Maturity Regulation (EU) 2023/915 · Compliance with contaminant criteria
Contaminant control measured site by site, and translated into a costed action plan.
10 themes, a 5-level scale. And the action that moves each level to the next.
The framework’s 10 themes, already written from L1 to L5. One company, one business unit, or 300 at once.
Maturity Regulation (EU) 2023/915 · Compliance with contaminant criteria
10 themes, 5-level scale.
Nordhavn Industries
53 / 100
They measure their maturity with Datamensio
An example
This could be your situation.
Take one company as an example: three sites, three spreadsheets, no shared answer.
Nobody can consolidate.
Nordhavn Industries, 2,400 people in Hamburg, Lyon and Porto. A client asks where the group stands. Each site answers in its own spreadsheet, with its own scales.
Three weeks, a single base.
One Regulation (EU) 2023/915 of 25 April 2023 assessment launched across all three sites at once, from the managers’ interview notes. The framework was already written, its 10 themes and levels L1 to L5 too.
Two costs avoided before being committed.
A score of 53 out of 100, with the gap concentrated on three themes. The AI companion spotted that two actions duplicated those of another audit. The committee report took one sentence to request.
What it saved them
- 3sites measured on the same base, instead of three questionnaires to reconcile
- 2duplicate actions caught before the spend
- 1committee report, with no manual rework
These figures are an example. They could be yours.
The standard imposes processes. Datamensio says where you stand.
01
The framework is already written
Themes, questions and levels L1 to L5, all written. You do not start from an empty spreadsheet.
02
The score lands the same day
Online, by self-assessment link or in interview. Theme by theme, comparable over time.
03
The gap becomes a costed plan
Every step up carries its action. The AI prioritises on expected effect, not on the order of the standard.
04
Progress can be demonstrated
Campaign after campaign, against your target and against your own past. That is what your board asks for.
The maturity scale
One level, the next, and the action that links the two.
This mechanism, a level, the level above, and the action linking the two, is what turns an observation into a trajectory.
Is the contaminant sampling plan built on a documented and reviewed risk analysis?
- N1
No formalised plan. Analyses are triggered on customer request or after an incident.
- N2
A plan exists and sets frequencies, but its basis is not documented and it has not been reviewed for several campaigns.
- N3
The plan is based on a written risk analysis per contaminant/product pair, applied across all flows, with an annual review.
- N4
Frequencies are adjusted according to result history, origin and supplier. Deviations from the plan are recorded and justified.
- N5
The plan is readjusted mid-campaign based on external and internal warning signals, and its effectiveness is periodically evaluated with traceability of revisions.
Action to move from L2 to L3
Formalise the risk analysis per contaminant/product pair before the next campaign, drawing on the last three years of results, then put its review on the agenda of the annual quality review.
« With Datamensio, we meet our objectives far more efficiently. The ERDF inspection services and our supervising ministry particularly appreciated an approach that gives them reliable data. »
Director, CCI 94CCI Île-de-France
« We believe this is the most suitable solution to scale our transformation project and measure impact according to our needs. »
Maja SucekChief Operating Officer, Interreg Danube
Rarely on its own
Frameworks combine. Put several together to cover your business, or have the AI write yours.
Take your first measurement
What this framework covers
Regulation (EU) 2023/915 sets maximum levels for contaminants in food: mycotoxins, heavy metals, nitrates, process contaminants, persistent organic pollutants, plant alkaloids. It sits downstream of Regulation (EC) No 315/93, which establishes the principle of keeping contaminants as low as reasonably achievable. It prescribes neither sampling method nor frequency: these are set out in implementing regulations on sampling and analysis, and above all in the plans each operator builds and must be able to justify.
This is where oversight becomes difficult, particularly for a cooperative or federation sourcing from many producers. On what basis was the analysis frequency set, and when was it last reviewed? Are the thresholds applied internally aligned with the latest consolidated version of the text, or with a grid carried over from several campaigns ago? What actually happens between a non-conforming laboratory result and the effective blocking of the batch concerned, and how much time elapses between the two?
One confusion recurs often: Regulation 2023/915 and Regulation (EC) No 396/2005 on maximum residue limits for pesticides do not cover the same substances. Residues of plant protection products fall under the latter. Contaminants, by contrast, are not intentionally added: they come from the environment, storage, or the processing method. The two frameworks rely on similar analysis plans and are often handled by the same team, but their thresholds, review cycles and traceability obligations are distinct.
The official control, under Regulation (EU) 2017/625, concludes with a compliance or a deviation on a batch and a date. The maturity assessment answers a different question: what level of control the system has reached, and which specific action moves it to the next level. A site can be compliant across all its analyses for the campaign and still be fragile, because its sampling plan is not based on a documented risk analysis and a change of supplier alone would be enough to put it at fault.
In Datamensio, the framework is ready to use and adapts to your supply chains. The AI adjusts themes, questions and levels according to your product categories, or builds a variant from your monitoring plans, your non-conformity management procedures and your customer specifications.
Reference standard: Regulation (EU) 2023/915 of 25 April 2023
The themes assessed
Regulatory monitoring and threshold framework
Tracking the consolidated version of the regulation, incorporating changes to maximum levels, updating internal grids, alignment with stricter customer requirements.
Contaminant risk analysis
Identification of relevant contaminant/product pairs, consideration of geographic origin, process and storage, prioritisation, frequency of risk analysis review.
Monitoring plans and sampling
Building the plans, justifying frequencies, representativeness of samples, compliance with applicable sampling methods, coverage of raw materials and finished products.
Analysis and laboratories
Laboratory accreditation, limits of quantification suited to thresholds, measurement uncertainty and its use in decision-making, turnaround times, counter-analyses.
Upstream control at collection
Producer specifications, good agricultural and harvesting practices, drying and storage conditions, sorting and rejection, member awareness.
Control of process contaminants
Acrylamide, polycyclic aromatic hydrocarbons, 3-MCPD and glycidyl esters: identification of generating steps, process parameters, mitigation measures and verification of their effect.
Traceability and batch management
Definition and identification of the batch, linking of analysis results, upstream and downstream reconstitution capability, blocking and release.
Managing exceedances and non-conformities
Decision criteria, blocking, notification of competent authorities and customers, withdrawal and recall, prohibition of blending and unauthorised detoxification, root cause analysis.
Indicators and management review
Tracking results and trends by contaminant and origin, internal alert thresholds, reporting at management review, decisions and trade-offs recorded.
Competence and documentation
Qualification of people responsible for plans and decisions, up-to-date procedures, accessible records, readiness for official controls.
A short version of the framework is available for the online self-assessment.
Frequently asked questions
Does Regulation (EU) 2023/915 lead to a certification?
No. It is a directly applicable regulation, verified by competent authorities during official controls. The assessment measures the maturity of your control system and prepares for these controls, it does not issue any certificate.
What is the difference from a compliance audit?
The audit rules on batches, records and dates, and concludes with a deviation or compliance. The assessment positions your practices on a maturity scale and points to the action that drives progress. The first validates, the second builds the trajectory.
Does this framework also cover pesticide residues?
No, maximum residue limits fall under Regulation (EC) No 396/2005, which has its own separate framework. The two assessments intersect in a cross-cutting roadmap, since they rely on the same analysis plans and the same laboratories.
How long does the assessment take?
The short version takes 20 to 30 minutes to complete for a quality manager. The full version, run collaboratively with the laboratory, sourcing and production teams, typically spans one to two weeks, most of the time being spent gathering records.
Can the framework be adapted to our supply chains?
Yes. Themes, questions and levels can be modified, and the AI generates a variant per product category from your monitoring plans and specifications. The framework remains your property.
How can several sites or members be compared?
Each assessment produces a score per theme. The benchmark compares business units against each other and each entity against its previous campaigns. A consolidated roadmap groups common actions and avoids duplicating the same effort across ten sites.
How does this assessment fit with FSSC 22000 or HACCP?
Contaminant control feeds into prerequisite programmes and chemical hazard analysis. A solid 2023/915 assessment provides the elements expected on this front and is reused when preparing for the certification audit.
Where is the data hosted?
In France, with OVH, backed up at Scaleway. No transfer outside the European Union. The AI models used can be selected, including from European providers.