Allergen declarations have no expiry date. So when is one out of date?

An allergen declaration does not expire, because nothing on it ever said when it would. There is no printed validity date, no certificate number with a renewal cycle sitting behind it, and no issuing body that withdraws it. It is a statement from your supplier about what their product contains and what runs on the same line, true on the day somebody signed it. So the honest answer to how long an allergen declaration is valid is this: for as long as the formulation, the site and the supplier's own inputs are unchanged. The date you track is a date you choose, write down, and can justify when an auditor asks.

The convention most QA teams settle on is three years from the date printed or written on the form, with an annual reconfirmation for the materials that carry allergen risk into your own product. Three years is not plucked from the air. BRCGS Issue 9 requires that where supplier approval rests on a questionnaire, the questionnaire is reissued at least every three years and the supplier is required to notify you of significant changes in the interim. The standard applies the same floor to raw material risk assessment and to specification review, which it expects to be frequent enough to keep the data current, at minimum every three years. An allergen declaration sits in the same family of documents, so a three-year renewal period with an interim notification clause is a rule an auditor already recognises.

Why there is no date to find

It helps to separate the documents in your supplier file into two groups, because they fail in completely different ways.

The first group carries its own expiry. A BRCGS or SQF audit certificate has a certificate expiry date on its face. So does an insurance certificate, a kosher or halal certificate, an organic certificate. For these, the date you track is the supplier's date. You are copying, not deciding.

The second group carries only a signature and, if you are lucky, a date. Allergen declarations, vendor approval questionnaires, GMO statements, continuing guarantees, letters of guarantee, specification sign-offs. Nobody issues these on a cycle. They are written once, often by a technical manager who has since left, and they sit in your file unchanged until something forces the question. The question is usually an auditor pulling three supplier files at random and asking how you know the declaration is still true.

That is the real answer to the query. The second group does not go out of date on its own. It goes out of date against your own written rule, and if you have no written rule, the auditor will supply one, which is rarely the one you would have picked.

Setting a renewal period per document type

A single blanket period across every document is the thing that makes the file unmanageable. Annual re-collection of everything buries you in chases that suppliers learn to ignore. A three-year period applied to audit certificates would leave expired certificates reading as current for two years. The workable approach is one period per document type, written into your supplier approval procedure, with a risk-based override for individual suppliers.

• Audit certificate: use the printed expiry. No renewal period of your own. The chase should start before the certificate lapses, not after.
• Certificate of analysis: per batch or per delivery, not per year. A CoA is evidence about one consignment, so a renewal period is the wrong tool entirely.
• Allergen declaration: three years from the date on the form is the defensible default, shortened to twelve months for suppliers of materials that carry one of your declared allergens, or where the supplier handles allergens you exclude.
• Vendor or supplier questionnaire: three years, matching the BRCGS questionnaire reissue requirement directly.
• Continuing guarantee or letter of guarantee: three years, and no longer. Practitioners report minor nonconformances raised against guarantees that had been left on file for six years, which is what happens when a document with no expiry also has no renewal period.
• Insurance: the printed expiry, usually annual.

Two details make the difference between a rule that survives an audit and a rule that reads as paperwork. First, the declaration must require the supplier to notify you of any change in the interim, otherwise a three-year period is a three-year blind spot. Second, a reconfirmation does not have to be a brand new document. An email from the supplier confirming the declaration on file is still accurate, filed and dated, is evidence of review. It is far easier to obtain than a re-signed form, and it is the thing that keeps the annual tier realistic.

The date you track is the date on the form

The most common error is quiet and expensive. The declaration goes into the folder, and the date recorded is the date it was filed, or the date the file was last touched, or the modified timestamp on the PDF. Three years later the clock is wrong by however long the document sat in an inbox before anyone opened it.

Record two dates. The issue date is what the supplier wrote on the form. The due date is the issue date plus the renewal period for that document type. Everything downstream, every reminder, every status colour, every row an auditor reads, should compute from those two. If a supplier sends a declaration with no date at all, that is not a document you can track, and the correct response is to send it back and ask for a dated and signed version rather than inventing a start date for it.

Answering the auditor who asks for an updated statement

When an auditor asks for an updated allergen statement, they are usually testing one of three things: whether the document is dated at all, whether it is older than your own stated renewal period, or whether a renewal period exists in writing. The answer is not the document. The answer is four pieces of evidence, in this order.

1. The written rule. Your supplier approval procedure names a renewal period per document type and the risk basis for shortening it. This turns "it is three years old" from a finding into a planned state.
2. The dated evidence of review. The issue date, the computed due date, and a record that somebody in QA opened the document and checked it. Many QA managers only ever proved review by the act of typing the date into a spreadsheet, so when that step is automated the proof has to be recorded deliberately instead.
3. The chase record. If the declaration is within three months of its due date, the auditor wants to see that the request has already gone out, with dates, not that you will do it after the audit.
4. The risk decision, if it has lapsed. Some documents will be past due while you wait on a supplier who is not responding. A dated note saying who assessed the lapse, what the material is used in, and what interim control applies is a far better answer than silence. Several QA programmes already require a risk assessment where documents are not renewed before expiry, so this is the expected route, not an excuse.

That last point is worth sitting with. An expired allergen declaration with a documented risk decision and a chase history is a managed situation. An expired allergen declaration nobody noticed is a nonconformance about your system, which is more expensive, because the auditor now has reason to sample wider.

How Certly handles documents with no printed expiry

Certly was built around exactly this problem, because allergen declarations and vendor forms were the documents the spreadsheet never handled well.

Each supplier record names the certificate types you require from them, including allergen declarations, certificates of analysis and audit certificates. When the QA team uploads a document manually, the form takes the issue date, the date on the form itself, and derives the due date from the renewal period you have set. That renewal period is configurable per certificate type for your plant, so audit certificates can run on their printed expiry while allergen declarations run on three years, without either rule leaking into the other.

From there the tracking is the same for every document type. Alert thresholds at 90, 60 and 30 days before the due date are configurable per certificate type, and a scheduled check recomputes status. Chase emails go to the supplier contact with a single-use upload link, so the supplier can return the renewed declaration without an account or a login, and every send is logged against the supplier. The dashboard shows four states per certificate, current, expiring soon, expired and missing, on one screen, and exports as a PDF for auditor review. A certificate can be marked as reviewed by a named user, and that sign-off appears on the dashboard row and in the exported PDF, which is the proof-of-review point above. Where a document has lapsed while you wait on the supplier, the QA team can record a risk decision against it so the auditor sees the judgement, not a gap.

One boundary matters here, and it is stated on the dashboard and on the PDF itself: Certly tracks and reminds on certificate expiry, it does not verify certificate authenticity or guarantee regulatory compliance. Deciding that a three-year renewal period is right for a given material, and reading the declaration to check it still matches the specification, is QA work. What the tool removes is the part where a document with no printed expiry quietly has no due date either.