The fourteen
Annex II of Regulation 1169/2011 lists them: cereals containing gluten, crustaceans, eggs, fish, peanuts, soybeans, milk, nuts, celery, mustard, sesame, sulphur dioxide and sulphites above 10 mg/kg or 10 mg/litre, lupin, and molluscs. Each entry includes products made from them, which is why soy sauce carries both soy and usually gluten.
The obligation covers presence as an ingredient or processing aid that remains in the finished product. It does not cover cross-contamination, which is a food-safety matter handled through your HACCP procedures rather than through the ingredient declaration.
How it must be presented
For prepacked food the allergen must be emphasised in the ingredient list, typically in bold. For non-prepacked food, which is what a restaurant sells, Article 44 says the information must be provided but leaves the means to national law.
Most countries require it in writing, on the menu or on a clearly signposted document available before the customer orders. Some permit a verbal declaration provided a written record exists and a notice tells customers to ask. These are genuinely different regimes, so the answer depends on where your venue is.
Whatever the method, it has to be available before the purchase is concluded, not with the bill.
Keeping it true when the dish changes
The practical risk is not the initial declaration, it is the drift afterwards. A supplier substitution, a chef using a different stock, a special that was never added to the allergen matrix. The declaration is a statement about what you are serving today.
This is the argument for a menu you can change in a minute rather than a printed card or a PDF someone has to re-export. The compliance failure is almost never "we did not know the rule", it is "the menu was three weeks out of date".