Compound-specific AIs replacing defaults, the NMPEA recalculation and what it implies for downstream surrogates, and the three control-strategy paths that have crystallised since the 2023 deadlines.
The CPCA framework was published by the EMA on 7 July 2023, with the FDA Recommended Acceptable Intake Limits (RAIL) guidance following on 4 August 2023. Three years on, the practice has settled enough to take stock of what has worked, what has not, and where the framework has had to be revised to accommodate the science.
Three observations stand out from the work of the past two years.
The CPCA categorisation produces five potency classes with default acceptable intake (AI) values from 18 ng/day (Category 1, highest potency) to 1500 ng/day (Category 5, lowest). When these defaults were first applied, several products were assigned AI limits that posed substantial control challenges relative to the maximum daily dose, particularly for high-dose chronic medications.
The path forward in many of these cases has been compound-specific AI derivation, justified through read-across from a structurally and mechanistically appropriate surrogate, supported by carcinogenicity data of acceptable quality. The EMA Q&A document (Article 5(3) referral, EMEA-H-A5(3)-1490) has been updated through revision 23 (October 2025) and now reflects this in operational terms. FDA's CDER NDSRI table is updated regularly with compound-specific limits where surrogate data support them.
The challenge is that the surrogates initially identified for many NDSRIs were small, low-molecular-weight nitrosamines whose carcinogenic potency is not necessarily representative of structurally larger NDSRIs. Bercu et al. (2024) examined the molecular weight distribution of NDSRIs (typically 200–600 Da) against the small-molecule nitrosamines on which the original CPCA defaults were anchored, and proposed that for CPCA categories 1 and 2 NDSRIs above 200 Da, an AI of 150 ng/day (10× lower than the ICH M7 TTC of 1500 ng/day) may be scientifically defensible in the absence of compound-specific data. The proposal has not yet been formally adopted but reflects an ongoing recalibration of the CPCA defaults against the actual physical properties of NDSRIs.
The most consequential development of the past eighteen months may be the recalculation of the AI for N-methyl-N-nitrosophenethylamine (NMPEA). The original Carcinogenic Potency Database (CPDB) entry combined tumour incidences across upper gastrointestinal tract sites (oesophagus, forestomach, tongue, nasal cavity) into a single tissue grouping, yielding a harmonic mean TD50 of 7.88 µg/kg/day and an AI of 8 ng/day.
Woolley et al. (2025), examining the original data, identified the oesophagus as the most sensitive single organ of effect, in line with ICH M7 recommendations on point-of-departure selection. The recalculated TD50 for the oesophagus alone was 40.1 µg/kg/day, corresponding to an AI of 40.1 ng/day. Benchmark dose (BMD) analysis on the same data yielded BMD10 values of 3.06–17.6 µg/kg/day, supporting a Permitted Daily Exposure range of 306–1760 ng/day.
The case illustrates a more general point: where a surrogate AI has been derived from a CPDB entry, the original tumour-incidence data should be examined directly. Tissue-grouping conventions, dosing schedule choices, and study quality factors that were embedded in the historical TD50 calculation may not align with current ICH M7 expectations.
In 2023, the central question for many marketing authorisation holders was whether confirmatory testing identified an NDSRI above the CPCA-derived AI. The August 2025 deadlines for FDA confirmatory testing and corresponding application updates (now extended in operational terms by the FDA's June 2025 revision allowing detailed progress reports in lieu of full implementation) shifted the focus from detection to mitigation.
Three control approaches have crystallised:
Each path is legitimate. The choice between them is a function of the specific product, the surrogate availability, and the commercial constraints.
What has not changed is the underlying expectation that mutagenic impurity control under ICH M7 is integrated into the lifecycle quality management system, not treated as a one-off compliance exercise. The cases that continue to consume regulatory time are typically those where the original control strategy was built around a default AI, and where the product has subsequently faced shifts in either the AI assignment or the analytical method sensitivity.
Three operational points follow from the experience of the past three years.
The CPCA framework remains a useful starting point. It is no longer reasonable to treat the default AI values as fixed. The science supporting the framework has continued to develop, and the practice has matured to the point where compound-specific reasoning, properly evidenced, is increasingly the expected response to a default value that does not fit the product.
Regulatory toxicologist with twenty-plus years of practice across REACH, BPR, cosmetics and pharmaceuticals. Lead author on nitrosamines assessment publications; co-author on EMA Article 5(3) referral support work.
