Nitrosamine and NDSRI Control After the August 2025 Deadline: Where FDA and EMA Stand
In the summer of 2018, regulators discovered N-nitrosodimethylamine (NDMA), a probable human carcinogen, in valsartan made by a Chinese active pharmaceutical ingredient (API) manufacturer. The finding triggered recalls across dozens of countries and began what has become one of the longest-running quality and regulatory challenges in modern pharmaceuticals. The problem then spread from the sartans to ranitidine, nizatidine, metformin and others, and from small, well-characterized nitrosamines like NDMA to a much larger and more complex group: nitrosamine drug substance-related impurities (NDSRIs), which form from the drug molecule itself.
Seven years on, the regulatory framework has matured, but the work has not ended. FDA's August 2025 deadline for implementing NDSRI controls was converted into a progress report requirement, the European Medicines Agency (EMA) continues to update its acceptable intake limits, and other authorities have aligned around a shared potency-based approach. This article summarizes where the framework stands, what FDA and EMA expect, and how regulatory affairs and CMC teams can manage nitrosamine risk as an ongoing lifecycle obligation.
Why Nitrosamines Are Different
Most impurities are controlled under ICH Q3A/Q3B thresholds or, for mutagenic impurities, under ICH M7 using a threshold of toxicological concern (TTC) of 1.5 micrograms per day. Nitrosamines are part of the "cohort of concern" in ICH M7: a group of high-potency mutagenic carcinogens for which the TTC is not considered sufficiently protective. They therefore require compound-specific acceptable intake (AI) limits, often in the nanograms-per-day range.
Nitrosamines can form when a nitrosating agent (such as nitrite, often present as a trace impurity in excipients, water or reagents) reacts with a secondary, tertiary or quaternary amine under suitable conditions. Sources include API synthesis routes, degradation of solvents and reagents, cross-contamination, packaging materials (for example, nitrocellulose-containing blister lidding), and reactions in the finished dosage form during manufacture or storage.
NDSRIs present a particular challenge because the amine is part of the API itself. Removing the risk may require reformulation, changes to excipients, pH modifiers, or antioxidants, or changes to manufacturing processes, all of which can require regulatory submissions.
The FDA Framework
General guidance
FDA's guidance "Control of Nitrosamine Impurities in Human Drugs," first issued in 2020 and revised most recently in September 2024, recommends a three-step approach for manufacturers of APIs and drug products:
Risk assessment: evaluate the risk of nitrosamine impurities in APIs, marketed products and products under development.
Confirmatory testing: where a risk is identified, perform confirmatory testing using sensitive and appropriately validated methods.
Reporting changes: implement changes to prevent or reduce nitrosamine impurities and report them to FDA through the appropriate submission type.
NDSRI guidance and the Carcinogenic Potency Categorization Approach
In August 2023, FDA issued "Recommended Acceptable Intake Limits for Nitrosamine Drug Substance-Related Impurities." The guidance introduced the Carcinogenic Potency Categorization Approach (CPCA), which assigns an NDSRI to one of five potency categories based on structural features around the N-nitroso group, such as the number of alpha-hydrogens and the presence of activating or deactivating features. Each category has a recommended AI limit:
Category 1: 26.5 ng/day
Category 2: 100 ng/day
Category 3: 400 ng/day
Category 4: 1,500 ng/day
Category 5: 1,500 ng/day
The CPCA is applied where compound-specific carcinogenicity data are not available. Manufacturers can propose alternative limits supported by compound-specific data, such as negative results from an enhanced Ames test or in vivo mutagenicity studies, or data from a structurally related surrogate compound. FDA maintains a public table of recommended AI limits for specific NDSRIs, which it updates as it evaluates additional compounds.
The August 2025 deadline and the June 2025 change
The 2023 NDSRI guidance recommended that manufacturers complete risk assessments, confirmatory testing and any necessary changes, and submit required changes, by 1 August 2025. On 23 June 2025, FDA revised that expectation. Instead of requiring that all changes be submitted by that date, FDA asked applicants to submit progress reports on assessing and mitigating NDSRI risk.
The progress report should include:
whether NDSRIs can form under forced degradation testing;
any NDSRIs detected;
the validated test methodology;
information on the batches analyzed, including manufacturing dates;
confirmatory test results, in ng/day or ppm;
the root cause, if identified;
a description of mitigation efforts; and
the estimated timeframe for completing mitigation.
For application products, FDA asked that progress reports be submitted as an "NDSRI Update" in the Log of Outstanding Regulatory Business section (eCTD Module 1.13.14) of the annual report, revising previously submitted annual reports where necessary. Manufacturers of non-application products (for example, certain OTC monograph drugs) should prepare and retain progress documentation and make it available on request, including during inspections.
The progress report approach gave industry relief from a hard deadline, but it also created a documented record of each manufacturer's status and timelines. Applicants should expect FDA to follow up where reports show slow progress or where estimated timelines slip.
The EU Framework
In the EU, the regulatory basis is the outcome of the Article 5(3) referral on nitrosamines, which the Committee for Medicinal Products for Human Use (CHMP) concluded in 2020, and the EMA's continuously updated "Questions and answers for marketing authorisation holders/applicants on the CHMP Opinion for the Article 5(3) of Regulation (EC) No 726/2004 referral on nitrosamine impurities in human medicinal products."
The EU approach follows three steps similar to FDA's (risk evaluation, confirmatory testing, and submission of variations where changes are needed) and uses the same CPCA framework introduced in 2023, with the same five categories and AI limits. EMA publishes a list of established AI limits for specific nitrosamines in an appendix to the Q&A, and it has introduced an enhanced Ames test protocol and considerations for using negative results to support higher limits.
Deadlines in the EU have been set for completing steps for chemically synthesized and biological products. For NDSRIs, EMA has set timelines for implementing controls where limits were established after initial assessments. Manufacturers should consult the current version of the Q&A, as specific deadlines and transitional arrangements have been updated several times.
Global Alignment
Health Canada, the TGA, Swissmedic, the MHRA and other authorities have adopted approaches broadly aligned with FDA and EMA, including CPCA-based limits. The Nitrosamines International Strategic Group (NISG), an informal collaboration among regulators, has worked to harmonize limits and scientific approaches, which reduces but does not eliminate regional differences. Global manufacturers should maintain a matrix of limits, deadlines and submission types by market, because the same product may have a different established limit or implementation timeline in different jurisdictions.
Managing Nitrosamine Risk as a Lifecycle Obligation
1. Make the risk assessment a controlled, living document
Nitrosamine risk assessments should be controlled documents within the pharmaceutical quality system, not one-time reports. They should be reviewed whenever there is a change in API supplier or synthesis route, excipient supplier or grade, manufacturing process, packaging components, or when new scientific information emerges (such as a new NDSRI identified for a structurally similar molecule).
2. Understand excipient nitrite levels
For NDSRIs in finished products, nitrite in excipients is often the most important controllable variable. Work with excipient suppliers to obtain nitrite data, consider low-nitrite grades where available, and incorporate nitrite specifications or supplier controls where risk warrants it.
3. Consider mitigation strategies early
Mitigation options include reformulation with nitrite scavengers (such as ascorbic acid or alpha-tocopherol), pH modification, changes in excipients, process changes that reduce exposure to nitrosating conditions, and packaging changes. Each option has regulatory implications. RA teams should assess the submission category early (for example, prior approval supplement, CBE-30 or annual report in the U.S.; Type IA, IB or II variation in the EU), because the regulatory timeline often determines how quickly a mitigation can be implemented.
4. Build robust analytical methods
Confirmatory testing requires highly sensitive methods, typically LC-MS/MS or GC-MS, validated to quantitation limits well below the AI limit. Methods for NDSRIs often have to be developed product by product. Laboratories should also consider the risk of artifactual nitrosamine formation during sample preparation.
5. Plan for supply continuity
When an NDSRI exceeds its AI limit, the options are to mitigate, to request an alternative limit supported by data, or, in some cases, to discuss temporary limits with regulators to avoid shortages. Both FDA and EMA have shown flexibility where patient access is at stake, but that flexibility depends on transparent communication and a credible mitigation plan. Consistent with ICH Q9(R1)'s emphasis on product availability, risk assessments should consider supply implications from the start.
6. Keep the regulatory record consistent
Ensure that risk assessments, test results, progress reports, annual report entries and variation dossiers tell the same story. Inconsistencies between what was submitted and what an inspector finds on site are a common source of findings.
Common Questions
Do we still need to act if our product passed the August 2025 progress report stage?
Yes. The progress report documented status; it did not end the obligation. Mitigation must be completed on the timelines reported, and supplemental submissions will be needed for resulting changes.
Can we use CPCA to justify a higher limit than a published one?
No. Where FDA or EMA has published an established limit for a specific nitrosamine, that limit applies unless you provide compound-specific data that support a different limit and the agency agrees.
Does the less-than-lifetime approach apply?
Both FDA and EMA recognize that products intended for shorter durations of use may justify adjusted limits, based on ICH M7 principles, but the conditions and calculations differ. Consult the current guidance and Q&A before relying on this approach.
Worked Example: Applying the CPCA
The CPCA can seem abstract until it is applied to a structure. The method works in two stages.
Stage 1: Alpha-hydrogen count. Count the hydrogen atoms on each of the two carbon atoms directly attached to the N-nitroso nitrogen (the alpha carbons). The combination of counts on each side gives an initial potency score. In general, nitrosamines with more alpha-hydrogens on both sides (for example, two on each side, as in NDMA-like structures) are associated with higher potency, because the metabolic activation pathway that leads to DNA-reactive species proceeds through alpha-hydroxylation.
Stage 2: Structural modifiers. Adjust the score based on deactivating features (such as a carboxylic acid group anywhere on the molecule, the N-nitroso group being within a pyrrolidine ring, or bulky groups near the alpha carbons) and activating features (such as an aryl group or certain electron-withdrawing groups on the alpha carbon). The final score maps to one of the five potency categories and its AI limit.
Illustrative outcome: an NDSRI formed from a secondary amine in an API, where the nitrosamine nitrogen is attached to a methyl group (three alpha-hydrogens) on one side and a secondary carbon (one alpha-hydrogen) on the other, and where the molecule has a deactivating carboxylic acid group, might score into Category 3 or 4 rather than Category 1. The exact outcome depends on the specific scoring rules in the FDA guidance and EMA Q&A, which should be applied exactly as published and documented step by step in the risk assessment.
Two practical lessons follow. First, the CPCA calculation should be reviewed by a qualified toxicologist or chemist, because misclassification can lead to an AI limit that is too high (a patient safety risk) or too low (an unnecessary mitigation burden). Second, if the CPCA places an NDSRI in a restrictive category that is difficult to meet, compound-specific data such as enhanced Ames testing may support a higher limit, but generating those data takes time and should be planned early.
Choosing the Right Regulatory Pathway for Mitigation
Mitigation changes often require regulatory submissions, and the pathway can determine how quickly a change reaches the market. In the U.S., the reporting category for postapproval changes under 21 CFR 314.70 depends on the nature of the change: a change in drug product composition, such as adding an antioxidant, is typically a prior approval supplement, while some manufacturing and specification changes may be reportable as CBE-30 or in the annual report depending on their potential to affect product quality. FDA's nitrosamine guidance has encouraged sponsors to contact the relevant review division where the appropriate reporting category is unclear, and FDA has prioritized review of nitrosamine-related submissions.
In the EU, the Variations Regulation and the classification guideline determine whether a change is a Type IA, IB or II variation. Tightening a specification limit is often a Type IA or IB variation, while a change to the qualitative composition of the product is generally Type II. EMA has also indicated that variations to introduce nitrosamine controls should be submitted in line with the timelines in its Q&A.
For products marketed in multiple regions, a single mitigation strategy should be designed with every market's submission pathway in mind, so that the change can be implemented globally without maintaining different formulations longer than necessary.
The Bottom Line
Nitrosamine control has shifted from a crisis response to a permanent part of pharmaceutical lifecycle management. The CPCA framework has brought consistency, and FDA's progress report approach bought time. But every product with an amine functionality now carries a standing obligation to understand its nitrosamine risk, keep that understanding current, and act when the science or the supply chain changes. For regulatory affairs and CMC professionals, the most valuable investment is a single, controlled source of truth for each product's nitrosamine status across all markets.
Sources
FDA, Control of Nitrosamine Impurities in Human Drugs, Guidance for Industry (Rev. 2, September 2024)
FDA, Recommended Acceptable Intake Limits for Nitrosamine Drug Substance-Related Impurities, Guidance for Industry (August 2023, as updated)
Sidley Austin, "U.S. FDA Revises Deadline for Submitting Changes to Mitigate Nitrosamine Impurities in Drugs" (June 2025): sidley.com
RAPS, "FDA will permit some leeway in nitrosamine testing": raps.org
EMA, Questions and answers for marketing authorisation holders/applicants on the CHMP Opinion for the Article 5(3) referral on nitrosamine impurities in human medicinal products
ICH M7(R2), Assessment and Control of DNA Reactive (Mutagenic) Impurities in Pharmaceuticals to Limit Potential Carcinogenic Risk
Comments