Nitrosamine Risk Assessment Data Management

Where the Rules Actually Stand in August 2026

Anyone writing a nitrosamine strategy from a 2021 or 2023 memory of the rules will get the timing wrong. The landscape has moved several times, and the most consequential changes are recent. Before describing the data problem, it is worth stating plainly what the requirements are today and what has shifted.

Europe: the call for review is closed, the obligation is not

The European response ran through an Article 5(3) referral under Regulation (EC) No 726/2004, which produced the three-step call for review familiar to every regulatory affairs group: step 1 risk evaluation, step 2 confirmatory testing, step 3 variation to the marketing authorization where changes were needed.¹ EMA now states directly on its guidance page that the deadlines for steps 1, 2, and 3 have passed for medicines containing both chemically synthesized and biological active substances.¹

That is easy to misread as completion. It is not. The same page carries the obligation that actually governs day-to-day work: marketing authorization holders should implement corrective and preventive action within three years from the point at which an acceptable intake limit is established and published.¹ Because new limits keep being published, that three-year clock keeps starting again on different products at different times. There is no single portfolio deadline. There are dozens of overlapping ones, and they are set by an external document you do not control.

The controlling reference document is the CMDh and EMA question and answer document for the Article 5(3) referral, which reached revision 23 in October 2025.¹³ Its Appendix 1 holds the tabular list of acceptable intakes. That appendix was updated in March 2026 and again on June 24, 2026, each time adding entries and revising some existing values.¹¹³ Appendix 3 covers the enhanced Ames test. EMA and the CMDh also published a joint report in July 2025 setting out how the European regulatory network handled the whole episode, which is the most useful single account of how the requirements were built.⁴⁵

The United States: a softened deadline, not a removed one

FDA published revision 2 of Control of Nitrosamine Impurities in Human Drugs in September 2024.⁷¹⁴ The substantive change in that revision was the separation of two populations: the smaller nitrosamines that arise from reagents, solvents, catalysts, and contaminated materials, and the larger nitrosamine drug substance-related impurities, or NDSRIs, formed from the active substance itself. They behave differently, they are found differently, and they are limited differently.

Revision 2 recommended that confirmatory testing and any resulting application changes for products with NDSRI risk be concluded by August 1, 2025. In mid 2025 FDA revised that expectation. Confirmatory testing was still expected, but where mitigation could not be completed, companies were told to file a progress report by August 1, 2025 rather than a completed change.⁸ The progress report is submitted under an “NDSRI Update” heading in the Log of Outstanding Regulatory Business at eCTD section 1.13.14, within the annual report or as an amendment, and it is expected to cover forced degradation findings, impurities detected, validated methods, batches analyzed and their manufacturing dates, confirmatory results, root cause where known, mitigation attempted, and an estimated completion date.⁸

Read that list again as a data specification rather than a regulatory instruction. It is exactly the record structure an organization needs anyway, product by product, and FDA has now asked for it in a form it can review across a portfolio. Companies that had the underlying information in structured form assembled these reports quickly. Companies that had it distributed across assessment documents, laboratory reports, and email threads did not.

Limits: the CPCA and the lists that keep moving

The Carcinogenic Potency Categorization Approach, or CPCA, is the mechanism that made portfolio-scale limit setting possible. It assigns a nitrosamine to one of five predicted potency categories based on activating and deactivating structural features, and each category carries an acceptable intake.⁹ The categories run from the most potent, where EMA applies 18 ng/day and FDA applies 26.5 ng/day, up to 1500 ng/day for the least potent.⁹¹⁵ The underlying risk target is consistent: a lifetime excess cancer risk of one additional case in 100,000.¹

FDA maintains a published list of recommended acceptable intake limits for NDSRIs alongside its 2023 guidance on the subject, and that list has grown past 250 substances.⁶¹⁰¹⁵ EMA maintains Appendix 1. Health Canada maintains its own guidance and its own limit table, updated during 2025, and applies a comparable three-year corrective action window keyed to when a limit was published.¹¹ The three lists are close but not identical, which is itself a data management problem for any company registered in all three markets.

What is coming: ICH harmonization, but not yet

The ICH M7 Sub-Group was formed to fold nitrosamine risk assessment and control into the M7 framework, which currently sits at revision 2 with its addendum on compound-specific acceptable intakes.¹⁶ The sub-group’s final concept paper was endorsed in 2025, and its published work plan targets a Step 2 draft in 2028.¹²¹⁷ The direction of travel is a harmonized addendum plus compound-specific monographs, which will eventually reduce the divergence between regional limit tables.

The practical read for a leadership team is straightforward. Harmonization is real and it is coming, but it is years away. Anyone waiting for ICH to simplify the problem will spend the intervening period managing three separate limit tables against a portfolio, on three separate clocks. The data capability has to be built now, and it has to be built so that a future harmonized table can be loaded into it without reworking every record.

Why This Is a Portfolio Data Problem, Not a Project

Most organizations staffed nitrosamine work as a program with an end date. A cross-functional team, a tracker, a push to clear the step 1 and step 2 deadlines, and then a handover back to the line. That model was reasonable for the call for review. It fails for what came after, because the obligation has a shape that project structures handle badly.

The unit of assessment is not the product

The first thing that breaks is the assumption that one product equals one assessment. In practice the assessment has to hold for a combination of factors, and any one of them changing can change the answer:

• Product and strength. Because acceptable intakes are expressed as a daily intake, the maximum daily dose determines the concentration limit. Two strengths of the same product can land in different places.
• Active substance source. A second or third approved supplier is a different route of synthesis, different reagents, and a different risk profile. Dual sourcing doubles the assessment work, and it is exactly what supply resilience programs have been pushing companies toward.
• Route and site. The same supplier may run the same active substance at two sites with different solvent recovery arrangements.
• Formulation and excipient sources. Nitrite content in excipients is a recognized contributor to NDSRI formation in the finished product.
• Packaging configuration. Printing inks, adhesives, blister foils, and closure liners have all been considered as sources of nitrosating agents, and extractable and leachable data is part of the evaluation.¹⁸
• Market. The applicable limit table, and the reporting obligation, differ between the EU, the US, and Canada.

A mid-size portfolio of 120 products with an average of two active substance sources and three packaging configurations is not 120 assessments. It is several hundred assessment records, each with its own evidence set and its own expiry conditions. Companies that built one document per product have a structural mismatch between how the obligation is defined and how their evidence is stored.

The trigger for rework is external

The second thing that breaks is the assumption that reassessment is driven by internal events. In most quality processes, the organization decides when to revisit something. Here, roughly half the triggers arrive from outside: a new acceptable intake published, an existing limit revised downward, a new structural class recognized, a supplier notification, a regulatory question on an unrelated variation that touches the same active substance.

External triggers arrive without warning and without regard to internal planning cycles. A limit revision published in June lands on whatever the organization is doing in June. The only defense is a record structure that lets you answer the impact question quickly, because you cannot control the timing.

The evidence has a shelf life

The third thing that breaks is the assumption that a completed assessment stays completed. A risk evaluation is a statement about a manufacturing reality at a point in time. Solvent recovery practices change. Suppliers change their nitrite sources. A packaging vendor changes an ink. Each of those can invalidate a conclusion that was correct when it was written, and none of them will announce themselves as a nitrosamine event.

The published record of what nitrosamine findings have already done to supply is a reasonable argument for taking this seriously. Analyses of the FDA recall data covering the period since 2018 have documented well over a thousand recalled product lots across sartans, ranitidine, metformin, and related products.¹⁹²⁰ Those were not detected by chemists deciding to look. They were detected because someone eventually asked a question that the existing records could not answer.

The Data Each Assessment Needs and Where It Lives

A defensible assessment has to cover a defined set of factors. EMA’s question and answer document names them: route of synthesis, recovered solvents, catalysts and reagents, water, raw materials, packaging, and storage.³ The APIC template used across the active substance industry, updated most recently in January 2026, organizes the same territory into a reportable structure.²¹ The regulatory expectation is clear enough. The difficulty is that the information sits in a dozen different systems owned by a dozen different groups, and several of the most important pieces sit outside the company entirely.

The table below is the mapping worth doing before any tooling decision. It is deliberately blunt about ownership, because ownership is what determines how hard each element is to refresh.

The two elements that decide most assessments

In practice, two lines in that table determine the outcome of most evaluations. The first is whether a nitrosating agent is present anywhere in the route, most often sodium nitrite used to quench excess azide or to destroy residual reagents. The second is whether the process uses recovered solvents or recycled catalysts, particularly where recovery is performed by a third party who also handles other customers’ materials. Cross-contamination through shared recovery has been one of the recurring root causes across the whole episode.

Both of those facts belong to the supplier. Neither is reliably visible in the documents a marketing authorization holder holds. That is the dependency that makes this a supplier data problem before it is an analytical one.

Amine plus nitrosating agent, plus everything that changes it

For NDSRIs specifically, the vulnerable structure is in the active substance itself: a secondary or tertiary amine that can be nitrosated. That means the risk cannot be engineered out of the route, only controlled. The relevant variables become nitrite content in excipients, water activity, pH, temperature and humidity during processing and storage, and packaging contributions.¹⁸ Every one of those is a formulation and packaging data point rather than a synthesis one, which is why NDSRI assessment pulls in groups that were not part of the original 2019 response.

The Supplier Data Problem

Here is the structural difficulty, stated plainly. The marketing authorization holder carries the legal obligation for the risk evaluation. The marketing authorization holder does not hold the route of synthesis. EMA has been explicit that the responsibility remains with the marketing authorization holder even where information in an ASMF or a CEP is not accessible for confidentiality reasons.³ You are accountable for a conclusion you cannot independently verify.

That is not a reason to give up on the data. It is a reason to be systematic about how you request it, what you accept in place of full disclosure, and what you do when a supplier refuses.

What to request, in order of preference

When a supplier will not disclose

Refusal is common and it is not always unreasonable. A contract manufacturer supplying twenty customers does not want twenty different questionnaires exposing its route. The practical responses, in rough order of escalation:

• Fix the quality agreement first. Most agreements written before 2019 have no clause obliging the supplier to notify the marketing authorization holder of changes relevant to nitrosamine risk, and no clause obliging disclosure of the information needed to assess it. Every agreement renewal is an opportunity to add both. Make the notification obligation specific: changes to route, to reagents, to solvent recovery arrangements, to raw material suppliers, and to any third-party recovery service.
• Treat non-disclosure as a supply risk, not just a compliance gap. A supplier who will not answer the nitrite question is a supplier whose material you may have to stop using at short notice if a limit changes. That belongs on the supplier risk register with a real rating, visible to procurement, not filed in a quality folder.
• Use dual sourcing as leverage where it exists. An organization with a qualified second source has a genuine alternative. One with a single source does not, and should price that dependency accordingly when the next sourcing decision comes up.
• Escalate through the regulator where the assessment cannot be closed. Where a marketing authorization holder has made documented, repeated, good-faith attempts and the supplier still refuses, that record is itself part of the evidence. Regulators have seen the pattern. What they will not accept is silence.

The Traceability Test: Can You Answer in Days?

Here is the test that separates organizations with a working capability from organizations with a folder of completed documents. A new acceptable intake is published for a nitrosamine you have not previously assessed, or an existing limit is revised downward. How long does it take you to produce a defensible list of affected products?

This is not hypothetical. EMA revised Appendix 1 in March 2026 and again in June 2026.¹¹³ FDA’s list has grown steadily.⁶ Health Canada updated its limits during 2025.¹¹ Each event triggers the same question in every affected company on the same day. The answer arrives at very different speeds depending on how the assessments were stored.

Why documents fail this test

A nitrosamine risk evaluation written as a document is a narrative. It says, in prose, that the route uses reagent X, that no nitrosating agent is present, that the theoretical impurity Y was considered and ruled out on structural grounds, and that no testing was therefore required. Every one of those statements is a fact that could be a field. As prose, it is unsearchable in any reliable way.

Full-text search across a document repository does not solve this. Search for a nitrosamine name and you will find the documents that happen to spell it the way you spelled it, miss the ones that used a different naming convention or a CAS number, and return nothing at all for the assessments that ruled the impurity out implicitly by describing the route. Recall is poor and precision is worse, and neither is measurable, which means you cannot tell an inspector how confident you are that the list is complete.

What structured capture makes possible

That fourth query deserves emphasis because it is the one organizations most often miss. When an acceptable intake is revised downward, the immediate technical problem is often not that the product exceeds the new limit. It is that the validated method cannot quantify at the new limit, so you cannot demonstrate compliance either way. Finding that out three weeks into an impact assessment, rather than on day one, wastes the part of the response window that matters most.

Structured Capture: A Practical Data Model

Structured capture does not require a new platform. Most organizations already own something that can hold this: a quality management system with configurable records, a regulatory information management system, a product lifecycle management tool, or in smaller portfolios a properly governed database. What matters is the model, not the vendor.

The core entities

Four entities carry most of the value. Keeping them separate is what makes the impact queries work.

• Product configuration. The combination that a single assessment conclusion applies to: product, strength, formulation, active substance source and site, packaging configuration, and market. This is the record that gets a status. Getting this granularity right is the single most important design decision, because too coarse a record forces reassessment of things that did not change, and too fine a record creates an unmanageable population.
• Substance of concern. Each nitrosamine considered, identified by name and CAS number where one exists, with its structural category, the applicable acceptable intake per market, and the publication date of that limit. This entity is maintained centrally and refreshed against the external lists.
• Evidence item. Each piece of supporting information: a supplier attestation, a completed template, a test result, a method validation, a stability study, an extractable and leachable report. Each carries a date, a source, and an expiry or review condition. Documents attach here rather than being the record itself.
• Assessment conclusion. The link between a product configuration and a substance of concern: the outcome, the reasoning code, the evidence items relied upon, the limit assessed against, the measured or predicted level, the margin, the responsible owner, and the reassessment trigger conditions.

The fields that earn their keep

Not every attribute justifies the effort of maintaining it. The following ones consistently do, because each one answers a question that otherwise requires reading a document:

Keep the documents, but stop relying on them

None of this replaces the assessment report. Regulators expect a readable evaluation with reasoning, and a table of fields is not that. The point is that the report should be generated from the record rather than being the record. When the underlying facts are fields, the document can be regenerated on demand and will always match the current state. When the document is the master, every update is a manual rewrite and the versions drift.

This is the same argument that applies to any regulated content that has to stay current across a portfolio, and the same argument that underpins structured authoring in regulatory submissions more broadly. Nitrosamine assessments are simply a case where the recurring update frequency makes the document-as-master approach fail visibly and soon.

The Lifecycle Model: Triggers, Ownership, Change Control

A register that nobody is required to update decays quietly. The final piece is the operating model: what causes a reassessment, who is accountable, and how the obligation is wired into processes people already follow.

The trigger set

Reassessment triggers fall into two groups. External triggers arrive from regulators and the scientific literature. Internal triggers arrive from your own change processes and your suppliers. Both need a named route into the register.

Wire it into change control, do not build a parallel process

The single highest-value change most organizations can make is small: add a mandatory nitrosamine impact question to the change control form, with defined routing. Any change touching an active substance source, route, reagent, solvent recovery, excipient, packaging component, or process parameter that affects moisture, pH, or temperature should require an explicit answer and, where the answer is yes, should link to the affected assessment records.

This works because change control is a process people already complete and auditors already examine. A separate nitrosamine review process competes for attention and loses. An embedded question does not. The same logic applies to supplier change notifications: the notification should land in the change control system with the nitrosamine question attached, not in an inbox.

Quality risk management under ICH Q9(R1) provides the framework for deciding how much reassessment a given trigger warrants, and EDQM points explicitly to Q9 principles for the CEP-side risk assessment.²² Not every change needs a full reassessment. What every change needs is a documented decision about whether it does.

Ownership that survives reorganization

Nitrosamine work sits awkwardly across functions. Toxicology sets the limits. Analytical development builds the methods. Regulatory affairs holds the filing obligation. Quality holds the change control process. Supply chain holds the supplier relationship. Manufacturing science holds the process knowledge. When ownership is described as shared, it usually means nobody is accountable for the register being current.

The arrangement that works assigns three distinct roles clearly:

• A single accountable owner for the register itself, normally in quality or regulatory CMC, responsible for its completeness and currency and for reporting portfolio status to leadership. This is a named person, not a committee.
• A named owner per assessment record, normally the product’s regulatory or technical lead, responsible for the conclusion and the evidence behind it.
• A monitoring function for external triggers, responsible for watching the limit tables and guidance sources and raising a formal impact assessment when they move. This can be a small part of a regulatory intelligence role, but it has to be someone’s explicit duty with a defined checking frequency, not something that depends on a colleague noticing a news item.

Getting From Documents to a Register

Organizations reading this with several hundred existing assessment documents reasonably ask whether the conversion effort is justified. It usually is, but not as a full retrospective data entry exercise. The sequence that works is narrower and faster.

Done this way, the work is measured in weeks for a mid-size portfolio, not quarters, because it is deliberately not trying to restructure the assessment reports. It is extracting the facts that have to be queryable and leaving the narrative where it is.

Conclusion

The nitrosamine story is often told as a scientific one: a class of impurities nobody was looking for, a set of analytical methods that had to be built quickly, and a toxicological framework assembled in real time to set limits that could be applied at scale. All of that is true, and the CPCA in particular is a genuine achievement given how fast it had to be produced. But the science has largely stabilized. The limits are being published, the methods exist, and ICH is working toward harmonization with a Step 2 target in 2028.¹² What has not stabilized is the operational demand this places on a marketing authorization holder, because that demand is permanent and it is external in origin. Limits will keep being added and revised. Suppliers will keep changing routes. Each event asks the same question of the same portfolio, and asks it on a timeline the company does not set.

Organizations that treat this as a chemistry obligation will keep re-running impact assessments as manual document reviews, and will keep discovering their gaps late. Organizations that treat it as a data management obligation, with structured assessment records, honest gap marking, a supplier information strategy that anticipates refusal, and a reassessment trigger wired into change control rather than running beside it, will answer the question in days and spend their scientific effort on the products that actually need it. The difference is not sophistication. It is a decision about whether the assessments are documents or data.

Sakara Digital works with pharma and biotech organizations building the data foundations that make recurring regulatory obligations manageable rather than repeatedly disruptive. If you are looking at a portfolio of nitrosamine assessments and are not confident how quickly you could answer the next limit change, we are happy to have that conversation.

For Further Reading