruit cake, mince pie | wheat, egg, milk, sulphites (UK) | dried fruit and alcohol |
| Sausage roll, savoury pie | wheat, milk, egg, mustard, celery (UK) | mustard in seasoning, celery in stock |
Two habits remove most of it. Write the label from the recipe sheet, including washes, glazes and seasoning blends — FDA's guidance specifically notes that sesame inside a spice mix must be declared, via Contains sesame or spices (sesame). And treat a spice blend as a possible allergen carrier even when the product name says nothing about it.
The bake board is a schedule, not a promise
Publishing bake times is cheap and useful, and it is a good example of content that must never end up on a label: it is a service line, not a legal statement. "Out of the oven around 9:30" survives a late oven; "9:30 sharp" does not.
The bread itself argues for keeping this on a page. Staling is starch retrogradation, and it runs fastest in the cold — studies of storage temperature put the peak rate around 4 °C, ordinary fridge temperature, while −18 °C holds the crumb almost unchanged for weeks. So the useful line is not "baked today" but "counter tonight, freeze what you will not eat tomorrow, refresh in the oven". That sentence changes as often as the bread does.
The cake order is a form, not a product page
A cake ordered for Saturday is the clearest case of "does not exist yet": no label can be printed in advance. What replaces it is a confirmation with five fields — size and servings, flavour and filling from a fixed list, inscription exactly as it will be written (read back), collection window, phone number plus deposit — and a cutoff that sits on the form, not at the till. 48 hours is the common answer for a standard cake, longer for tiered work.
If the kitchen handles nuts, sesame or gluten, that belongs on the confirmation. The customer with an allergy is ordering a cake, not reading a website; the confirmation is the document they keep.
What I actually shipped
A page with eight blocks in this order: today; the allergen matrix; whole cakes; a short paragraph explaining what is and is not labelled; bread keeping; where and when; one button; a note about who bakes. The page has to be editable in under a minute from the counter, or it will not be edited, and a stale page behind a permanent code is worse than no page.
The printed set is four pieces, each doing a different job: a box/bag label for prepacked items (name, full ingredients, allergens emphasised), a counter card that says the matrix exists, a bag sticker with the code and the page address in plain text, and a cake box label that doubles as the confirmation.
Two details from the printing side, both measured rather than guessed: our counter card is 93.0 × 127.5 mm with a 48 mm code (reads at about half a metre), and the A4 poster carries a 126 mm code (about 1.3 m). The familiar 1:10 rule — one unit of code per ten units of reading distance — is an industry rule of thumb, not part of ISO/IEC 18004, so treat it as a floor and leave four modules of quiet zone.
The model, in one line: the label is generated per batch and lives on the package; the matrix, the day and the order live on the page; and the code points at an address, never at a file.
The full piece, with the FDA and FSA citations dated and the two market rules kept separate, is here: A bakery's allergen labels, today's bake times and whole-cake orders. If you want the page without building it, MapToSite builds a free one, and the printed kit is a one-off — with the label text left for the shop to check against its own recipes, because no template knows what went into the batch.
