EMA nitrosamines Appendix 1 Rev.12: new AI limits added March 2026 and what MAHs must do

EMA posted Appendix 1 Rev.12 (EMA/42189/2026) on March 13, 2026, adding new acceptable intake (AI) limits for several N-nitrosamines, including new drug substance-related impurities (NDSRIs) of rivaroxaban, furosemide, and dextromethorphan. The new entries are flagged in red in the tabular list. Marketing authorisation holders (MAHs) have three years from the date an AI limit is published to implement corrective or preventive action for affected products. If your product formulation contains any of the newly listed nitrosamines, the implementation clock started March 13, 2026.

What Appendix 1 is and why Rev.12 matters

Appendix 1 is the EMA-maintained list of compound-specific AI limits for individual N-nitrosamines. It sits alongside the Q&A document for MAHs (EMEA-H-A5(3)-1490) as the operational reference for nitrosamine risk control. It is compiled by the EMA Non-clinical Working Party (NcWP) and kept current by the Nitrosamine Implementation Oversight Group (NIOG), co-chaired by EMA and CMDh.

AI limits in Appendix 1 define the maximum daily exposure that keeps the theoretical additional lifetime cancer risk below 1 in 100,000, consistent with ICH M7(R2). When a specific nitrosamine has an entry in Appendix 1, that AI is the regulatory benchmark for batch release, stability, and specification setting in the EU.

Rev.12 (March 2026) is the twelfth revision since the initial publication. The NIOG updates Appendix 1 as new substance-specific data becomes available, meaning the limits you qualified against 12 months ago may no longer be the current EU benchmark.

What changed in Rev.12

The March 13, 2026 revision added or updated AI limits for several nitrosamines, with all changes marked in red in the published table. New AI limits were introduced for N-nitroso impurities of:

• Rivaroxaban (anticoagulant, widely marketed)
• Furosemide (loop diuretic, high-volume generic)
• Dextromethorphan (OTC antitussive)

Additional updates adjusted existing entries where new carcinogenicity data, surrogate studies, or revised Carcinogenic Potency Categorisation Approach (CPCA) assessments changed the recommended limit.

MAHs holding marketing authorisations for any affected product must compare their current product specification and batch release limits against the Rev.12 values, even if no change was made to the formulation, manufacturing process, or API supplier. The AI limit in Appendix 1 is the regulatory threshold, not the internally qualified limit from a prior filing.

How Appendix 1 limits are derived: ICH M7(R2) plus CPCA

Appendix 1 values are derived from two complementary frameworks.

ICH M7(R2) is the ICH guideline on assessment and control of DNA reactive (mutagenic) impurities in pharmaceuticals, updated to R2 in February 2023. It defines how to classify impurities, set compound-specific AI limits from carcinogenicity data, and apply the 1 in 100,000 lifetime risk principle.

CPCA (Carcinogenic Potency Categorisation Approach) is a structure-activity relationship approach that assigns a nitrosamine to one of five categories based on α-hydrogens at the N-nitroso center plus activating and deactivating structural features. CPCA is used when compound-specific carcinogenicity data is not available.

FDA uses a default of 26.5 ng/day when an AI limit cannot otherwise be determined (FDA CDER AI Limits list). The exact FDA framework is in the Recommended Acceptable Intake Limits for NDSRIs guidance.

The CPCA assignment is not a permanent label. When compound-specific data (in vivo transgenic rodent mutagenicity, enhanced Ames test, or carcinogenicity study) becomes available, the AI limit is refined and Appendix 1 is updated. Rev.12 reflects exactly this kind of refinement.

EMA vs FDA: comparing the two frameworks

Both frameworks rest on ICH M7(R2) and both reference CPCA as the default method for NDSRIs. The practical difference is the format: EMA maintains a single cumulative table (Appendix 1), while FDA maintains a cumulative online list with supporting guidance. For a global submission, both lists must be reconciled against your specification.

The EMA three-step process remains the operational framework

Although the original call for review deadlines have passed, the three-step framework remains the operational model for ongoing MAH obligations:

Step 1, risk evaluation: Identify every active substance and finished product at risk of N-nitrosamine formation or cross-contamination. Document the rationale and report to the competent authority.

Step 2, confirmatory testing: If risk is identified, test the finished product to confirm or refute the presence of nitrosamines using validated methods (typically LC-MS/MS with SPE cleanup). The method LOQ must be below the AI limit divided by the maximum daily dose.

Step 3, risk mitigation: Where presence is confirmed above the AI limit, implement mitigation through a variation. Mitigation can include reformulation, antioxidant addition, supplier change, API purification, or container-closure optimisation.

Steps 1 through 3 are not one-time activities. Every Rev.X update to Appendix 1, every new product, every manufacturing change, every API supplier change triggers a re-evaluation. The three-year implementation window starts on the date an AI limit is added or revised.

What MAHs must do now

1. Map Rev.12 changes to your portfolio. Cross-reference the red-marked entries in Appendix 1 Rev.12 against your product list. If you hold a rivaroxaban, furosemide, or dextromethorphan marketing authorisation, start the assessment now.

2. Recompare specification limits. The new AI limits in Rev.12 override any previously qualified limit for those substances. Your release specification, stability specification, and shelf life calculation must align with the current AI.

3. Requalify your analytical method. An analytical method qualified against a prior AI limit may no longer have adequate sensitivity. LOQ must sit safely below AI divided by maximum daily dose. Re-validate if needed.

4. Document the Rev.12 comparison in your PQS. Create a traceable record showing when you reviewed Rev.12, which products were affected, and what actions were initiated. This record is expected at routine GMP inspections.

5. Assess whether a variation is required. If your current product specification exceeds the Rev.12 AI limit, or if mitigation is needed, prepare a Type IA, IB, or II variation as appropriate under EU variation rules.

6. Plan the implementation within three years. The implementation clock for Rev.12 entries started on March 13, 2026. Work backward from March 13, 2029 to set internal milestones for assessment, mitigation design, variation filing, and CMO coordination.

7. Align FDA and EMA positions. If your product is marketed in both regions, check the FDA CDER AI Limits list against Appendix 1 Rev.12. Where the two regulators set different values, document your justification for the limit you apply in each region.

Try this in RegAid: What is the EMA acceptable intake for N-nitroso-rivaroxaban?

Common pitfalls

Treating Appendix 1 as a frozen document: the table is revised every few months. A specification that passes today may exceed a new limit six months from now. Build a recurring review task, not a one-off check.

Misclassifying NDSRIs under CPCA without structural review: CPCA assignment depends on α-hydrogen positions and activating groups, not just molecular weight or functional groups. A miscategorised nitrosamine can result in a 10x or 100x error in the AI limit.

Ignoring the distinction between API nitrosamines and NDSRIs: NDSRIs are formed when the API itself is susceptible to nitrosation (typically at a secondary amine). Supplier changes alone will not fix an NDSRI; the API structure is the root cause.

Assuming FDA and EMA limits always match: they usually align, but not always. FDA may list an NDSRI limit that EMA has not yet added to Appendix 1, or EMA may revise downward before FDA does. Track both lists.

Underestimating method sensitivity requirements: for low-dose NDSRIs at 18 or 26.5 ng/day limits, LC-MS/MS methods must reach low ppb detection levels. Prior methods qualified against 1,500 ng/day benchmarks are likely inadequate.

Key takeaways

• EMA Appendix 1 Rev.12 was published March 13, 2026, with new AI limits for rivaroxaban, furosemide, and dextromethorphan nitrosamines
• AI limits target a theoretical additional lifetime cancer risk below 1 in 100,000, per ICH M7(R2)
• CPCA assigns a nitrosamine to one of 5 categories with AI limits of 18, 100, 400, or 1,500 ng/day; FDA default is 26.5 ng/day
• MAHs have 3 years from publication to implement corrective or preventive action; for Rev.12 entries, the clock started March 13, 2026
• FDA maintains its own list of 251 NDSRI limits under the September 2024 Rev.2 guidance; reconcile against EMA Appendix 1 for global products
• The three-step EMA framework (risk evaluation, confirmatory testing, risk mitigation) remains the operational lifecycle model, not a one-time exercise

How RegAid helps

RegAid covers the EMA Q&A EMEA-H-A5(3)-1490, every revision of Appendix 1 including Rev.12, the CPCA methodology in Appendix 2, ICH M7(R2), and the FDA Control of Nitrosamine Impurities and NDSRI RAIL guidances. Ask "What is the acceptable intake for N-nitroso-rivaroxaban?" or "How does the EMA Appendix 1 limit compare to the FDA list for furosemide?" and get a cited answer with links to the agency source documents.