Nitrosamine Impurity Risk Assessment: The 2026 Guide for Pharma Compliance Teams

On July 13, 2018, the FDA recalled valsartan after the probable carcinogen NDMA was found in active ingredient from China’s Zhejiang Huahai Pharmaceutical. That contamination turned nitrosamine impurity risk assessment into a global regulatory mandate. By February 2023, more than 18 million bottles of blood-pressure drugs had been pulled from US shelves.

That single contamination opened a seven-year compliance scramble. A nitrosamine impurity risk assessment is now mandatory for every marketed human drug, and the FDA’s 251-compound NDSRI list, its CPCA potency scheme, and an August 1, 2025 deadline have raised the bar sharply.

Nitrosamine Impurity Risk Assessment: Key Takeaways
A nitrosamine impurity risk assessment follows the FDA’s three steps: assess every API and finished product for nitrosamine potential, run confirmatory testing where risk is flagged, then report changes and mitigate.
The FDA’s Carcinogenic Potency Categorization Approach (CPCA) sets acceptable intake limits of 26.5, 100, 400 or 1,500 ng/day. NDMA is capped at 96 ng/day and NDEA at 26.5 ng/day, with 26.5 ng/day the default when no compound-specific limit exists.
NDSRIs (nitrosamines formed when a drug’s own secondary amine reacts with trace nitrite in excipients) are the hardest class and the focus of the August 1, 2025 testing and evaluation deadline.
Root causes span contaminated raw materials, recovered solvents reused across the wrong step, nitrite in excipients, process water, and nitrocellulose packaging.
The valsartan, ranitidine (Zantac) and metformin recalls show the stakes; GSK alone settled Zantac claims for up to $2.2 billion in 2024.
A June 23, 2025 FDA revision lets firms that cannot finish mitigation submit a progress report instead of missing the deadline outright. That is relief, not a reprieve.

This guide sets out what a nitrosamine impurity risk assessment must cover in 2026: the three-step FDA process, acceptable intake limits by category, the root causes to screen, the analytical and Ames-test evidence regulators expect, and a readiness checklist you can act on.

Why Nitrosamine Impurity Risk Assessment Became a Board-Level Issue

The valsartan recall was the first domino, not the last. NDEA and NMBA soon turned up in other angiotensin-receptor blockers, and the contamination traced back to a single API change at one supplier, a textbook third-party risk failure with global reach.

Ranitidine followed. In April 2020 the FDA requested removal of all Zantac and generic ranitidine after NDMA was shown to grow in the molecule over time. The litigation that followed turned a quality defect into a balance-sheet event.

Figure 1. The financial stakes behind every nitrosamine impurity risk assessment: 2024 Zantac (ranitidine) settlements.

In 2024 the manufacturers settled. GSK agreed to pay up to $2.2 billion, Pfizer roughly $250 million, and Sanofi about $100 million to resolve Zantac claims. Numbers like these are why nitrosamines now sit on enterprise risk registers, not just lab logs.

Metformin made the threat feel routine. In June 2020 the FDA asked five manufacturers to recall extended-release lots for NDMA. Three of the most-prescribed drug classes in America were hit inside two years.

Drug (year)	Nitrosamine	FDA action	Scale
Valsartan & other ARBs (2018-19)	NDMA, NDEA, NMBA	Recalls; import alerts on supplier	18M+ bottles
Ranitidine / Zantac (2019-20)	NDMA	Market removal of all products	Entire category
Metformin ER (2020)	NDMA	Recalls by five manufacturers	80+ lots
NDSRIs (2023-present)	Drug-specific	Risk re-assessment; AI limits set	251 compounds listed

What a Nitrosamine Impurity Risk Assessment Actually Evaluates

Beyond the headlines sits chemistry. A nitrosamine impurity risk assessment asks one core question: can a nitrosating agent and an amine meet anywhere across the product’s life, from synthesis to shelf?

Nitrosamines form when secondary, tertiary or quaternary amines react with nitrite under acidic conditions. The amine can live in the active ingredient, an intermediate, a degradant, or a vendor-sourced reagent, which is why supply chain risk assessment runs through the whole exercise.

Two families matter. Small-molecule nitrosamines such as NDMA and NDEA are simple, well-studied contaminants, while NDSRIs are larger molecules built from the drug’s own structure. The second family is where most 2023-onward work concentrates.

Figure 2. The scale a modern nitrosamine impurity risk assessment is built to prevent.

These were not edge cases. A peer-reviewed analysis of the FDA recall database counted more than 1,400 product lots withdrawn over nitrosamines, and FDA’s published NDSRI list now carries 251 compounds with assigned limits.

NDSRIs: The Hardest Class in a Nitrosamine Impurity Risk Assessment

NDSRIs form in the finished product, not the synthesis route. A secondary amine on the drug molecule reacts with nitrite present at roughly one part per million in everyday excipients, so even a clean API can fail late.

This is what makes NDSRIs the center of any current nitrosamine impurity risk assessment. They often have no toxicology data, forcing teams to set limits by structure-based prediction rather than direct study, as the EMA’s guidance for marketing authorisation holders lays out.

The Three-Step Nitrosamine Impurity Risk Assessment Process

Regulators converged on a common shape. The FDA’s Control of Nitrosamine Impurities guidance defines three sequential steps, and the EMA call to review mirrors them for the EU.

Step	What the nitrosamine impurity risk assessment requires	Method or output
1. Risk assessment	Evaluate every API, marketed product, and pending application for whether nitrosamines could be present or form	Documented, signed risk assessment
2. Confirmatory testing	Test the products the assessment flags as at risk, using sensitive validated methods	LC-MS/MS or LC-HRMS data
3. Reporting & mitigation	Submit required changes to the FDA and implement controls to bring levels below the limit	DMF amendments, supplements, controls

 

Step one is a paper exercise done well or badly. Map the synthetic route, the excipients, the packaging, the water, and the suppliers, then score each pathway, the same discipline as any structured risk assessment methodology applied to a single failure mode.

Step two converts suspicion into numbers. Where the assessment flags credible risk, a validated, sensitive method confirms whether a nitrosamine is present and at what level, and a qualitative-to-quantitative handoff is exactly the move regulators expect.

Mapping the Nitrosamine Impurity Risk Assessment to FDA Deadlines

Figure 3. The regulatory timeline a nitrosamine impurity risk assessment now has to keep pace with.

Dates drive the program. Small-molecule confirmatory testing was due October 1, 2023; NDSRI risk re-assessment followed on November 1, 2023; and confirmatory testing plus mitigation submissions are due August 1, 2025.

There is one safety valve. A June 23, 2025 revision lets firms that cannot finish mitigation file an “NDSRI Update” progress report instead of missing the date, after which the FDA issues a revised target. Document the gap rather than hide it.

Acceptable Intake Limits in a Nitrosamine Impurity Risk Assessment

Every nitrosamine impurity risk assessment ends in a number: the acceptable intake, or AI, expressed in nanograms per day. Beat it and the product ships; miss it and the change must be reported and fixed.

For NDSRIs without their own data, the FDA built the Carcinogenic Potency Categorization Approach (CPCA). It scores structural features (alpha-hydrogens and activating or deactivating groups) and assigns each compound to a potency category with a matching limit.

Figure 4. The CPCA acceptable intake limits every NDSRI nitrosamine impurity risk assessment applies.

The CPCA tiers are 26.5, 100, 400 and 1,500 ng/day across five categories, the strictest reserved for the most potent structures. A category-one NDSRI must sit nearly sixty times lower than a category-four one.

Worked example: a tablet contains an NDSRI scored as category two. Its limit is 100 ng/day, so at a maximum daily dose of four tablets the method must reliably detect well below 25 ng per tablet, a sensitivity target that shapes the whole analytical plan.

Compound-Specific Limits Your Nitrosamine Impurity Risk Assessment Must Apply

Well-studied nitrosamines skip the categories and use their own limits. A nitrosamine impurity risk assessment should apply the compound-specific value whenever the FDA has published one, and fall back to 26.5 ng/day only when it has not.

Figure 5. Compound-specific limits a nitrosamine impurity risk assessment applies before any category default.

NDMA and NMBA carry a 96 ng/day limit; NDEA, NMPA, NIPEA and NDIPA sit at 26.5 ng/day. The Federal Register notice lists each value, and the 26.5 ng/day default applies to any nitrosamine the agency has not yet characterized.

Root Causes Every Nitrosamine Impurity Risk Assessment Must Screen

A credible nitrosamine impurity risk assessment is only as good as its source list. The FDA’s revised guidance names the recurring pathways, and missing one is how clean products fail audits.

Root cause	Where it enters	Primary control
Contaminated raw materials / APIs	Amine or nitrite impurities in vendor-sourced inputs	Supplier qualification, certificates of analysis, audits
Recovered solvents, reagents, catalysts	Residual amines carried when material is reused across steps	Reuse only in the step it was collected; purification controls
Nitrite in excipients (NDSRI route)	Trace nitrite (~1 ppm) meeting a secondary amine in the drug	Low-nitrite excipients, antioxidants, formulation pH
Tertiary amine degradation	De-alkylation and amide hydrolysis yielding secondary amines	Stability studies, packaging and formulation design
Process water	Nitrite or nitrosamines in water systems	Test water; switch to purified water where needed
Packaging and printing inks	Nitrocellulose lidding and inks contacting product	Material qualification and supplier specifications

 

Supplier inputs dominate the list, so vendor controls carry weight. Tight supplier qualification and disciplined vendor risk mitigation close the gap that started the valsartan crisis in the first place.

The reuse rule trips teams most often. The guidance is blunt: recovered solvents and catalysts may be reused only in the same step where they were collected, because cross-step reuse is how amine residues migrate into places no one screened.

Analytical Testing and the Ames Test in a Nitrosamine Impurity Risk Assessment

When the nitrosamine impurity risk assessment flags risk, evidence has to follow. Two evidence streams matter: analytical quantitation of how much is present, and toxicological data on how dangerous it is.

Approach	What it answers	Role in the assessment
LC-MS/MS and LC-HRMS	How much nitrosamine is present	Confirmatory testing and routine release control
Enhanced Ames Test (EAT)	Is the nitrosamine mutagenic	A negative result can justify a higher AI limit
(Q)SAR and read-across	Predicted hazard from structure or analogues	Initial hazard screening under ICH M7
CPCA categorization	Default limit when no data exist	Sets a conservative AI for novel NDSRIs

 

The Enhanced Ames Test is the pivot point. Both the FDA and EMA publish optimized conditions, and a clear negative result can move a compound off the conservative default and onto a higher, defensible limit.

Prediction comes first, though. ICH M7(R2) accepts (Q)SAR assessment of mutagenicity in place of early animal studies, and broader mutagenic-impurity control under M7 frames where nitrosamines fit among DNA-reactive impurities.

A Nitrosamine Impurity Risk Assessment Readiness Checklist

Strategy is worth little without execution. This checklist turns the nitrosamine impurity risk assessment into auditable tasks, each with an owner and an artifact a regulator can read.

#	Action	Evidence to retain
1	Inventory every API, product and application in scope	Scoping register with sign-off
2	Map amine, nitrite and reuse pathways per product	Route and formulation risk map
3	Qualify suppliers for amine and nitrite controls	Audit reports, certificates of analysis
4	Run confirmatory testing where risk is flagged	Validated LC-MS/MS or LC-HRMS results
5	Assign the AI limit (compound-specific, CPCA, or EAT)	Documented limit rationale
6	Submit changes or an NDSRI Update progress report	Regulatory submission record
7	Re-assess on change and on a fixed cadence	Dated review log and version history

 

Keep the evidence where auditors expect it. A live risk register linked to the testing data and a GMP risk assessment file makes the difference between a quick inspection and a costly one.

Treat the checklist as repeatable, not one-off. The cadence in our guide to how often risk assessments should run applies here: re-open the file on any route change, supplier change, or new toxicology signal.

Frequently Asked Questions About Nitrosamine Impurity Risk Assessment

What is a nitrosamine impurity risk assessment?

A nitrosamine impurity risk assessment is a documented evaluation of whether carcinogenic nitrosamines could be present in, or form within, a drug product. It follows the FDA’s three steps (assess, test, mitigate) and ends with each impurity held below its acceptable intake limit.

Who must perform a nitrosamine impurity risk assessment?

Every holder of an approved or pending human-drug application must complete one, along with API makers and finished-dose manufacturers. The duty flows down the supply chain, so a strong compliance risk assessment process is essential for contract partners too.

What acceptable intake limits apply in a nitrosamine impurity risk assessment?

The FDA’s CPCA sets limits of 26.5, 100, 400 or 1,500 ng/day for NDSRIs by potency category. Well-studied compounds use their own values (NDMA at 96 ng/day, NDEA at 26.5 ng/day), and 26.5 ng/day is the default.

What is an NDSRI in a nitrosamine impurity risk assessment?

An NDSRI is a nitrosamine drug-substance-related impurity, formed when the drug’s own secondary amine reacts with trace nitrite, usually from excipients. Because NDSRIs rarely have toxicology data, the assessment often sets their limits by CPCA or an Enhanced Ames Test.

What analytical methods support a nitrosamine impurity risk assessment?

Confirmatory testing relies on sensitive, validated methods, principally LC-MS/MS and LC-HRMS, capable of detecting nitrosamines at single-digit nanogram levels. Mutagenicity is addressed through (Q)SAR prediction under ICH M7 and the Enhanced Ames Test.

When is the nitrosamine impurity risk assessment deadline?

Confirmatory testing and risk evaluation for NDSRIs were due August 1, 2025. Firms unable to complete mitigation may instead file an NDSRI Update progress report under the FDA’s June 2025 revision, after which the agency sets a revised timeline.

How often should a nitrosamine impurity risk assessment be updated?

Re-open the assessment on any synthetic-route change, supplier change, formulation change, or new toxicology data, and review on a fixed periodic cadence. A dated version history shows inspectors exactly when and why each conclusion changed.

Where Nitrosamine Impurity Risk Assessments Go Wrong

Most failed assessments share a short list of mistakes. Each row below pairs the trap with the control that prevents it, drawn from the recall record and inspection findings.

Pitfall	Root cause	Fix
Screening the API but not the excipients	Treating NDSRIs as a synthesis problem only	Assess the finished formulation, not just the route
Trusting supplier paperwork at face value	Weak vendor qualification and no audits	Verify amine and nitrite controls on site
Using a generic limit of convenience	Skipping CPCA or compound-specific values	Document the AI rationale for each impurity
Methods too insensitive to see the limit	Detection above the AI threshold	Validate LC-MS/MS down to single-digit ng/day
A one-time assessment that never reopens	No change-triggered review	Re-assess on every route, supplier or data change
Hiding a missed deadline	Fear of a regulatory finding	File the NDSRI Update progress report instead

 

The first row causes the most pain. Teams steeped in process chemistry instinctively guard the synthetic route, then a late-forming NDSRI appears in a stable, well-made tablet and the internal audit finds it before the inspector does, if you are lucky.

The Nitrosamine Impurity Risk Assessment Horizon: 2026 and 2027

The science is still moving under the rules. A future ICH M7(R3) is expected to fold quantitative carcinogenic-potency categorization into the global standard, pushing CPCA-style logic beyond the United States.

Harmonization is the second trend. The EMA’s categorization approach already tracks the FDA’s, and convergence makes a single, well-built nitrosamine impurity risk assessment portable across both markets rather than two parallel exercises.

Expect prediction to carry more weight too. As (Q)SAR models and read-across libraries mature, more NDSRIs will earn defensible limits without bespoke animal studies, shifting effort from testing toward data integrity and model governance.

The durable lesson is structural. The firms that came through the recall wave fastest had treated nitrosamines as an enterprise risk with board visibility, not a lab curiosity. That posture is what 2026 rewards.

Strengthen Your Nitrosamine Impurity Risk Assessment

Risk Publishing helps US quality and risk teams turn regulatory pressure into defensible programs, from quality risk management to process-validation risk and foreign-material screening. Read about the practice, then contact us when your nitrosamine impurity risk assessment needs to stand up to an inspection.