Selling Food Online in Ireland: Website Rules

The order landed at twenty past one on a Saturday. Two boxes, delivery fifteen minutes out the road, card payment, nothing in the special instructions field. It looked like every other order that afternoon.

The letter arrived a fortnight later, and it was not about the food. It was about the ingredients line on the website.

That scene is illustrative rather than a case I can name. The mechanism behind it is neither. Since late 2024, Irish law has said in plain terms that where food is offered for sale by means of distance communication, an authorised officer "may order samples without identifying himself or herself" ^[1]. That sentence sits in Regulation 8(5) of the amended allergen regulations. An inspection can now begin on your product page, on a laptop, with a card payment, before anyone walks through your door.

I was on a call with a food producer a couple of weeks back who had never heard this. She is not unusual. Everyone selling food online here knows the kitchen gets inspected. Very few have been told the website does too.

Your website is part of the shop now, legally speaking

The Food Safety Authority of Ireland says it about as directly as a regulator ever says anything: "Your inspector can check your business's website or social media page before, during or after inspections" ^[2].

That is not a new interpretation. General EU food law has always said that labelling, advertising and presentation of food, "and the information which is made available about them through whatever medium, shall not mislead consumers". Whatever medium. A chalkboard, a printed menu, a product page. The medium was never the point.

The 2014 allergen regulations define a "relevant thing" as any medium through which food is presented or made available for sale, or through which food information is displayed ^[1]. Your website is a relevant thing. An officer can inspect it, copy it, photograph it, and now buy from it without saying who they are.

What that means on a Tuesday morning is simple. If your kitchen swaps supplier and the new mayonnaise carries mustard, the ingredients line on the site is wrong from that moment, and it stays wrong until somebody edits it. If editing your own site means emailing whoever built it and waiting three days for a quote, you are not running a compliant page. You are running a page that happened to be correct once.

What actually has to be on the page before someone can pay

This is where most owners overestimate the burden in one direction and underestimate it in the other.

If you sell prepacked food online, food boxes, jars, bags of coffee, anything packed before it was offered for sale, the mandatory information under the Food Information to Consumers Regulation has to be available before the purchase is concluded. Name of the food, ingredients list with allergens emphasised, quantities of certain ingredients, net quantity, storage conditions, your business name and address, country of origin where its absence would mislead, instructions for use, alcoholic strength above 1.2%, and a nutrition declaration ^[3].

One merciful exception. The best-before or use-by date does not have to be shown before purchase, since you cannot know which jar you will pick off the shelf. It must be on the label of the food you deliver.

If you sell non-prepacked food, the deli counter, the pizza, the cakes made at home for collection, the requirement narrows sharply. The only information that must be available before the purchase is concluded is the allergen information ^[3]. It must be provided in writing at one of two stages: before the purchase, or on delivery.

Type of online sale	Must be available before purchase	Also required
Prepacked food	Full mandatory food information, allergens emphasised	Best-before or use-by on the delivered label
Non-prepacked food	Allergen information only	Provided again at delivery, written at one stage or the other
Advertising only, no purchase facility	No mandatory food information	Claims rules still apply in full

That third row is the one people miss in both directions. If your site says you make sourdough and gives a phone number, with no way to complete a purchase, FSAI guidance is explicit that you do not need to publish the mandatory information, because "advertising is about promoting the fact that your business sells a food, not closing the contract for a sale" ^[3]. Add an order button and the position changes that afternoon.

Prepacked, non-prepacked and advertising-only sit under three different sets of duties.

The allergen wording is stricter than most menus

Fourteen substances have to be declared: cereals containing gluten, crustaceans, eggs, fish, peanuts, soybeans, milk, nuts, celery, mustard, sesame, sulphur dioxide and sulphites, lupin, and molluscs ^[4].

The regulations set out how, not just whether. The information has to be freely and easily accessible before the sale, in English or in Irish and English, in a conspicuous place, in clear legible script, and presented so there is no possibility of confusion about which food it relates to ^[1]. That last clause is the one that catches people. A single allergen page listing everything the kitchen holds, three clicks from the product, does not relate clearly to the dish. An allergen line under each item does.

One relief: where the name of the food clearly refers to the allergen, you do not have to declare it separately ^[1]. Nobody needs telling that the almond croissant contains almonds.

Then there is the failure all of this exists to prevent. A customer with a serious allergy reads your page, sees no mustard, and orders. The recipe changed on Tuesday. Nobody updated the site because nobody could. That is not a fine, that is an ambulance, and everything else in this article is paperwork by comparison.

The words you use for marketing are legal claims

This is the part that surprises owners most, because it does not feel like regulation. It feels like copywriting.

Medicinal claims are simply out. You cannot say food prevents, treats or cures a human disease. Make that claim and the product may be reclassified as a medicine, which puts you under the Health Products Regulatory Authority rather than the FSAI ^[3]. "Great for winter colds" is a sentence with consequences.

Health and nutrition claims must be authorised. Regulation 1924/2006 governs these, and a public EU Register sets out what is permitted and how it must be worded ^[5]. You can adapt wording for clarity, but the adaptation must mean the same thing to the consumer and must not make the claim stronger than the authorised version.

Organic is a certification, not a description. Food may only be marketed as organic, bio or eco if it comes from an operation certified by an official control body ^[3].

Artisan has actual numbers behind it. The FSAI's guidance on marketing terms says the word should only be used where the food is made in limited quantities by skilled craftspeople, by a process that is not fully mechanised, in a micro-enterprise at a single location. Limited quantities means an average of under 1,000 kg or litres a week across the year. Plenty of businesses using the word would pass that test comfortably. Some would not.

And one detail that genuinely catches people out: you must be able to substantiate any claim, and that includes claims made in customer testimonials or blog posts you host on your own site ^[3]. The five-star review saying your kombucha cleared up someone's skin is your claim once you publish it on your page.

Where this stops, honestly

A website cannot carry the whole load, and I would rather say that than oversell the fix.

Written allergen information online does not remove the conversation at the counter, and it cannot speak to cross-contamination in a small kitchen where the same surfaces do everything. "May contain" is a judgement your food safety management system makes, not something a content management system decides for you. If a customer rings to ask whether the coeliac option is prepared separately, the honest answer is about your kitchen, not your CMS.

A fair concession about the ordering platforms, too. If you take orders through a large delivery or marketplace app, its structured allergen fields force a discipline a free-text page does not, and for a one-person operation that scaffolding has genuine value. It is also why so many of those listings are more accurate than the business's own site.

The recall notice nobody plans for

If food you have sold turns out to be unsafe, you have to start removing it from the market and tell your competent authority. Retailers put a notice at the till. Your online customers will never see the till.

The FSAI's guidance is that you should display a point-of-sale notice "in a prominent position on the website or social media page from which the product was sold" ^[3]. Think about what that requires on the worst day your business has had: a notice, published on your homepage, within hours, correct, and taken down again later.

If publishing that means raising a ticket with an agency, you do not have a recall process. You have a hope. That is why being able to update your own website safely and quickly stops being a convenience and starts being a control.

Five verifications that take an afternoon once and minutes thereafter.

Five checks before you take another food order online

Register. If you sell food online you must be registered with a competent authority, even if you operate from home ^[3]. If you are already registered and have just started selling online, tell your inspector, because your activities have changed.
Verify the allergen line item by item. Not a general page. A declaration attached to each product, using "contains" wording, in language nobody has to interpret.
Audit every marketing word. Natural, artisan, organic, immune, detox, traditional. Each one is either substantiated, authorised, certified, or deleted.
Confirm you can deploy a change yourself. Open the site, edit a product description, publish it, and time it. If that took longer than five minutes or needed someone else, fix that before you fix anything else, because getting a site you actually control live is a weekend's work at most.
Write the recall paragraph now. Draft the notice while nothing is wrong, save it, and know where it goes on the homepage.

What this costs to get right

Almost nothing, if you own the site. Everything, if you do not.

That is the arithmetic underneath all of this. Every duty above assumes a business that can change its own words on its own page the day the recipe changes. A site you cannot edit is not a cheaper site. It is a compliance liability with a nice header image, and the same goes for the PDF menu sitting on your homepage, which cannot be corrected quickly and cannot carry a per-item allergen line that relates clearly to anything.

A WordPress site you build and control yourself, on a platform where the whole thing including hosting, security and backups runs to sixty euro a year, makes correcting an ingredients line a two-minute job at the end of service. That is the difference between a recall notice going up at nine in the evening and going up on Thursday.

I got this wrong myself once. Years ago I talked a food client out of a self-managed site because they said they would never touch it. They were right until their supplier changed a stock cube, and then they needed to touch it urgently and could not.

Conclusion

A food business already understands the paperwork that follows food: traceability, temperature records, HACCP. The website has sat outside that model, filed under marketing, and Irish law has quietly stopped agreeing with the filing.

Enforcement remains overwhelmingly about the physical premises. Of the 127 Enforcement Orders the FSAI reported for 2025, slightly down on the 132 the year before, the causes cited were pest infestations, poor hygiene, unsafe storage and missing food safety systems ^[6]. Nobody is closing a farm shop in Laois over an allergen line on a weekend delivery box.

But the page is inspectable, the anonymous order is written into the regulations, and what is on your site is information you stand over. The move is small: read your own food pages this week as if someone with a severe allergy were reading them, and check you could correct anything you find today.

Frequently Asked Questions

Do I need allergen information on my website if I only take orders by phone?

Yes, if the phone order is a distance sale and the food is not prepacked. The rules cover any means of distance communication. Allergen information must be available before the purchase is concluded and again at delivery, in writing at one of those two stages. Publishing it on the website is usually the easiest way to satisfy the first stage.

My website only shows my menu, it does not take orders. Am I covered?

Largely, yes. FSAI guidance is that a site used only to advertise food, with no facility to purchase, does not have to carry the full mandatory food information, because advertising promotes the fact that you sell food rather than closing a contract. The rules on medicinal, health and nutrition claims still apply, and nothing you publish may mislead.

Can an inspector really buy from my website without telling me?

Yes. The 2024 amendment provides that where food is offered for sale by distance communication, an authorised officer may order samples without identifying themselves. They must afterwards take reasonable steps to tell you a sample was taken and, where it is analysed, let you exercise your right to a second expert opinion.

What about the allergen information on the delivery app I use?

Keeping the app accurate is a duty too, and it does not discharge the duty on your own site. Both are means by which you present food for sale. The practical risk is that the two drift apart after a recipe change, so treat one as the source of truth and update the other from it the same day.

Do I have to publish a recall notice on my own website?

If you have sold the affected food online, yes. FSAI guidance is to display a point-of-sale notice prominently on the page the product was sold from, because your online customers will never see a notice at the till. You should also contact those customers directly using the details they gave at checkout.