What “May Contain Wheat” Really Means Now: The New FAO/WHO Gluten Rule Explained

The short answer: on 7 July 2026, the FAO/WHO Codex Alimentarius Commission adopted the first international reference dose for gluten: 4 mg. It is a scientific tool that tells manufacturers when a “may contain” warning is genuinely warranted, so those warnings stop being guesswork. It does not change the gluten-free standard, which stays at under 20 ppm. Certified gluten-free products, like every Simply Desserts dessert, are still gluten-free regardless of any “may contain” wording.

If you live with celiac disease, you know the moment well. You are holding a box in the supermarket aisle. The front says gluten-free. The back says “may contain wheat”. So which is it?

For years there was no good answer, because that warning did not have to mean anything specific. As of this month, that is changing.

In this guide we will cover what Codex adopted, what a reference dose actually does, why the 20 ppm gluten-free standard is unchanged, and how to read a “may contain” label today, including where certification fits and why it remains your strongest signal.

What Codex Actually Adopted

At its 49th Session in Geneva (6 to 10 July 2026), the FAO/WHO Codex Alimentarius Commission, the body that sets international food standards, adopted new risk-based guidance for precautionary allergen labelling. Precautionary allergen labelling, or PAL, is the formal name for “may contain” statements.

For the first time, that guidance includes a reference dose for cereals containing gluten: 4 mg.

The Celiac Disease Foundation, which has served as the North American representative to the Association of European Coeliac Societies since 2018 and convened a Gluten Safety Standards Committee of international experts, worked toward this outcome over roughly two years. It is the kind of slow, technical advocacy that rarely makes headlines but quietly changes what ends up on a label.

What a “Reference Dose” Is, and What It Is Not

This is the part that gets misread, so it is worth being precise. A reference dose is not a new gluten-free threshold. It is not an instruction to you, the shopper. It is a risk-assessment tool used by manufacturers and regulators.

The 4 mg figure was derived to keep cumulative daily gluten intake below roughly 10 mg per day, a level rooted in the science behind the original Codex gluten-free standard. Manufacturers take that reference dose, work out how much of their product a person eats in one sitting, and calculate an action level for that specific food.

Then the logic is simple. If a risk assessment shows unintended gluten cannot be prevented or kept below that action level, a “may contain” statement is warranted. If it can, the warning is not needed.

That is the real change: “may contain” becomes a signal that means something, rather than a blanket disclaimer applied by a lawyer to cover every conceivable scenario.

The 20 ppm Gluten-Free Standard Has Not Changed

Worth saying plainly, because this has caused confusion since the announcement. Foods labelled gluten-free must still contain less than 20 parts per million of gluten. Codex retained that standard.

The 4 mg reference dose sits alongside it and does a different job. One defines what “gluten-free” means. The other defines when a precautionary warning is honest.

So Can You Eat Something That Says “May Contain Wheat”?

Here is where the certifiers are refreshingly direct. The Gluten Intolerance Group, which runs the GFCO certification programme, publishes guidance on exactly this question. Their position: if a product is certified gluten-free, it is gluten-free, regardless of any “may contain” statement on the pack. The certification is the stronger signal, because it is backed by testing.

Part of the confusion is that “may contain wheat” is often aimed at a different audience entirely. People with a wheat allergy react to wheat proteins beyond gluten, so a manufacturer may flag wheat in the facility for their benefit. That statement is not necessarily telling a person with celiac disease anything about gluten content.

Celiac disease and wheat allergy are different conditions. Beyond Celiac and the Celiac Disease Foundation both cover the distinction in depth, and it is worth understanding. We also break down the major allergens in our guide to the 8 foods that cause 90% of all food allergies.

Where the United States Stands

The US currently has no formal precautionary labelling framework for gluten. Nothing obliges a manufacturer to justify a “may contain” statement, and nothing stops one printing it for pure caution.

The Celiac Disease Foundation has submitted formal comments urging the FDA to adopt the 4 mg reference dose and to require declaration of barley-derived and rye-derived ingredients. Codex guidance is not automatically binding on any country, so what happens next depends on regulators choosing to adopt it.

That is slow work, and it is the same patient advocacy that produced 30 proclamations recognising May as Celiac Disease Awareness Month this year, a record, from 29 states and the District of Columbia, with requests submitted in all 50 states. More than 3 million Americans live with celiac disease.

How to Read a Label Right Now

Until the FDA moves, here is the practical order of trust.

1. A gluten-free certification mark is your strongest signal. It means a third party tested the product, not just that the brand said so.
2. “Gluten-free” on the label is meaningful, and legally means under 20 ppm in the US.
3. “May contain wheat” on an uncertified product is ambiguous. It might reflect real risk, or a cautious legal department. You cannot tell which, which is precisely the problem Codex is fixing.
4. “Processed in a facility that also processes wheat” tells you very little about what is actually in the food. Under the new guidance, statements like this should give way to assessments based on real risk.

Where Simply Desserts Fits

We are not neutral here, so we will be specific rather than vague. Every Simply Desserts dessert is GFCO certified. The Gluten-Free Certification Organization, run by the Gluten Intolerance Group, requires 10 ppm or less, which is twice as strict as the FDA’s 20 ppm rule, and it is verified through ingredient review, facility inspection and product testing rather than self-declared.

We did not do that because a regulation forced us to. We did it because “trust us” is not good enough when getting it wrong means an autoimmune response.

Our Instant Puddings and Jel Desserts are also plant-based and dairy-free, which matters given how many people with celiac disease also avoid lactose. (Our Protein Puddings do contain milk, so they are the exception, and we would rather tell you that than let you find out.)

If you want the full detail on what certification involves and how the audits work, we wrote it up here: GFCO Certified Gluten-Free Desserts: Simply Desserts Is Officially Certified.

The Bottom Line

The 4 mg reference dose will not change what is on shelves tomorrow. It is a technical decision by a standards body, and it needs regulators to pick it up before you feel it.

But it matters. For the first time there is an international, science-based answer to “should this product carry a gluten warning?” That is the difference between a label that informs you and a label that just protects the manufacturer. For a community that has spent years decoding ambiguous packaging, that is real progress.

Until then: look for the certification mark. That is what it is for.

FAQ: “May Contain” & the New Gluten Rule