Challenge

A generic pharmaceutical manufacturer producing a widely prescribed secondary-amine-containing oral drug product was required to complete a Nitrosamine Drug Substance-Related Impurity (NDSRI) risk assessment ahead of FDA's enforcement deadline and EMA's Article 5(3) step-3 conclusion. Internal confirmatory testing had detected trace quantities of a novel NDSRI for which no published Acceptable Intake (AI) limit existed in regulatory databases.

With a compliance deadline only 8 weeks away, the sponsor needed either (a) a defensible compound-specific AI derived from carcinogenicity data, or (b) a regulator-ready justification using FDA's Carcinogenic Potency Categorization Approach (CPCA) — and the structural analysis to support either path. Missing the deadline would trigger distribution holds, product recalls, and potential loss of market share to competitors with already-compliant formulations.

The sponsor engaged Chemva to deliver a complete NDSRI risk assessment package combining CPCA classification, dual-platform (Q)SAR evaluation, and read-across AI derivation — three parallel paths that would give FDA and EMA reviewers multiple lines of defensible evidence and maximize formulation flexibility.

The NDSRI Regulatory Landscape in 2026

The nitrosamine file has evolved rapidly since the 2018 sartans (valsartan/losartan/irbesartan) recalls first exposed systemic gaps in active pharmaceutical ingredient (API) impurity control. The key 2026 regulatory anchors for NDSRI risk assessment are summarized below, and sponsors submitting globally should build their AI justification to satisfy all three simultaneously.

FDA's Carcinogenic Potency Categorization Approach (CPCA)

Published in FDA's 2023 CPCA guidance and refined through subsequent updates, the CPCA assigns NDSRIs to five Acceptable Intake categories (18 ng/day, 100 ng/day, 400 ng/day, 1,500 ng/day, or compound-specific) based on structural activating and deactivating features, α-hydrogen count, and neighboring group effects. CPCA provides a rapid, defensible starting point when no compound-specific carcinogenicity data exists.

EMA Article 5(3) Framework

The European Medicines Agency's Article 5(3) procedure established the three-step evaluation (presence → confirmation → AI derivation) now required across all marketing authorization holders in the EEA. Step 3 AI derivation must use either a compound-specific carcinogenicity-derived AI or a class-based default (Threshold of Toxicological Concern of 18 ng/day or the higher ICH M7 class-specific limit, where applicable).

ICH M7(R1) Mutagenicity Assessment

All NDSRI assessments rely on ICH M7(R1)-aligned (Q)SAR evaluation — two complementary systems, one expert rule-based and one statistical/machine-learning, followed by expert toxicological review to resolve any conflicting calls. An NDSRI classified to ICH M7 Class 5 (no structural alerts) can often be released from the CPCA framework entirely.

Health Canada and Global Harmonization

Health Canada has aligned its NDSRI expectations with ICH M7(R1) and accepts both CPCA-derived and read-across AIs where the underlying rationale is documented. In 2024–2026, Health Canada, Swissmedic, MHRA, and PMDA have each adopted variations of the CPCA framework, creating a de-facto global consensus that reviewers expect a tiered approach — CPCA baseline plus compound-specific refinement where commercially justified. For sponsors pursuing parallel submissions across multiple jurisdictions, building one unified NDSRI risk assessment dossier usable across all five authorities is significantly more efficient than producing region-specific packages.

Chemva's Solution

Chemva executed a tiered NDSRI risk assessment using current FDA, EMA, and Health Canada methodology, delivered as four integrated work packages running partly in parallel to meet the 8-week deadline.

1. Structural Characterization & CPCA Classification

Chemva's computational toxicology team assigned the NDSRI to a CPCA potency category using FDA's 2023 methodology as updated in subsequent Q&A releases. The assessment integrated three inputs: activating/deactivating feature count, α-hydrogen availability, and neighboring-group electronic effects. The NDSRI was placed in CPCA Category 4 (AI = 1,500 ng/day), providing a conservative default permitting most dosing scenarios without reformulation.

A rapid-turnaround CPCA report was delivered within 10 business days — giving the sponsor an immediate compliance fallback while the more favorable read-across AI was developed in parallel.

2. Dual-Platform (Q)SAR Mutagenicity Assessment

Chemva ran the parent NDSRI through two ICH M7-compliant (Q)SAR systems — one expert rule-based model and one statistical machine-learning model. Both systems returned structural alerts consistent with the nitroso parent, but with differing calls on the N-alkyl substitution's impact on mutagenic potency, reflecting the known difficulty of (Q)SAR systems with N-nitroso secondary amines.

Chemva's toxicologists resolved the conflict using compound-specific expert rule-based evaluation — functional group reactivity, structural analogs with known genotoxicity data, and the compound's predicted in-vivo metabolism — ultimately classifying the NDSRI to ICH M7 Class 2 (known mutagen with no published carcinogenicity data) pending read-across derivation.

3. Read-Across AI Derivation (Parallel Path)

In parallel with the CPCA pathway, Chemva identified three structurally analogous nitrosamines with published carcinogenicity dose-response data (TD50 values) in authoritative databases. Each analog was scored for structural similarity using Tanimoto indices and for metabolic equivalence using expert judgment on the position of the nitroso group, substitution pattern, and predicted activation pathway.

A weighted read-across TD50 was derived using the three analogs, and the corresponding AI was calculated using the standard TD50 × BW(50 kg) / LTD(25,550 days) formulation. The resulting read-across-derived AI was 7,200 ng/day — more than four times the default CPCA Category 4 value — giving the sponsor substantially broader formulation flexibility and allowing continued commercialization at the existing dose strengths.

4. Regulatory Submission Package

Chemva prepared a complete FDA/EMA submission package containing: (a) the CPCA-based AI justification as a fallback position, (b) the read-across-derived AI with full analog-selection rationale, Tanimoto similarity scoring, and TD50 documentation as the preferred position, and (c) a reviewer-facing narrative explaining the preferred approach and the regulatory basis for accepting it.

The package was formatted for direct transfer into Module 3.2.S.3.2 (Impurities) for FDA and into the Article 5(3) step-3 response template for EMA. A parallel Health Canada and MHRA annex was included to preempt follow-up requests from those authorities. The package was submitted through the sponsor's regulatory affairs function three weeks ahead of the 8-week compliance deadline, and a short executive briefing was prepared for the sponsor's internal stakeholders (Quality, Regulatory, Commercial) explaining the read-across rationale in business terms.

Impact Delivered

• Chemva delivered the complete NDSRI risk assessment package 3 weeks ahead of the FDA/EMA compliance deadline.
• The read-across-derived AI was accepted by both EMA and FDA reviewers on first-pass review, allowing the sponsor to avoid reformulation and retain their existing manufacturing supply chain.
• Estimated cost avoidance of ~$2.5M in reformulation, analytical method revalidation, and market supply disruption.
• The CPCA-plus-read-across dual-path methodology Chemva developed has been adopted as the sponsor's standard NDSRI playbook for three follow-on drug product assessments.

Key Takeaways

NDSRI risk assessments in 2026 are no longer a single-method exercise. A defensible submission typically includes at minimum a CPCA category assignment as a baseline, a dual-platform (Q)SAR mutagenicity assessment, and — where reformulation would be commercially damaging — a parallel read-across AI derivation to secure a more permissive compound-specific limit.

The commercial stakes are significant: for widely prescribed generics, the difference between the CPCA default AI and a read-across-derived AI can determine whether a product remains on-market at full dose strength, requires partial reformulation, or faces supply disruption. Sponsors should not approach NDSRI assessments as a pure compliance exercise — the technical approach chosen directly determines market access. Chemva's integrated toxicology risk assessment practice is built around this combined commercial-plus-regulatory lens.