The landscape of global medical device regulation has shifted toward a unified, risk-based approach where efficiency and safety are no longer mutually exclusive. The Medical Device Single Audit Program, commonly known as MDSAP, stands as the most significant realization of this shift. By allowing a single regulatory audit of a medical device manufacturer’s quality management system (QMS) to satisfy the requirements of multiple jurisdictions, the program has streamlined market access for thousands of organizations worldwide. As of 2026, the program has matured beyond its pilot origins, expanding its scope to include a broader range of medical device organizations and solidifying its role as the gold standard for international regulatory compliance.

The Strategic Importance of MDSAP in 2026

Regulatory alignment is the primary driver behind the continued growth of MDSAP. The program is governed by the Regulatory Authority Council (RAC), which includes representatives from the therapeutic goods agencies of five founding member nations. For a manufacturer, participating in MDSAP is not merely a matter of convenience; it is a strategic decision that impacts global supply chain resilience and regulatory predictability.

One of the most significant developments recently is the expansion of eligibility. Previously, only "legal" manufacturers—those who market devices under their own name—were the primary candidates for certification. However, under the latest procedures, specifically following the pilot programs initiated for Medical Device Organizations (MDOs), the doors have opened for contract manufacturers and specification developers. This change recognizes that the complexity of modern medical device production often involves multiple specialized entities, all of which must adhere to rigorous QMS standards to ensure patient safety.

Deep Dive into the Five Founding Jurisdictions

To understand the value of MDSAP, it is essential to examine how each participating Regulatory Authority (RA) utilizes the audit outcomes. While the audit process is unified, the legal application of the results varies by country.

United States: FDA Acceptance

The U.S. Food and Drug Administration (FDA) accepts MDSAP audit reports as a substitute for routine agency inspections. It is important to note that this does not exempt a firm from "for-cause" inspections or compliance follow-ups related to specific product issues. However, for the vast majority of firms, an MDSAP certificate provides a high degree of confidence that their QMS meets the requirements of 21 CFR Part 820. As the FDA continues its transition toward the Quality Management System Regulation (QMSR), which aligns more closely with ISO 13485:2016, the MDSAP audit approach remains the most effective tool for demonstrating compliance with these evolving expectations.

Canada: Mandatory Participation

Health Canada has been the most assertive proponent of the program. Since 2019, MDSAP certification has been a mandatory requirement for medical device manufacturers selling Class II, III, and IV devices in the Canadian market. Unlike other jurisdictions where participation is voluntary, any organization targeting the Canadian market must integrate MDSAP into their core regulatory strategy. This mandate ensures that all higher-risk devices sold in Canada are produced under a QMS that has been rigorously vetted by a recognized Auditing Organization (AO).

Brazil: ANVISA and GMP

The Brazilian Health Regulatory Agency (ANVISA) utilizes MDSAP audit reports to satisfy the requirements for Good Manufacturing Practices (GMP) certification. Historically, obtaining an ANVISA GMP certificate often required a direct inspection by Brazilian authorities, which could lead to significant delays due to travel and scheduling. Through MDSAP, ANVISA can issue or renew GMP certificates based on the AO’s report, significantly accelerating the time-to-market for innovative devices in the South American region. Compliance is measured against RDC 665/2022, which is now the foundational QMS regulation in Brazil.

Australia: TGA Conformity Assessment

The Therapeutic Goods Administration (TGA) uses MDSAP audit reports as part of the evidence required to issue TGA conformity assessment certificates or to support the inclusion of a medical device in the Australian Register of Therapeutic Goods (ARTG). For many manufacturers, this reduces the need for additional assessments, provided that the MDSAP audit covers the specific Australian regulatory requirements outlined in the Therapeutic Goods (Medical Devices) Regulations 2002.

Japan: MHLW and PMDA Integration

In Japan, the Ministry of Health, Labour and Welfare (MHLW) and the Pharmaceuticals and Medical Devices Agency (PMDA) use MDSAP reports to streamline QMS audits. While Japan maintains its specific requirements under MHLW Ministerial Ordinance No. 169, the MDSAP audit approach is designed to capture these nuances. Participation can lead to a reduction in the documents required for a QMS audit and can sometimes eliminate the need for an on-site inspection by the PMDA, particularly for lower-risk devices.

The New Frontier: Eligibility for MDOs

A pivotal shift in the program’s evolution is the inclusion of Medical Device Organizations (MDOs) that do not market devices under their own name. This includes contract manufacturers, specification developers, and internal suppliers. According to the updated procedures effective through 2025 and 2026, these organizations can now voluntarily apply for MDSAP certification even if they are not the "legal manufacturer."

Defining the MDO

An MDO is defined as an organization involved in the design or manufacturing of medical devices that does not market the device under its own trademark. For instance, a high-tech contract manufacturer in Asia that produces complex surgical instruments for a European brand can now seek MDSAP certification. This provides a significant competitive advantage, as it allows the contract manufacturer to provide a pre-vetted, globally recognized audit report to any potential partner, reducing the burden of second-party audits.

Why This Matters for the Supply Chain

By allowing MDOs to participate, the MDSAP program addresses a major bottleneck in the industry. Legal manufacturers often struggle to manage the compliance of their critical suppliers. When a supplier holds its own MDSAP certificate, it demonstrates a baseline of excellence that satisfies the regulatory authorities of the five major markets. This transparency fosters a more robust and compliant global supply chain.

Navigating the MDSAP Audit Cycle

Participation in MDSAP is a commitment to a continuous three-year audit cycle. Understanding the nuances of each stage is critical for maintaining certification without business disruption.

Initial Certification: Stage 1 and Stage 2

The journey begins with the Initial Certification Audit. Stage 1 is primarily a documentation review. The Auditing Organization (AO) evaluates the manufacturer's QMS documentation and readiness for the on-site audit. This includes verifying the scope of the certification and ensuring that all jurisdictional requirements are addressed.

Stage 2 is the on-site assessment (though remote or hybrid arrangements have become more common under specific risk-based criteria). During Stage 2, the auditors evaluate the implementation and effectiveness of the QMS. They follow the MDSAP Audit Model, which uses a top-down approach, starting with Management Responsibility and flowing through the various operational processes.

Surveillance Audits

Following a successful initial certification, the manufacturer enters the surveillance phase. Surveillance audits occur annually (Year 1 and Year 2). These audits are not as exhaustive as the initial certification but focus on changes to the QMS, product improvements, and the ongoing effectiveness of the system. They ensure that the manufacturer has not deviated from the standards set during the initial assessment.

Recertification Audit

In the third year, a recertification audit is conducted. This is a comprehensive evaluation similar to the Stage 2 audit. A successful recertification extends the certificate for another three-year cycle. Organizations must plan for this audit well in advance to avoid any lapse in certification, which could result in an immediate loss of market access in jurisdictions like Canada.

The MDSAP Audit Model: A Process-Based Approach

The MDSAP audit is not a checklist of clauses; it is a process-based evaluation. The auditors use the "MDSAP Audit Approach" (document P0002) to navigate five primary processes. Each process is linked, and a failure in one often points to a systemic failure in another.

  1. Management: This is the foundation. Auditors look for evidence that senior leadership is committed to the QMS. This includes the provision of resources, the conduct of management reviews, and the establishment of a clear quality policy. If the management process is weak, the entire QMS is at risk.
  2. Measurement, Analysis, and Improvement: This process focuses on how the company handles data. It includes the Corrective and Preventive Action (CAPA) system, internal audits, and the analysis of feedback. In the MDSAP framework, the CAPA system is often the most scrutinized area, as it reveals how a company identifies and resolves non-conformities.
  3. Design and Development: For manufacturers of devices that require design controls, this process ensures that the transition from a concept to a finished product is documented, validated, and verified. It also ensures that risk management (ISO 14971) is integrated into the design phase.
  4. Production and Service Controls: This is the "shop floor" element of the audit. Auditors verify that manufacturing processes are controlled, validated where necessary, and that the environment is suitable for the production of sterile or sensitive devices. It also covers installation and servicing activities.
  5. Purchasing: In an era of global outsourcing, purchasing controls are vital. The audit evaluates how a manufacturer selects, evaluates, and monitors its suppliers. This links directly back to the new eligibility for MDOs, as previously discussed.

There is also a "supporting" process: Medical Device Adverse Events and Advisory Notices Reporting. This ensures that the manufacturer has established procedures to notify regulatory authorities of any serious incidents or field safety corrective actions (recalls) within the required timelines for each specific jurisdiction.

Understanding Non-Conformities and Grading

One of the unique aspects of MDSAP is the standardized grading of non-conformities (NCs). Instead of the traditional "Major" or "Minor" labels used in ISO 13485 audits, MDSAP uses a 1-to-5 grading scale based on the GHTF (Global Harmonization Task Force) model.

  • Grade 1 & 2: These are generally considered minor. A Grade 1 is a non-conformity in a non-critical process, while Grade 2 might be a repeat non-conformity or one in a more significant area.
  • Grade 3: A more serious issue that requires a robust CAPA plan and may trigger a follow-up assessment.
  • Grade 4 & 5: These are critical non-conformities. A Grade 5 NC, for instance, represents a systemic failure that could pose a direct risk to patient safety.

The grading system is calculated using a matrix that considers the impact of the non-conformity on the QMS and whether it is a repeat occurrence. The final grade can be escalated if the manufacturer has a history of similar issues. These grades are shared with all participating RAs, providing a transparent view of the manufacturer's compliance status.

Financial and Operational Considerations

While the benefits of MDSAP are clear, the transition requires a realistic assessment of costs and resources. Organizations should consider the following when deciding to enter the program:

  • Audit Duration: MDSAP audits are typically longer than standard ISO 13485 audits because they must cover the specific regulatory requirements of five different countries. This leads to higher audit fees from the AO.
  • Internal Resource Burden: Preparing for an MDSAP audit requires significant internal coordination. Quality managers must be well-versed in the regulations of all five jurisdictions, not just their local market.
  • Consolidation of Audits: The primary financial benefit comes from the reduction of individual regulatory inspections and second-party audits. For a company selling in all five markets, the cost of one MDSAP audit is significantly lower than the cumulative cost of five separate inspections.

For smaller companies or those only selling in a single market (other than Canada), the investment in MDSAP may not yield an immediate return. It is often more beneficial for mid-to-large sized firms or those with aggressive international expansion plans.

Future Outlook: Affiliate Members and Global Expansion

The reach of MDSAP is extending beyond the original five members. A growing list of "Affiliate Members" and "Official Observers" suggests that the program may eventually become a truly global standard. Countries like Mexico, South Korea, Israel, and Malaysia have joined as affiliate members, meaning they may utilize MDSAP audit reports to varying degrees in their own regulatory processes.

Furthermore, the 2026 MDSAP Forum in Kyoto highlights the ongoing commitment of the International Medical Device Regulators Forum (IMDRF) to refine and expand the program. Future enhancements are likely to focus on increasing audit capacity, leveraging remote auditing technologies, and further harmonizing the reporting requirements for IVD (In-Vitro Diagnostic) products.

Practical Steps for Successful Certification

Preparation is the key to a successful MDSAP outcome. Organizations should start by conducting a gap analysis between their current QMS and the MDSAP Audit Approach (P0002).

  1. Select the Right AO: Not all Auditing Organizations are recognized for MDSAP. Ensure that your chosen partner has the scope and capacity to handle your specific device types and geographic locations.
  2. Training: Invest in comprehensive training for your quality and regulatory teams. They need to understand the "Audit Model" and how to present evidence in a way that aligns with the process-based approach.
  3. Jurisdictional Checklists: Create specific checklists for each of the five countries. Even if you don't currently sell in all five, being "MDSAP-ready" for all jurisdictions makes future market entry much smoother.
  4. Mock Audits: Conduct a mock audit using the same grading system that the AO will use. This helps identify potential Grade 4 or 5 issues before the official auditor arrives on site.

MDSAP represents the future of medical device oversight. By shifting from a fragmented inspection model to a unified, process-driven audit program, it provides a clearer path for manufacturers to ensure their products are safe, effective, and compliant across the world's most significant healthcare markets. Whether as a legal manufacturer or an eligible MDO, embracing MDSAP is a commitment to regulatory excellence and global patient health.