MDSAP in 2026: How the Single Audit Program Works After QMSR
For a medical device manufacturer selling in several major markets, the Medical Device Single Audit Program (MDSAP) promises something rare in regulatory work: one audit that satisfies multiple regulators. In practice, the program is more demanding than a standard ISO 13485 certification audit, and 2026 has brought the most significant changes to it since the pilot ended in 2017. A new audit approach took effect in February 2026, governance of the program moved to a new host, and FDA's Quality Management System Regulation (QMSR) now aligns U.S. requirements with ISO 13485:2016, which changes how MDSAP audits map to FDA expectations.
This article explains how MDSAP works today, what changed in 2026, how each participating regulator uses MDSAP reports, and how regulatory affairs and quality teams can prepare for an audit that is designed to find more than a certification audit would.
What MDSAP Is and Who Participates
MDSAP allows a recognized Auditing Organization (AO) to conduct a single regulatory audit of a manufacturer's quality management system that covers the requirements of all participating Regulatory Authorities. The program has five full members:
U.S. Food and Drug Administration (FDA)
Health Canada
Therapeutic Goods Administration (TGA), Australia
Agência Nacional de Vigilância Sanitária (ANVISA), Brazil
Ministry of Health, Labour and Welfare (MHLW) and Pharmaceuticals and Medical Devices Agency (PMDA), Japan
Other authorities participate as affiliate members or observers, and the UK's Medicines and Healthcare products Regulatory Agency (MHRA) has been working toward fuller participation as part of its post-Brexit reliance strategy. The European Union participates as an observer but does not accept MDSAP audits in place of notified body audits under the MDR.
The audit criteria are ISO 13485:2016 plus the country-specific requirements of each participating authority, such as FDA's medical device reporting (21 CFR Part 803), corrections and removals (21 CFR Part 806), and registration and listing (21 CFR Part 807), or Health Canada's Medical Devices Regulations for licensing, mandatory problem reporting and recalls.
How Each Regulator Uses MDSAP
A frequent misunderstanding is that MDSAP is a single certificate with a single meaning. Each authority uses the audit report differently.
Health Canada requires MDSAP certification as the quality system evidence for Class II, III and IV medical device licence applications and for maintaining those licences. For most manufacturers selling in Canada, MDSAP is effectively mandatory.
FDA accepts MDSAP audit reports as a substitute for routine, surveillance-level inspections. MDSAP does not replace pre-approval inspections for PMA devices, for-cause inspections, or compliance follow-up inspections, and FDA can still inspect any facility at any time.
TGA uses MDSAP audit reports and certificates as evidence of conformity assessment in support of applications to include devices in the Australian Register of Therapeutic Goods (ARTG), which can reduce the need for TGA's own conformity assessment of the quality system.
ANVISA uses MDSAP reports to support Good Manufacturing Practice (GMP) certification for Class III and IV devices, which can reduce or replace the need for an ANVISA on-site inspection and shorten certification timelines.
MHLW/PMDA use MDSAP reports to reduce the scope of, or in some cases replace, on-site QMS inspections under Japan's Ministerial Ordinance No. 169, which is itself closely aligned with ISO 13485.
The practical implication is that a manufacturer should define its MDSAP audit scope based on which markets it actually sells into. An audit scope that includes a jurisdiction adds that jurisdiction's specific requirements to the audit, and the AO will audit against them.
What Changed in 2026
A new audit approach: MDSAP AU P0002.010
In February 2026, the program issued version 010 of the MDSAP Audit Approach (MDSAP AU P0002.010). The revision is the most substantial update to the audit methodology since the pilot. Key changes include:
Removal of legacy 21 CFR Part 820 (QSR) citations and direct alignment with FDA's QMSR, which incorporates ISO 13485:2016 by reference and became effective on 2 February 2026.
New audit criteria for Predetermined Change Control Plans (PCCPs), reflecting FDA's framework for pre-authorized modifications to AI-enabled device software.
A streamlined process structure that links design and development, risk management and post-market surveillance more explicitly, so that auditors follow evidence across processes rather than auditing each in isolation.
New governance host
In December 2025, administration of the program's documentation and portal transferred to a TGA-managed platform at mdsap.global. Audit approaches, AO listings, forms and announcements are now published there. RA teams should update any internal links, procedures and supplier qualification records that point to older program pages.
The QMSR effect
Before February 2026, the FDA portion of an MDSAP audit required auditors to cross-reference the QSR's structure against ISO 13485. With the QMSR in effect, the underlying U.S. requirements are ISO 13485:2016 plus a limited set of FDA-specific provisions (for example, the additional record content required for complaints, servicing and UDI under 21 CFR 820.35, and labeling and packaging controls under 820.45). This makes the FDA portion of an MDSAP audit more coherent, but it also removes some of the flexibility that manufacturers previously relied on. Notably, under the QMSR, management review records, internal audit reports and supplier audit reports are no longer exempt from FDA inspection, and MDSAP auditors have always reviewed them. The two regimes now converge.
The Audit Cycle
MDSAP runs on a three-year cycle:
Initial certification audit, conducted in two stages. Stage 1 reviews documentation and readiness; Stage 2 is the full on-site audit of the QMS against all applicable requirements.
Surveillance audit 1, about 12 months after certification.
Surveillance audit 2, about 24 months after certification.
Recertification audit in year three, completed before the certificate expires.
Special audits and unannounced audits can occur outside this cycle, for example after significant changes, serious quality problems, or at a Regulatory Authority's request.
How Nonconformities Are Graded
The feature of MDSAP that most surprises teams used to ISO certification audits is its grading system. Each nonconformity is graded from 1 to 5 using a matrix derived from the GHTF/SG3/N19 grading system. The grade depends on two factors:
Impact: whether the nonconformity is in a process with direct impact on device safety and performance (for example, design control, production controls, CAPA, complaint handling) or indirect impact (for example, document control, management review).
Occurrence: whether the nonconformity is a first occurrence or a repeat of a nonconformity found in a previous audit.
Two escalation rules then apply: a grade is increased by one if there is an absence of a documented process or procedure, and increased by one if a nonconforming medical device has been released. A grade 5 nonconformity, or more than two grade 4 nonconformities, triggers notification by the AO to all participating authorities within five days, and it can prompt regulatory follow-up.
Manufacturers have 15 calendar days to provide a remediation plan for nonconformities and 30 calendar days to provide evidence of correction and corrective action implementation, although the specific expectations should be confirmed against the current program documents and the AO's procedures. The practical lesson: a repeat finding in a high-impact process is expensive, because it escalates the grade automatically. CAPA effectiveness for previous MDSAP findings is therefore one of the most important things to verify before any surveillance or recertification audit.
Preparing for an MDSAP Audit
1. Confirm your jurisdictional scope
List every market in scope and every device family sold there. Confirm with your AO that the audit plan reflects both. Adding a jurisdiction late creates gaps in evidence.
2. Map the country-specific requirements
Create a matrix that lists, for each participating authority, the specific requirements your QMS must address: device registration and listing, adverse event reporting timelines, recall and field action procedures, labeling requirements, and licensing obligations. For example, FDA requires medical device reports within 30 calendar days of becoming aware of a reportable event (5 work days for events requiring remedial action), while Health Canada's mandatory problem reporting timelines are 10 days for incidents involving death or serious deterioration in health and 30 days for incidents that could lead to such outcomes if they recurred. Your complaint handling and vigilance procedures must address each set of timelines explicitly, not just by reference.
3. Walk the audit sequence yourself
The MDSAP Audit Approach follows a defined sequence of processes: management; device marketing authorization and facility registration; measurement, analysis and improvement; medical device adverse events and advisory notices reporting; design and development; production and service controls; and purchasing. Conduct an internal audit that follows this exact sequence and uses the same linkages. Auditors trace evidence from one process to the next (for example, from a complaint to a CAPA to a design change to a regulatory assessment of whether a new submission is needed). Weak linkages are where findings concentrate.
4. Test the regulatory assessment of changes
MDSAP auditors routinely ask how a manufacturer determined whether a change required a new 510(k), a Health Canada licence amendment, a TGA variation, or an ANVISA notification. Pick five recent changes and verify that each has a documented, jurisdiction-specific regulatory assessment. This is one of the most common sources of findings in the "device marketing authorization" process.
5. Verify CAPA effectiveness on previous findings
Because repeat findings escalate in grade, check that every nonconformity from the previous audit has a closed CAPA with objective evidence of effectiveness, not just evidence of implementation.
6. Prepare your PCCP evidence if applicable
If you market AI-enabled device software with an authorized PCCP, expect auditors to review how modifications are implemented within the PCCP's boundaries, how verification and validation are performed according to the modification protocol, and how impact assessments are documented. The new audit criteria make this a defined audit area rather than an ad hoc topic.
A Worked Example: How Auditors Trace a Complaint
To understand why process linkages matter, consider how an MDSAP auditor might follow a single complaint through a QMS.
Complaint intake. The auditor samples a complaint about an infusion pump alarm failing to sound. They check that the complaint record contains the information required by ISO 13485 clause 8.2.2 and, for the FDA portion, the additional content required by 21 CFR 820.35(a), such as the UDI, the dates and results of the investigation, and any reply to the complainant.
Reportability decision. The auditor checks whether the manufacturer assessed reportability for every jurisdiction in scope. An alarm failure that could contribute to serious injury if it recurred is likely reportable to FDA as a malfunction under Part 803 and to Health Canada as a mandatory problem report. The auditor looks for a dated decision, the criteria applied and, where reportable, evidence of timely submission.
Investigation and CAPA. If a trend or root cause was identified, the auditor follows the link into CAPA. They check whether the root cause analysis was proportionate to the risk, whether the corrective action addressed the cause rather than the symptom, and whether effectiveness was verified.
Design change. If the corrective action was a firmware change, the auditor moves into design and development. They look for design verification and validation, updated risk management documentation, and a software change assessment.
Regulatory assessment. Finally, the auditor checks whether the manufacturer determined if the firmware change required a new 510(k) under FDA's guidance on software changes, a licence amendment in Canada, a variation in Australia, and a notification in Brazil and Japan. They also check whether devices in the field were addressed, and if so, whether a correction or removal report was filed under 21 CFR Part 806.
Each step is a potential finding, and a gap at any point can be graded as high impact because complaint handling, CAPA and design are all processes with direct impact on safety and performance. Running this trace yourself, with three or four real complaints, is one of the most effective forms of audit preparation.
Building a Regulatory Assessment Procedure That Holds Up
Because change assessment is so central to MDSAP, it is worth investing in a procedure that makes the reasoning visible. A strong procedure typically includes:
A trigger list defining which change types require RA review (design, labeling, materials, suppliers of critical components, manufacturing site, sterilization, software, and intended use).
A jurisdiction-by-jurisdiction decision tool that references the relevant guidance for each market, such as FDA's guidances on deciding when to submit a 510(k) for a change to an existing device and for software changes, and Health Canada's guidance on significant change.
A requirement to record the rationale, not just the conclusion, with references to the specific decision points applied.
A link to the risk management file, so that changes that affect risk controls are identified consistently.
A periodic retrospective review of a sample of change decisions to check consistency across reviewers and product lines.
Is MDSAP Worth It?
For manufacturers selling in Canada, the question is moot. For others, the calculation depends on market footprint. The costs include longer audit durations than a standard ISO 13485 audit, the operational burden of meeting all jurisdictional requirements at once, and the transparency of grading and regulator notification. The benefits include fewer separate regulatory inspections, a predictable audit schedule in place of unannounced FDA routine inspections, smoother market entry in Brazil, Australia and Japan, and a single, internally consistent set of evidence.
With the QMSR now in force, the marginal effort of MDSAP for U.S. manufacturers has decreased. Much of what MDSAP auditors examine is now what FDA investigators examine too. For companies selling in two or more participating markets, MDSAP has become easier to justify than at any time since the program began.
Common Pitfalls
Treating MDSAP as an ISO 13485 audit with extras. The country-specific requirements are audited with the same rigor as the ISO clauses.
Generic vigilance procedures. A procedure that says "report per applicable regulations" without specifying each jurisdiction's criteria and timelines is a common finding.
Unclear responsibility for regulatory assessments of changes. If engineering approves a change without RA input, expect questions.
Weak supplier controls for critical suppliers. Auditors will trace purchasing controls for suppliers of components and services that affect safety and performance, including contract sterilizers and software service providers.
Not preparing staff for process-linked questioning. Staff who can explain their own process but not how it connects to upstream and downstream processes create gaps in the audit trail.
The Bottom Line
MDSAP in 2026 is more aligned, more demanding and more useful than it has ever been. The new audit approach, the move to a TGA-managed platform and FDA's adoption of ISO 13485 through the QMSR have narrowed the distance between what an MDSAP auditor looks for and what a regulator expects. For regulatory affairs professionals, the priority is to own the jurisdictional layer: the registration, reporting, change assessment and labeling requirements that are unique to each market. That is where MDSAP audits are won or lost.
Sources
MDSAP program documents and Audit Approach (MDSAP AU P0002.010): mdsap.global
FDA, Medical Device Single Audit Program (MDSAP): fda.gov
FDA, Quality Management System Regulation (21 CFR Part 820), final rule published 2 February 2024, effective 2 February 2026
Health Canada, Medical Devices Regulations (SOR/98-282) and MDSAP requirements for licence applications
ANVISA, "Anvisa takes part in the MDSAP 2026 Forum": gov.br/anvisa
NSF, "MDSAP Audit Approach Update: What Changed and Why It Matters": nsf.org
GHTF/SG3/N19:2012, Nonconformity Grading System for Regulatory Purposes and Information Exchange
Comments