Nitrosamine Risk Assessment: Template and EMA/FDA Steps

Nitrosamine risk assessment: three words that have been a permanent part of the vocabulary of QA, regulatory affairs and Qualified Persons since 2018, the year of the valsartan-NDMA case. Today assessing nitrosamine risk is no longer an extraordinary, crisis-driven exercise but a standing requirement: every MAH and every applicant must demonstrate, in a structured and defensible document, that the risk of N-nitrosamine formation or contamination in their products has been evaluated. In this article we walk through how to set up the risk assessment step by step, how to structure the template, which limits apply under the CPCA approach and which weaknesses inspectors challenge most often.

Why the nitrosamine risk assessment is mandatory

N-nitrosamines are classified as probable human carcinogens, and some of them, such as NDMA and NDEA, are among the most potent mutagens known. After the recall of numerous batches of sartans, ranitidine and metformin, EMA conducted a review under Article 5(3) of Regulation 726/2004, concluded with the CHMP opinion of 2020. Since then the obligation has been generalised: the risk evaluation applies to all human medicinal products, with principles covering both chemically synthesised and biological medicines. The operational reference is the Q&A document EMA/409815/2020, continuously updated (revision 22 dates from May 2025), complemented by the CMDh/HMA pages for nationally authorised products.

The regulatory framework: EMA, CMDh and FDA

The European package consists of the Q&A plus three technical appendices: Appendix 1 lists the acceptable intake (AI) limits already established for individual nitrosamines; Appendix 2 describes the Carcinogenic Potency Categorisation Approach (CPCA) used to derive the AI of nitrosamines without experimental data, including NDSRIs (nitrosamine drug substance-related impurities); Appendix 3 defines the Enhanced Ames Test conditions. The CMDh also publishes the official Step 1 response templates ("risk identified" and "no risk identified"), which are worth using as the backbone of your own dossier. On the US side, FDA consolidated its expectations in the guidance "Control of Nitrosamine Impurities in Human Drugs" (Revision 2, September 2024) and in a dedicated guidance on recommended acceptable intake limits for NDSRIs. The general principles remain those of ICH M7(R2) on mutagenic impurities.

Topics like this change faster than your SOPs: to get a practical, no-frills weekly update on GMP, data integrity and inspections, subscribe to The Pragmatic GMP, the free GuideGxP newsletter.

The three steps of the call for review

The European procedure is structured in three steps, and the same logic can be reused for every new product or variation:

1. Step 1 – Risk evaluation: a documented analysis of process, raw materials, excipients, packaging and supply chain to identify plausible root causes of formation or contamination. The outcome is binary: risk identified or no risk identified.
2. Step 2 – Confirmatory testing: if a risk is identified, batches are tested with sensitive analytical methods (typically LC-MS/MS or GC-MS), with an LOQ adequate for the applicable limits.
3. Step 3 – Variation: if presence is confirmed above the limits, corrective measures are implemented (reformulation, supplier change, specification controls) through a variation to the marketing authorisation.

The original call-for-review deadlines have passed (for chemical medicines Step 3 had to be closed by 1 October 2023), but the obligations remain fully in force: every new marketing authorisation application, every relevant variation and every new piece of information on root causes requires an updated assessment, and corrective actions must be implemented within three years of a new AI limit being established.

How to structure the risk assessment template

A nitrosamine risk assessment that stands up in an audit contains at least these sections:

• Scope and product identification: name, marketing authorisation, dosage form, maximum daily dose (needed to convert the AI into ppm).
• Process description: API synthetic route, reagents and solvents (watch out for nitrites and secondary or tertiary amines), recovered solvents, reaction conditions.
• Root cause analysis: for each known cause — nitrosating agents plus vulnerable amines, contaminated solvents and catalysts, recovered materials, cross-contamination, excipients with trace nitrites, water, primary packaging — document whether it is plausible in your specific case.
• NDSRI evaluation: if the API or its impurities contain vulnerable amines, assess possible nitrosation of the drug substance itself.
• Conclusion and applicable limits: AI from Appendix 1 or from the CPCA, conversion into concentration, comparison with analytical capability.
• Decision and follow-up: Step 1 outcome, confirmatory testing plan if needed, periodic review within the PQR and change control.

Acceptable intake limits: the CPCA approach

For nitrosamines without carcinogenicity data, the AI is determined with the CPCA, which assigns a potency category based on the structural features of the molecule (alpha-carbon activation, deactivating groups, steric hindrance):

For nitrosamines with robust data, the Appendix 1 AIs apply instead: for example 96 ng/day for NDMA and 26.5 ng/day for NDEA. Where several nitrosamines coexist in the same product, the risk must be assessed cumulatively, and for limited treatment durations the Q&A allows less-than-lifetime approaches. In every case the limit in ppm depends on the maximum daily dose: an AI of 18 ng/day for a 600 mg/day dose means 0.03 ppm — a level your analytical method must actually be able to see.

The mistakes inspectors challenge most often

Three weaknesses recur in findings: "photocopy" risk assessments taken from the API supplier, with no evaluation of the finished product (excipients, water, packaging, stability); "no risk" conclusions not supported by documented evidence on the supply chain; and lack of document maintenance, with assessments never updated after change controls, supplier changes or new Q&A revisions. The nitrosamine risk assessment is a living document: it must be referenced in the PQR and reviewed at every relevant variation.

GuideGxP recommendation

Treat the nitrosamine risk assessment as a full QRM process, not a one-off compliance exercise: assign an owner, define a review trigger in change control, use the CMDh templates as your response format and maintain a master table with AI, CPCA category and status for every product in the portfolio. In an audit, being able to show the complete chain — root cause, limit, analytical data, decision — is worth more than a hundred pages of regulatory preamble.

To go further: the GuideGxP guide Elemental, mutagenic and nitrosamine impurities: risk assessment under ICH Q3D and M7 includes the complete PDE/TTC/CPCA operational workflow with ready-to-use Excel and Word toolkits.

Official sources

• EMA – Q&A for MAHs/applicants on nitrosamine impurities (EMA/409815/2020)
• CMDh/HMA – Nitrosamine impurities: appendices and Step 1 response templates
• FDA – Guidance for Industry: Control of Nitrosamine Impurities in Human Drugs