Nitrosamines

In July 2018, valsartan API from Zhejiang Huahai Pharmaceutical was found to contain N-nitrosodimethylamine (NDMA), a probable human carcinogen, at levels well above any safe threshold. Investigation traced the impurity to a 2012 change in synthetic route that introduced tetrazole-forming conditions in the presence of nitrite. The recall expanded across the sartan class (irbesartan, losartan, olmesartan), then to ranitidine (NDMA in the molecule itself under typical storage), metformin (high-volume Type 2 diabetes drug, NDMA detected at levels exceeding the AI), and a long list of other products. The episode forced a wholesale rethink of impurity-control philosophy across pharma.

EMA Article 5(3) procedure (2019) and FDA's February 2021 guidance (with September 2024 revision) require every Marketing Authorisation Holder (MAH) to perform three steps for every chemical drug product:

1. Step 1 — Risk assessment (deadline: 31 March 2021 for chemical APIs in EMA; 31 March 2021 for FDA chemical products). Assess each API + finished product against the known sources of N-nitrosamines (vulnerable APIs, manufacturing processes, materials, packaging, drug-substance impurities — NDSRIs).
2. Step 2 — Confirmatory testing where risk is identified (deadline: 26 September 2022 originally for EMA, extended for NDSRIs). Validated LC-MS/MS or GC-MS/MS methods at the low ppb / ppt level.
3. Step 3 — Risk-mitigation / control (variations and labelling changes as needed). Where exposure exceeds the AI, the product must be re-engineered, re-supplied or removed from market.

Acceptable Intakes (AIs) are calculated using the ICH M7 framework — TD50 from carcinogenicity bioassay divided by 50,000 (the standard 1-in-100,000 lifetime cancer-risk margin), or the threshold of toxicological concern (1.5 µg/day for non-cohort genotoxins) when no specific data exist. The FDA published recommended AIs for NDMA (96 ng/day), NDEA (26.5 ng/day), NMBA (96 ng/day), NMPA (26.5 ng/day), NIPEA (26.5 ng/day) and NDIPA (26.5 ng/day). NDSRI AIs (where the nitrosamine retains the API's structural fragment) are published in tranches as the agency works through them.

• Source 1 — API synthesis. Secondary or tertiary amines + a nitrosating agent (nitrite, nitrous acid, nitrogen oxides, certain catalysts) under acidic conditions form nitrosamines. The classic sartan failure mode (tetrazole-forming step + recovered DMF solvent + acidic conditions = NDMA). Process risk assessment should be element-by-element for every step.
• Source 2 — Cross-contamination from previous products on shared equipment. Especially relevant in multi-product API plants and CMOs.
• Source 3 — Raw materials / starting materials carrying nitrosamines or precursors. Recovered solvents (DMF, DMA, NMP), nitrite-containing salts, amine reagents.
• Source 4 — NDSRIs (Nitrosamine Drug Substance-Related Impurities) — formed in the finished drug product from secondary-amine-containing APIs reacting with trace nitrite from excipients (typically <1 ppm in many common excipients) under typical formulation/storage conditions. The hardest source to engineer out, because nitrite is everywhere at trace levels.

When risk is confirmed, the available controls form a hierarchy:

1. Eliminate the precursor — change the synthetic route to avoid the nitrosating step, use a non-nitrite-bearing reagent, change the solvent (avoid recovered DMF in nitrite-containing process). The strongest control, requires variation.
2. Process change to suppress formation — add nitrite scavenger (ascorbic acid, gallic acid, vitamin E), lower the temperature, shorten the hold time at risk, change pH, add a downstream purification step.
3. Excipient change — switch to a low-nitrite excipient grade (when justified for the formulation), control nitrite spec on the excipient at the supplier level, change excipient supplier.
4. Drug-substance specification — set a nitrosamine impurity limit at the API level (with associated method validation, OOS workflow, change-control discipline).
5. Finished-product testing per batch — least efficient (testing in is harder than designing in) but sometimes the only option for legacy products under transition.
6. Withdraw from market — when re-engineering is infeasible and the AI cannot be met, products have been (and continue to be) recalled.

1. Risk assessment treated as a one-off — not re-opened when the API supplier, excipient grade or finished-product formulation changes.
2. Step 2 (confirmatory testing) delayed past the deadline without a documented justification — a frequent EMA variation finding.
3. Test method validated for one matrix (API) but applied to a different matrix (finished tablet) without re-validation — sensitivity collapses.
4. AI calculated against the wrong daily dose — the AI is the absolute µg/day, not a percentage of the spec.
5. NDSRI not even considered for secondary-amine APIs — only the named nitrosamines (NDMA, NDEA) tested.
6. Excipient nitrite content not characterised — supplier hasn't been asked, and the formulator's risk assessment assumes nitrite-free.
7. Cross-contamination risk from shared API equipment not assessed — the equipment-history file shows a nitrite-process campaign immediately before the at-risk product.

• Nitrosamine-risk-assessment register per product holds the four-source assessment, the assumptions, the supporting data and the current status (initial / under confirmatory testing / mitigated / recalled). The register is a controlled record under change control, not a Word file.
• Change-control workflow auto-routes API-source changes, synthetic-route changes, excipient-grade changes, formulation changes and equipment-history events (previous campaigns on shared API equipment) to the nitrosamine assessment owner.
• LC-MS/MS or GC-MS/MS test data integrate with LIMS as critical release attributes; the method is held as a validated Q2(R2) procedure with documented sensitivity to the low-ppb level.
• AI tracking — the platform holds the regulatory AI per nitrosamine and product, and computes the percent-of-AI for every batch's measured (or estimated) content. Drift toward the AI is visible before exceedance.
• Recall-readiness — if a batch exceeds the AI, the platform's recall workflow uses the genealogy and shipping data to identify all affected lots and downstream consignees within minutes, not days.
• Supplier portal includes a nitrite spec on excipient CoAs where required — the data lives on the same record the formulator's risk assessment cites.