On 18 December 2025, MDSAP documents moved to a new website, mdsap.global, managed by Australia's TGA (FDA). Since 2 February 2026, FDA's Quality Management System Regulation has been in force, and FDA states that its inspections under the QMSR will not follow the MDSAP audit plan or procedures (FDA QMSR FAQ).
The Medical Device Single Audit Program (MDSAP) lets one recognised Auditing Organization (AO) carry out a single regulatory audit of a manufacturer's quality management system that satisfies the relevant requirements of several regulators. This article explains who takes part, how each regulator uses the audit, what is audited, and how the audit cycle works.
Background
At its first meeting in Singapore in 2012, the International Medical Device Regulators Forum (IMDRF) set up a work group to develop MDSAP. FDA and its partners ran a pilot from 1 January 2014 to 31 December 2016. Japan joined in June 2015. The final pilot report of 29 June 2017 concluded that the programme was viable, according to FDA.
Who takes part
| Status | Authorities |
|---|---|
| Members | TGA (Australia), ANVISA (Brazil), Health Canada, MHLW and PMDA (Japan), FDA (US) |
| Official Observers | European Union, HSA (Singapore), MHRA (UK), WHO Prequalification of In Vitro Diagnostics |
| Affiliate Members | ANMAT (Argentina), Ministry of Health of Israel, Pharmacy and Poisons Board (Kenya), MFDS (Republic of Korea), COFEPRIS (Mexico), SAHPRA (South Africa), TFDA (Taiwan) |
Source: FDA, MDSAP page.
For European manufacturers, the important point is that the EU and the UK are observers, not members. An MDSAP certificate does not replace conformity assessment for CE marking or for the UK market. Manufacturers based outside the EU, including most MDSAP participants, also need an EU authorised representative under Article 11 of the MDR before placing devices on the EU market. MedQAIR's Digital AR service covers that role.
In our view, the first step is to list your target markets and mark each one as member, observer, affiliate or none. That list tells you whether MDSAP is mandatory, useful or irrelevant for you.
How each regulator uses the audit
The audit result is the same; what each regulator does with it is not.
FDA: may accept MDSAP audit reports as a substitute for routine FDA inspections. Activities under the Electronic Product Radiation Control provisions remain subject to FDA inspection. According to FDA, MDSAP is voluntary in the US, FDA does not require or issue ISO 13485 certificates, and an ISO 13485 certificate does not exempt a manufacturer from inspection.
Health Canada: since 1 January 2019, MDSAP has replaced the Canadian Medical Devices Conformity Assessment System (CMDCAS). All manufacturers holding Canadian medical device licences now take part (Health Canada).
TGA, ANVISA and MHLW/PMDA: use MDSAP reports within their own procedures. Check each authority's current requirements for your device before relying on a report.
None of these uses is a market authorisation. A 510(k), a Canadian licence or an ARTG inclusion is still a separate decision.
The certificate
According to the MDSAP FAQs, after an initial audit or re-audit the AO issues certification documents that refer to MDSAP and state compliance with ISO 13485 and the regulations of each jurisdiction used as audit criteria. Manufacturers may publicise their certification, within their AO's terms. They may not call products "MDSAP certified" or "MDSAP Approved", and they may not put the MDSAP logo or any mention of MDSAP on product labelling.
What is audited
The audit criteria combine ISO 13485:2016 with the quality system requirements of each member jurisdiction in scope:
| Jurisdiction | Requirements audited |
|---|---|
| All | ISO 13485:2016 |
| Australia | Therapeutic Goods (Medical Devices) Regulations 2002 |
| Brazil | ANVISA RDC 665/2022, among others |
| Canada | Medical Devices Regulations (SOR/98-282) |
| Japan | MHLW Ministerial Ordinance No. 169 |
| US | 21 CFR Part 820 (QMSR), plus related rules such as 21 CFR 803 (medical device reporting) and 806 (corrections and removals) |
Source: MDSAP Audit Approach.
The MDSAP audit approach is organised around seven processes:
Management;
Device Marketing Authorization and Facility Registration;
Measurement, Analysis and Improvement;
Medical Device Adverse Events and Advisory Notices Reporting;
Design and Development;
Production and Service Controls;
Purchasing.
In our view, the linkage between processes is what catches manufacturers out. A weak complaint trend analysis shows up again in corrective action, management review and design changes. Our article on the ISO 13485 quality management system covers the underlying requirements, and our article on EN ISO 13485 under the MDR covers the EU side.
The three-year audit cycle
MDSAP follows a three-year certification cycle:
| Audit | When | Scope |
|---|---|---|
| Initial audit | Start of the cycle, in two stages | Full QMS |
| Surveillance audits | Years one and two | Partial |
| Recertification audit | Year three | Full QMS |
| Special audits | When a regulator or the AO requires one | As needed |
| Unannounced audits | At any time | As needed |
Source: MDSAP programme documents.
FDA's QMSR FAQ makes the contrast clear: FDA inspections are scheduled based on risk, while third-party audits take place annually on a three-year plan.
A hypothetical example
Hypothetical example: a Dutch SaMD manufacturer has a 510(k) clearance and plans to sell in Canada and Australia. It does not supply Brazil or Japan.
Scope: it agrees the audit scope with its AO, covering the US, Canada and Australia, after checking the MDSAP rules on excluding jurisdictions where it does not market.
Audit: the Design and Development process covers its software lifecycle, and the adverse events process covers its procedures under 21 CFR 803.
Use: Health Canada requires the MDSAP certificate for the licence; FDA may accept the report instead of a routine inspection; TGA uses it within its own procedures.
EU: none of this replaces its MDR conformity assessment, which it plans separately.
Our article on medical device regulatory strategy for the EU and US covers that wider planning.
Conclusion
MDSAP gives one audit and one report, but each member regulator makes its own decision with it. For Canada it is mandatory; for the US it is voluntary; for the EU and UK it does not replace their own conformity assessment.
In our view, MDSAP is worth it when you sell, or plan to sell, in two or more member markets, and essential if Canada is one of them.
If you need help preparing a quality system for MDSAP, our management system team can help, or contact MedQAIR.
Frequently asked questions
Is MDSAP mandatory?
It depends on the market. Health Canada requires it for manufacturers holding Canadian medical device licences. FDA states that it is voluntary in the US.
Does an MDSAP certificate allow me to sell in the EU?
No. The EU is an official observer, not a member. CE marking under the MDR or IVDR is still required, and manufacturers outside the EU must designate an EU authorised representative.
Can I call my product "MDSAP certified"?
No. According to the MDSAP FAQs, products may not be called "MDSAP certified" or "MDSAP Approved", and MDSAP must not appear on product labelling.
Does MDSAP replace FDA inspections?
Not entirely. FDA may accept MDSAP audit reports as a substitute for routine inspections, but its QMSR inspections do not follow the MDSAP audit plan, and FDA can still inspect.
How often are MDSAP audits held?
On a three-year cycle: an initial audit, surveillance audits in years one and two, and a recertification audit in year three, plus any special or unannounced audits.
