Regulatory guides

Source-grounded practical guide

Nitrosamine risk assessment for EU submissions

How the three-step EU nitrosamine exercise is structured, what belongs in Module 3, and the gaps that most often send a risk evaluation back for rework.

Last reviewed 14 August 2026

The obligation, in plain terms

Since the sartan findings in 2018, EU authorities have treated N-nitrosamines as a cross-cutting quality problem rather than a series of individual product incidents. The Article 5(3) referral on nitrosamine impurities in human medicines set out an approach that applies to marketing authorisation holders across chemically synthesised and biological medicines, and the same expectations are applied to new applications.

The work is structured in three steps. Step 1 is a risk evaluation of every product in scope, documented and product-specific. Step 2 is confirmatory testing wherever step 1 identifies a risk. Step 3 is the regulatory action that follows — a variation, a change to the control strategy, or in some cases a supply decision.

Deadlines, reporting templates and the response route have all been revised more than once since the call for review was issued. Treat the current EMA nitrosamines page and the associated questions-and-answers document as the operative source, and record which revision you worked from. A risk evaluation that cites a superseded Q&A revision is one of the easier findings for an assessor to raise.

Scope: it is not only the synthesis route

The most familiar root cause is a nitrosatable amine meeting a nitrosating agent during synthesis of the active substance — a secondary or tertiary amine plus nitrite, often under acidic conditions. That is where most assessments start, and it is the part suppliers usually document well.

It is also the part that rarely fails in isolation. The recurring surprises come from elsewhere: recovered solvents, catalysts and reagents processed by a third party; nitrite present as an impurity in excipients or in purified water; degradation during storage; cross-contamination on shared equipment or in shared facilities; and nitrocellulose in primary or secondary packaging, which has been the source of a distinct class of contamination findings for finished products.

A defensible evaluation states which of these routes were considered and why each was included or excluded. "No nitrosating agent is used in the process" answers one question out of several.

  • Map every amine and every potential nitrosating agent across the route, including quenching and work-up steps.
  • Ask suppliers explicitly about recovered solvents, catalysts and reagents, and about the sites that process them.
  • Assess excipients, purified water and processing aids as potential nitrite sources.
  • Cover packaging components, printing inks and any nitrocellulose-containing material.
  • Document shared-equipment and shared-facility exposure, not only the dedicated line.
  • Consider degradation pathways under the approved storage conditions and shelf life.

Step 1: what a complete risk evaluation looks like

A risk evaluation is a per-product document, not a per-molecule one. Two products containing the same active substance can reach different conclusions because they use different suppliers, excipients, packaging or manufacturing sites. Reuse the science; do not reuse the conclusion without checking the facts behind it.

The evaluation should identify each potential nitrosamine by structure where possible, state the theoretical basis for its formation, and reach an explicit conclusion: risk identified, or risk not identified with a justification an assessor can follow. Where the conclusion rests on information from an active substance manufacturer, an ASMF holder or a CEP holder, the evaluation should say what was received, from whom, and on what date — a confirmation letter that predates a change in the route is not current evidence.

Keep the assessment inside the pharmaceutical quality system. It is not a one-off exercise: a change of active substance supplier, synthesis route, excipient grade or packaging component reopens it, and the obligation to keep it current continues after approval.

Step 2: confirmatory testing and the analytical trap

Where a risk is identified, confirmatory testing follows on a justified sampling plan — normally including worst-case batches, batches near the end of shelf life, and material from each site or supplier under assessment.

The most common technical failure at this stage is a method that cannot see the limit it is being used to defend. If the acceptable intake corresponds to a concentration below the method's limit of quantitation at the product's maximum daily dose, the result does not demonstrate compliance no matter how many batches are tested. Confirm that the method's sensitivity, specificity and recovery were established against the applicable limit and the actual matrix, and that validation covers the nitrosamine you are looking for rather than a structurally related one.

Where a result exceeds the applicable limit, the reporting expectations and timelines are set out in the current EMA guidance and national requirements. That is a notification obligation, not something to hold until the next planned variation.

  • State the maximum daily dose used to convert an intake limit into a concentration limit.
  • Show that the limit of quantitation sits below that concentration, in the real matrix.
  • Justify the batches selected, including end-of-shelf-life and worst-case material.
  • Validate for each specific nitrosamine being controlled.
  • Define what happens if a result exceeds the limit, before you run the test.

Setting the limit: AI, ICH M7 and the categorisation approach

Acceptable intakes for individual nitrosamines are published by EMA and revised as data emerge; they should be read from the current source rather than quoted from memory or from an internal SOP. Where a substance-specific limit exists, it governs.

Where one does not, the framework falls back on the principles in ICH M7(R2) for mutagenic impurities, and on the carcinogenic potency categorisation approach EMA adopted for N-nitrosamines without substance-specific carcinogenicity data. An enhanced Ames test result can change the classification, and there are defined expectations for how such a study is run and reported.

Two situations are easy to overlook. Where more than one nitrosamine is present, the total intake has to be addressed, not only each impurity against its own limit. And where treatment is genuinely short-term, less-than-lifetime considerations may apply — but that argument needs the posology to support it, and it should be presented as a justification rather than assumed.

Where it lands in the dossier

For a new application, the assessment is not a standalone annex — it is distributed across Module 3 and summarised in Module 2. Impurity discussion and the formation rationale sit with the active substance in 3.2.S.3.2, the control strategy in 3.2.S.4 and 3.2.P.5, and the development reasoning that justifies why routine testing is or is not required belongs in 3.2.P.2. The quality overall summary in 2.3 should reflect the same conclusion, in the same terms.

The frequent inconsistency here is a control strategy that contradicts the development section: a risk evaluation concluding that a nitrosamine is controlled upstream, alongside a specification that never mentions it and a development section that never explains the omission. Assessors read those sections together.

For an authorised product, changes arising from step 3 are handled as variations, and the applicable category depends on what actually changes — a new specification test, a revised limit, a new supplier, or a change in the manufacturing process. Classify from the change itself, using the current Classification Guideline.

  • 3.2.S.3.2 — nitrosamine identification and formation rationale.
  • 3.2.S.4 / 3.2.P.5 — specification, method and limit where routine control applies.
  • 3.2.P.2 — justification where routine control is not applied.
  • 2.3 — a summary that matches the Module 3 conclusion.
  • Module 1 — supplier confirmations and access arrangements, where required by the procedure.

What a completeness check can and cannot tell you

A structural check answers whether the pieces are present, internally consistent and traceable to a current source: is there a per-product evaluation, does it cover packaging and shared equipment, does the method's sensitivity match the limit, does the specification agree with the development justification, is the cited Q&A revision the current one.

It cannot tell you whether the scientific conclusion is right. Whether a particular formation pathway is plausible for your route, whether a supplier's data is trustworthy, and whether a limit is correctly derived are judgements for qualified regulatory and quality professionals with the full dossier in front of them. Use a completeness check to clear the mechanical failures early, so review time goes to the questions that actually need expertise.

Official sources

Not built yet

Module 3 checks are in development

RafiHive checks EU Module 1 today. Module 3 is what we are looking at next, and what gets built first depends on what actually costs you time. Which Module 3 section costs you the most time?

Live today: the EU eCTD Module 1 gap check runs from your submission context — with your dossier files, or from a declared inventory with no upload at all.

This guide supports research and preparation. Confirm current source versions and have a qualified regulatory professional review decisions before use.