Nitrosamine Risk Assessment for APIs: What Buyers Should Ask

There is a sentence that almost never appears in a supplier's answer to a nitrosamine questionnaire, and it is the sentence the whole answer should start with: ursodeoxycholic acid cannot form a nitrosamine drug substance-related impurity. Not "is unlikely to". There is no nitrogen in the molecule to nitrosate.

UDCA is a C24 steroid carboxylic acid carrying two hydroxyl groups on a 5β-cholan-24-oic acid skeleton. An NDSRI, the class of nitrosamine that caused most of the recent regulatory activity, forms when a secondary or tertiary amine inside the drug molecule reacts with a nitrite source. A bile acid has no amine nitrogen anywhere in its structure. Neither does chenodeoxycholic acid, lithocholic acid, 7-ketolithocholic acid or dried pig bile powder. The same is true of the conjugated forms.

So the question a buyer should be asking is not "did you test for nitrosamines". It is "where could a nitrosamine come from, given that it cannot come from the molecule". That is a narrower and far more answerable question, and it is the one this page is about.

The two classes, and only one of them applies here

Regulators split the problem in two, and the distinction decides everything downstream. Small-molecule nitrosamines are ordinary nitrosamines such as NDMA and NDEA that bear no structural relationship to the drug they were found in. NDSRIs share the drug's structure and are, in practice, unique to each active substance.

I would rather make that argument explicitly than send a certificate with "not detected" on it and hope nobody asks why. A negative result is evidence about the batches tested. The structural argument is evidence about every batch, and it is the part a reviewing authority can actually follow.

The numbers you will be asked about

Buyers often arrive with a number half-remembered, usually 18 ng/day, and sometimes a limit from a specific product's recall. Here is what the published figures actually are.

Two things about this table are worth saying plainly. First, these are acceptable intakes, not specification limits for a raw material. They are converted into a concentration only by reference to a dose, and if nobody tells you the dose, the ppm figure is not defined. A supplier who quotes "0.03 ppm" without asking about the finished dose is quoting a number that may not apply. Second, the limit of quantitation matters as much as the limit. A method that cannot see below 0.03 ppm cannot demonstrate compliance with a 0.03 ppm ceiling, whatever the certificate says.

The 2024 revision of the FDA guidance also introduced a carcinogenic potency categorisation approach, which moved a number of compounds off the flat default and onto compound-specific values. Recommended limits have changed since the first wave of recalls, so a figure quoted from a 2019 slide deck should be treated as history rather than as a limit.

Where the nitrogen actually comes from

If the molecule is clean, the risk is entirely a question of what else is in the room. Four sources are worth walking through, in the order I would ask about them.

Amine-bearing reagents and solvents

This is the first question, and it is the one that separates a real assessment from a template. Does the route use secondary or tertiary amines anywhere, or any amide solvent? Amide solvents deserve particular attention because they are capable of generating a nitrosamine in the presence of a nitrite source. A route that uses a tertiary amide as the reaction medium has a pathway that a route using an alcohol does not, and that difference should be visible in the assessment rather than glossed over. Our note on what the synthesis route tells you about impurities covers the same logic from the solvent side.

Nitrite sources

Nitrosation needs nitrite, and nitrite has to get in from somewhere. Nitrous acid and nitrite salts used as reagents are the obvious route. Less obvious are water quality, cleaning residues, and recycled solvent. Where a process recycles solvent, ask how the recycled stream is controlled, because a small amine load can concentrate across cycles.

Shared equipment and packaging

Multi-product equipment is a genuine vector: a nitrosamine formed in an unrelated product can deposit and carry over. This is a cleaning validation question, not a chemistry question, and it belongs in the assessment. Packaging is the same story in the other direction, since nitrite is present in some materials and has been implicated in nitrosamine formation in finished products.

External origin of the starting material

Bile-derived starting materials pass through several hands before they reach a reactor, and each transfer is a chance for cross-contamination. This is one reason the origin paperwork matters for more than TSE purposes.

What a structural assessment looks like

A document I would accept answers five things in order, and none of them is a test result.

1. The structure argument. Confirmation that the API molecule contains no secondary or tertiary amine, with the structure or the molecular formula shown rather than asserted.
2. The route inventory. A list of every reagent and solvent in the process, flagged for whether it is an amine, an amide, or a potential nitrite source.
3. The equipment and packaging assessment. Whether the equipment is dedicated, and what the cleaning validation says about carry-over of nitrogen-bearing residues.
4. The supplier chain. Where the starting material comes from and how cross-contamination at that stage is controlled.
5. The conclusion, and its limits. Either "the risk is negligible and here is why", or "testing is warranted, here is the method and here is the result". Both are acceptable answers. A conclusion with no stated basis is not.

The same logic applies to elemental impurities

If this pattern feels familiar, it should. The elemental impurities assessment works the same way: the regulator stopped asking for a test result and started asking for a reasoned assessment of what could plausibly be present. Our write-up on the elemental impurities risk assessment sets out the same structure for a different family of contaminants. Read together, the two make a case that a bile acid's contaminant profile is largely a statement about its process, which is exactly why the question is worth asking a supplier directly.

Five questions before you accept a template

1. Is there any secondary amine, tertiary amine or amide solvent in the route? Name them.
2. What in the process could introduce nitrite, including water and recycled solvent?
3. Is the equipment dedicated to bile acids, and what does the cleaning validation demonstrate?
4. Does the assessment conclude that testing is unnecessary, and on what structural basis?
5. If a nitrosamine were present, what is the limit of quantitation of the method that would find it?

The last one is the honest test of whether an assessment has been thought through. A company that has genuinely examined its own process usually has an opinion about the method; a company that has filled in a form usually has the form and nothing else.

Frequently asked questions

Can ursodeoxycholic acid form an NDSRI?

No. An NDSRI requires an amine nitrogen within the drug molecule, and the bile acid skeleton contains none. The nitrosamine risk on a bile acid API is limited to small-molecule nitrosamines arriving from reagents, solvents, water, equipment or packaging.

What is the acceptable intake limit for nitrosamines in an API?

Where no substance-specific data exist, a default of 18 ng/day applies, derived from the Lhasa carcinogenic potency database. FDA has published compound-specific recommended limits for several nitrosamines, ranging from 26.5 ng/day for the most potent to higher values for others.

What does 0.03 ppm mean in a nitrosamine limit?

It is the concentration equivalent of the 26.5 ng/day total limit for a product with a maximum daily dose below 880 mg. Because it depends on the dose, the ppm figure has no meaning unless the dose is stated.

Is a "not detected" result enough?

No. A result describes the batches tested and the method's limit of quantitation. It says nothing about the batches you have not received, which is why a structural and process-based assessment is the document regulators expect.

Which guidance should a supplier's assessment follow?

The FDA guidance (September 2024 final version) and ICH M7(R2) together set out the framework: classify the impurity, assess the risk, test where the risk warrants it, and define controls. EMA publishes parallel questions and answers for the European market.

Does a negative assessment remove the need for a specification limit?

Not automatically. A negative assessment is a conclusion about risk, and whether it has to be backed by a routine test is a decision for the dossier holder. It is normal for the assessment to conclude that no routine control is needed while the testing data sits in the dossier as supporting evidence.

The question that separates an argument from a form

Ask the supplier to show you the structure with the nitrogen-bearing positions marked. If the answer is a certificate with "not detected", you have been given a form. If the answer is a route map with the amide solvent highlighted and a cleaning validation reference, you have been given an assessment.

The primary texts behind this piece are the FDA guidance on control of nitrosamine impurities, the FDA recommended acceptable intake limits, and ICH M7(R2). Recommended limits have been revised more than once; check the current table before quoting any figure.

Where the regulatory document set for a given market is covered in our guide to CEP, DMF and written confirmation. What we ship against is on the ursodeoxycholic acid page, and specification questions for a specific quantity can be raised through a quotation request.

This article describes contaminant control and regulatory frameworks for quality, regulatory and procurement professionals. It states no therapeutic use, dose or indication for any substance, and no order quantity or lead time. Confirm all limits and guidance references against the current published versions.