Is a "may contain" warning a legal requirement?

No. In the UK, EU, US, Canada, Australia and New Zealand precautionary allergen labelling is voluntary. What the law requires is that what you do say is accurate and not misleading.

Can I just put "may contain nuts" on everything?

You can, but it is a bad idea. A blanket warning tells allergic customers nothing, so they either ignore it or can't eat anywhere. Regulators in every one of these countries say precautionary labels should follow a real risk assessment.

What's the difference between cross-contamination and cross-contact?

They mean the same thing for allergens: an allergen getting into food that doesn't contain it as an ingredient. US guidance says cross-contact; UK, EU and Australian guidance mostly says cross-contamination.

"May contain" allergen warnings: when and how to use them

Contains and may contain are different statements

Contains is a fact about the recipe. The allergen is an ingredient, or part of one.
May contain is a judgement about risk. The allergen isn't in the recipe, but could reach the dish through shared equipment, an open kitchen or a supplier's own precautionary label.

Customers need to tell the two apart. A severely allergic diner will avoid both; someone with a mild intolerance may be fine with a "may contain". Showing them the same way takes that choice away.

When a "may contain" is honest

Use it for a specific, real risk you can't control away, for example:

fries cooked in the same oil as battered fish or breaded chicken;
a dessert topped at a station where nut toppings are also used;
a bought-in ingredient whose supplier label says "may contain sesame".

Don't use it:

as a substitute for good practice. If you can clean the board or use a separate pan, do that instead;
on every dish "just in case". A blanket warning stops being information;
in place of a "contains". If the pesto has pine nuts and cashews, the dish contains them.

What regulators say

UK and EU: precautionary allergen labelling is voluntary. The UK Food Standards Agency's guidance is to use it only after a risk assessment, to name the specific allergen, and not to use it as a substitute for good hygiene practice. The 14 allergens guide covers the mandatory part.
US: FDA says advisory statements are voluntary, must be truthful and not misleading, and are not a substitute for current good manufacturing practice. See the big 9 guide.
Canada: Health Canada recommends a single, consistent wording, "may contain [allergen]", and only where a risk can't be avoided. See the Canada guide.
Australia and New Zealand: precautionary statements are voluntary; most manufacturers use the Allergen Bureau's VITAL risk-assessment program. See the PEAL guide.

Kitchen-wide notes versus per-dish warnings

Some risks apply to the whole kitchen: "we handle nuts", "our fryers are shared". Say that once, in a short note under your allergen matrix. Keep per-dish "may contain" marks for risks specific to that dish, so they still mean something.

Showing it on an allergen matrix

On an allergen matrix, give "may contain" its own mark, such as a hollow circle next to the solid "contains" dot, and explain both in the key. Allergens does this for you: mark a dish, ingredient or option as "may contain", and it shows as a hollow marker on the page, print view and PDF. A customer who filters out an allergen hides both.