What is the MDSAP? For your medical device organization, it's an opportunity and a significant challenge at the same time.

The Medical Device Single Audit Program (MDSAP) is one of the biggest recent developments in global regulatory compliance for medical device manufacturers. By allowing a single audit pathway to satisfy 5 different national regulators, the MDSAP offers an accelerated route to global expansion for your medical device company — if you can meet its stringent requirements.

Succeeding with the MDSAP requires strategic preparation, a strong medical device quality management system, and a clear understanding of how the MDSAP audit approach differs from other industry quality standards such as ISO 13485.

In this comprehensive guide, we’ll break down:

• What the MDSAP is, and why it matters if you're a medical device company hungry for international expansion

• Which MDSAP countries recognize the program

• How the MDSAP audit approach works 

• What it takes to achieve MDSAP certification

• How to prepare your QMS and teams for a successful MDSAP process

What is MDSAP?

The Medical Device Single Audit Program, or MDSAP for short, is a regulatory framework that allows medical device manufacturers to undergo a single audit of their quality management system (QMS) that satisfies the requirements of multiple regulatory authorities simultaneously.

Traditionally, a manufacturer selling into multiple countries would face separate audits from each country’s regulator — a resource-heavy and burdensome process. The MDSAP was designed to streamline this process, by consolidating the requirements of participating countries into a single, unified audit model.

The MDSAP was piloted in 2014 and formally launched in 2017, driven by the International Medical Device Regulators Forum (IMDRF).

The program’s launch goals were to:

• Reduce the regulatory burden on manufacturers

• Improve audit predictability and consistency

• Enhance global cooperation among regulators

• Strengthen patient safety through more robust QMS oversight in major, high-population economies

Since its inception, the MDSAP has gained traction worldwide, particularly among manufacturers seeking efficient access to major global markets.

Is MDSAP certification worth it for me?

Going through the MDSAP is a notoriously difficult, high-bar process. 

The MDSAP is designed to be rigorous and leave little room for quality weakness. After all, any compliance issue could affect devices on the market in five large countries, rather than one. 

MDSAP certification is therefore more expensive and challenging than other programs, since the regulatory requirements of five countries have to be audited in addition to ISO 13485.

But there are substantial benefits to consider, too, given that only one audit is required to unlock five major markets at once.

Your internal teams need to prepare for and support one major audit, rather than several.

And while national regulators have the right to audit your company post-MDSAP, they'll let you know if they plan to do so, and this is generally only done if there's reason to assume that your company is not in compliance. So you can enjoy fewer audits, and no surprise visits, after the MDSAP process is complete.

MDSAP certification is, therefore, often a case of extra short-term effort and cost now, to set up for long-term success and lowered compliance burden later.

With that in mind, let's dive into which countries take part in the MDSAP program.

MDSAP countries

One of the most important aspects of your MDSAP prep is understanding where it applies.

As of 2025, the following MDSAP countries participate in the program:

1. United States of America (FDA)

If you don't have a history of substantial prior quality deficiencies, there's a high chance that the FDA will accept your MDSAP audit report in place of its routine inspections of your operation.

The FDA reserves the right to inspect after review of your MDSAP report, and will of course inspect you carefully in cases of product recalls, complaints or enforcement actions.

But, in general, the MDSAP offers a significant reduction in inspection frequency for compliant organizations.

It's important to note, though, that the MDSAP process cannot be used in lieu of PMA pre-approval inspections, because of the sensitive nature of high-risk Class III devices.

2. Canada (Health Canada)

Since January 1, 2019, Health Canada has required all manufacturers to provide valid MDSAP certificates to obtain or maintain a Canadian medical device license.

MDSAP certification is therefore mandatory for medical device manufacturers selling into Canada, with Canada the only country to operate in this way.

Manufacturers of moderate and high-risk devices in Classes 2, 3 or 4 must still file a device licence (MDAL) application.

3. Australia (TGA)

Australia's TGA uses the MDSAP audit report and certificate as part of the evidence to support an application for a TGA Conformity Assessment Certificate.

This is a crucial step for manufacturers who need to demonstrate that their quality management system (QMS) meets the requirements of the Australian Therapeutic Goods (Medical Devices) Regulations 2002.

For manufacturers who have a TGA Conformity Assessment Certificate and are also MDSAP-certified, the TGA performs a 'desktop review' of the MDSAP audit reports. This means they review the documentation remotely without a physical on-site inspection.

The TGA needs the MDSAP certificate and audit reports to explicitly state that the manufacturer's QMS was assessed and found to comply with the relevant aspects of the Australian regulations. The MDSAP audit model is designed to incorporate these country-specific requirements.

In essence, the TGA leverages the MDSAP program to reduce its own inspection workload while still maintaining regulatory oversight.

By relying on the MDSAP's robust and standardized audit process, the TGA can efficiently assess a manufacturer's compliance, which benefits both the regulator and the medical device industry.

4. Brazil (ANVISA)

In Brazil, MDSAP audit reports are analyzed by ANVISA and must cover RDC No.16/2013.

Reports with non-conformity grades 1 to 3 (more on that below!) must identify satisfactory action plans, while reports with grades 4 or 5 must state that corrective actions have been closed.
 

5. Japan (MHLW/PMDA)

Japan allows the marketing authorization holder to submit the MDSAP audit report in lieu of pre-inspection documents, and sometimes MDSAP status exempts a site from inspection generally.

Certain devices, such as HCT/Ps and radioactive IVDs still require PMDA inspection. 

In addition, a marketing authorization application for the device is required.

MDSAP and ISO 13485

Since it's a global medical device quality management benchmark, you may be wondering how the MDSAP differs from ISO 13485, the international medical device QMS standard.

Are MDSAP requirements identical to ISO 13485?

In a word, no. ISO 13485 requirements form the core of MDSAP requirements, but the MDSAP is not identical to ISO 13485.

Why? Each MDSAP country contains its own, additional requirements which need to be met by an MDSAP-certified company on top of the ISO 13485 spine.

There are additional requirements contained in Brazilian Good Manufacturing Practices, for instance, as well as in American, Australian, Canadian and Japanese requirements.

In fact, there are specific requirements for each MDSAP participating regulatory authority in terms of medical device adverse event reporting, advisory notice reporting, device marketing authorization, and facility registration.

In Canada and Australia, for instance, SQR/98.282 Section 63-65 and the Uniform Recall Procedure for Therapeutic Goods go beyond the requirements of ISO 13485 Clauses 8.2.3 and 8.3.3.

How the MDSAP audit approach works

Let's look at the core of the program, then: the audit process itself.

The MDSAP audit approach is structured, risk-based, and far more comprehensive than a typical ISO 13485 audit. It doesn’t just look at whether your processes exist; it evaluates whether they're effectively linked, documented, and producing compliant outcomes.

Key features of the MDSAP audit approach

1. Process-oriented structure

   • MDSAP audits are divided into process groups: 4 primary and 1 secondary

   • 2 additional supporting processes, adverse event/advisory notice reporting and marketing authorization/facility registration, are also explored
     
     

   • Auditors evaluate how these processes interact and whether outputs from one process serve as effective inputs to another

   •  While the groups have been arranged in a logical order to conduct an audit of the MDSAP process, the audit tasks may be performed in any order to facilitate a thorough and efficient audit of your QMS

      

     
     

     

   
   
   

2. Broad regulatory focus

   • As we've just seen above, unlike ISO 13485 alone, MDSAP integrates extra country-specific requirements. The audit is built on a foundation of requirements for risk management and comprise the requirements of an ISO 13485 QMS primarily, plus:

     • QMS requirements of the Conformity Assessment Procedures of the Australian Therapeutic Goods (Medical Devices) Regulations

     • Brazilian GMPs

     • Japan Ordinance on Standards for Manufacturing Control and Quality Control of Medical Devices and In Vitro Diagnostic Reagents

     • Health Canada MDRs

     • FDA QSR, soon to be Quality Management System Regulation (QMSR), now more harmonized with 13485

     
     
     

3. Nonconformity grading system

   • Issues are graded in a unique way in the MDSAP on severity, from minor documentation lapses to major systemic failures

   • This helps regulators understand the seriousness of non-conformities and prioritize any follow-up actions

4. Remote and hybrid techniques

   • The MDSAP remote audit is catching on; about ⅓ of MDSAP audits now have at least a partially offsite element

   • The FDA extended its adoption of the MDSAP remote and hybrid auditing pilot program for an extra 6 months in 2024-25, showing considerable focus and intent in this area

5. Audit timeframe

   • Initial certification audits are typically conducted over multiple days

   • Surveillance audits occur annually, with a recertification audit every three years

      

     

The MDSAP audit flow in practice

An MDSAP audit follows a pretty standard, multi-stage structure:

• Stage 1: Documentation review, QMS readiness evaluation

• Stage 2: On-site or remote audit of processes, interviews, and record reviews

• Reporting: Findings are documented and graded

• Follow-up: Manufacturers must address any nonconformities through CAPA plans

Preparing for MDSAP certification

Achieving MDSAP certification requires strategic preparation and a strong QMS foundation.

Think of it less as a single project, and more as a shift toward continuous global compliance with 5 major regulatory frameworks.

As the name suggests, succeeding in the program really hinges upon succeeding in a single, high-intensity MDSAP audit.

Pass the audit, and that shiny MDSAP certificate is yours!

To help you, we've built an MDSAP audit checklist to help you check off the operational ingredients you need in your medical device QMS.

MDSAP audit checklist

Need an MDSAP audit checklist to help your preparations?

Download your MDSAP audit checklist at the link below!

Download MDSAP audit checklist

Common challenges in MDSAP audits

Even well-prepared organizations can stumble in an MDSAP audit.

Here are some frequent pitfalls to be aware of.

1. Treating MDSAP as 'just another ISO audit'

   • ISO 13485 is a foundation, but MDSAP goes further. Neglecting those extra, country-specific requirements can lead to nonconformities and audit failure.

2. Inadequate documentation

   • MDSAP auditors expect clear evidence of process linkages, including inputs and outputs. Missing CAPA records or poorly maintained design history files can derail an MDSAP audit.

3. Weak supplier oversight

   • Remember: your critical suppliers may also be subject to review during your MDSAP audit. Poor supplier controls can raise major findings, so ensure you keep up with your supplier auditing activities in the months leading up to your MDSAP audit

4. Overlooking remote readiness

   • With one-third of MDSAP audits now including remote elements, not having digital medical device quality management software can make information-sharing much more difficult

MDSAP FAQs

Is participation in the MDSAP mandatory?

That depends - you can market your device in the US, Australia, Japan and Brazil without ever requiring MDSAP certification. You're free to tackle each market individually, leaving out any which don't fall into your global expansion strategy.

The only exception is Canada. As we saw above, Health Canada requires all medical device manufacturers selling Class II, III, and IV devices to have MDSAP certification. If you're only a Class I manufacturer, you don't need MDSAP certification at all.

Who conducts MDSAP audits?

MDSAP audits are carried out by recognized Auditing Organizations (AOs), which are accredited third-party organizations authorized by participating regulators. 

Find an AO for your company here.

Does the MDSAP cover in vitro diagnostic (IVD) devices?

Yes, IVDs are within scope of the MDSAP if regulated as medical devices by the participating authorities.

Does MDSAP certification guarantee market approval?

No. MDSAP certification supports regulatory compliance and is the biggest step you can take to market access, but it does not replace other product approval processes like device clearance, licensing and registration.

You'll still have to perform these tasks!

Does the MDSAP apply to all classes of medical devices?

Generally, only manufacturers of Class II devices and above should consider MDSAP certification.

The complexities of the Medical Device Single Audit Program won't be worth the effort if you only produce Class I devices, since the individual regulatory pathways for such devices are relatively light.

And, as we saw above, MDSAP certification is only mandatory for Class II, III and IV devices to be marketed in Canada.

The future of MDSAP

MDSAP is evolving rapidly, and there are number of key trends to keep your eye on.

In particular, look out for:

• Expansion to more countries: Other IMDRF members may join in the future, expanding MDSAP’s global reach. The EU, Argentina, South Korea and Singapore are currently acting as 'affiliate' members, while the UK was granted 'observer' status in March 2021. This loose outside engagement signals interest and could suggest expansion of the MDSAP initiative in the coming years.

• Greater reliance on remote audits: Hybrid auditing will likely become the norm, following worldwide post-COVID inspection trends.

• Integration with AI and compliance tech: Tools that automate audit readiness and CAPA management are emerging, making MDSAP success much easier than it used to be.

Manufacturers who invest early in digital compliance infrastructures will find themselves better positioned for success in the MDSAP.

Turning MDSAP into an advantage

The MDSAP isn’t just a particularly difficult audit initiative — it’s an opportunity to blow 5 major markets open for your medical device.

By aligning your QMS with the MDSAP audit approach and achieving MDSAP certification, your company unlocks:

• Streamlined entry into 5 large, wealthy countries

• Fewer audits and inspections

• Stronger internal processes that reduce compliance risks

• Increased credibility with regulators and customers

The key is preparation: focus on building a robust, preferably digital-first medical device QMS that will enable constant audit readiness.