MDSAP

Medical Device Single Audit Program

Dr.-Ing. Benedikt JannySenior Usability Engineer | Managing Partner
Last updated: October 2026
Short definition

The MDSAP (Medical Device Single Audit Program) is a program developed by the IMDRF (International Medical Device Regulators Forum) in which a recognized auditing organization examines a manufacturer's quality management system in a single audit. The audit covers the requirements of all participating regulatory authorities. It does not replace marketing authorization.

On this page

Definition and idea

The Medical Device Single Audit Program (MDSAP) is a program in which an auditing organization recognized by the participating authorities carries out a single regulatory audit at a manufacturer. This audit is intended to cover the requirements of all participating regulatory authorities. The program was developed by the International Medical Device Regulators Forum (IMDRF) and piloted from 2014 to 2016 (FDA program page). The rationale of the US final rule on the QMSR (Quality Management System Regulation) gives 2012 as the start of development.

The subject of the audit is the manufacturer's quality management system, not an individual product. According to the FDA's rationale, the basis is the core requirements of ISO 13485 (ISO 13485 (Quality Management System for Medical Devices)) plus country-specific requirements. According to Health Canada, the program introduces no new quality management requirements beyond ISO 13485 and the regulations of the participants.

Participating regulatory authorities (as of October 2026)

The FDA program page distinguishes three groups. It was read on October 10, 2026.

  • Members: the Australian Therapeutic Goods Administration (TGA), the Brazilian ANVISA, Health Canada, the Japanese Ministry of Health, Labour and Welfare (MHLW) together with the agency PMDA, and the US FDA.
  • Official observers: the European Union, Singapore's Health Sciences Authority, the British MHRA, and the WHO Prequalification program for in vitro diagnostics.
  • Affiliate members: bodies from Argentina, Israel, Kenya, South Korea, Mexico, South Africa, and Taiwan.

For the European Union, therefore, observer status applies, not membership. For the relationship to the United Kingdom, the term UKCA Marking and MHRA (United Kingdom) covers the approval rules there. The list of participants can change and should be checked on the FDA program page before a market decision.

Auditing organizations and process

The audits are carried out by third-party organizations that take part in the program and have received the status "authorized" or "recognized" after a prescribed assessment by the participating authorities (rationale of the QMSR final rule). In the Canadian Medical Devices Regulations, such an organization is called a registrar. Health Canada describes a four-year cycle for their recognition, with an initial assessment and annual surveillance assessments. The final decision is made by the Regulatory Authority Council.

The Audit Approach (in the version read, MDSAP AU P0002.009 of August 6, 2024) divides the audit into seven processes: management; device marketing authorization and facility registration; measurement, analysis, and improvement; medical device adverse events and advisory notices reporting; design and development; production and service controls; and purchasing. Each task refers to the relevant clauses of ISO 13485 and to regulations of the members, including the Canadian Medical Devices Regulations and 21 CFR 820.

The audit cycle covers three years: an initial audit in two stages, surveillance audits in the two following years, and a recertification in the third year. Not all participating authorities require or use certificates.

Relationship to the quality management standard and to the QMSR

Since February 2, 2026 (as of October 2026), the Quality Management System Regulation (QMSR, 21 CFR Part 820) has replaced the former Quality System Regulation in the United States. It incorporates ISO 13485:2016 by reference and requires in 21 CFR 820.10 that a quality management system be documented that meets the applicable requirements of the standard. The term QMSR and Design Controls (21 CFR Part 820) covers the regulation in detail.

In the rationale of the final rule, the FDA states that this incorporation does not conflict with MDSAP, because the program itself uses ISO 13485 as its core. What matters in practice is the role of the certificate: according to the FDA, it uses the audit reports, not the certificate. It may accept an MDSAP report in place of a routine inspection. An ISO 13485 certificate issued outside MDSAP, by contrast, does not replace FDA processes. The FDA does not require manufacturers to obtain ISO 13485 certification, and participation in MDSAP is voluntary for FDA-regulated manufacturers.

What MDSAP does not replace

MDSAP is an audit of the quality management system. It replaces neither an approval nor a marketing authorization. The Audit Approach even contains a separate task that confirms that the organization has obtained the clearance or approval required in each target market. For the United States, the agency's own procedures remain in place, such as 510(k) (Premarket Notification) or PMA (Premarket Approval). According to the FDA page, FDA inspections also remain possible for electronic radiation-emitting products.

In Canada, by contrast, MDSAP has a direct effect on approval: the quality management system certificate required under the Medical Devices Regulations must come from an MDSAP-recognized auditing organization, as the term Health Canada Medical Device Licence describes.

In the EU, conformity assessment under the MDR (Regulation (EU) 2017/745) runs through a notified body (a conformity assessment body designated by an EU member state). As reference regulations, the Audit Approach names those of the five members, not the European regulation. It follows that an MDSAP audit does not replace the EU procedure. This is an inference from observer status and the Audit Approach, not an explicit statement by an authority. Combination products (Combination Product) were outside the scope of MDSAP according to the rationale of the QMSR final rule of February 2, 2024.

Human factors in the MDSAP audit

MDSAP does not examine a human factors program as such. The connection arises through the design and development process, which mentions human factors in several places in the version of the Audit Approach read. For design inputs (Design input / design output), the auditors are to verify that these also cover requirements arising from human factors questions. Among the examples of aspects to be examined are the intended user and human factors.

For design validation (Validation), the audit is to check whether the predefined user needs and intended uses have been confirmed. This includes packaging and labeling. The Audit Approach states that these results have human factors implications. As an example of the content of the technical documentation (the documentation file required in the EU), it lists a human factors analysis.

The word usability and the standard IEC 62366-1 do not appear in this version (own full-text search, therefore an own inference). In practice this means: an MDSAP audit expects a traceable development process with documented inputs, risk management (Risk management (ISO 14971)), and validation. The program does not prescribe which method the human factors evidence uses. The FDA's expectations for human factors validation (Human factors validation testing) follow from the FDA guidance, not from MDSAP.

In brief

The MDSAP (Medical Device Single Audit Program) is a program developed by the IMDRF. A recognized auditing organization examines a manufacturer's quality management system in a single audit, based on ISO 13485 and the country-specific requirements of the participating authorities.

Members are Australia, Brazil, Canada, Japan, and the United States. The EU, Singapore, the United Kingdom, and the WHO program for in vitro diagnostics are observers (as of October 2026). MDSAP does not replace an approval or marketing authorization, but in Canada it is a prerequisite for licenses from Class II upward.

Human factors appear in the audit through the design and development process: in design inputs, risk management, and design validation. MDSAP does not prescribe a method or standard for the evidence.

Frequently asked questions (FAQ)

Is MDSAP mandatory?

For manufacturers regulated by the FDA, participation is voluntary according to the rationale of the QMSR final rule. In Canada, by contrast, the quality management system certificate for devices from Class II upward must come from an MDSAP-recognized auditing organization.

Is an MDSAP certificate valid in the EU?

The EU is an official observer but not a member, and the Audit Approach names no EU regulation as a reference. Conformity assessment under the MDR runs through a notified body. It follows that MDSAP does not replace it (an inference, not a statement by an authority).

Does MDSAP replace an FDA inspection?

The FDA may accept MDSAP audit reports in place of routine inspections but is not required to. It uses the report, not the certificate. For certain products, such as electronic radiation-emitting products, FDA inspections remain possible.

Does MDSAP examine the usability of a product?

Not directly. The audit examines the quality management system. Human factors come up in design inputs, risk management, and design validation. A usability study is not described as a separate requirement.

Who conducts the audits?

Auditing organizations that have received the status authorized or recognized after an assessment by the participating authorities.

Are you preparing for an MDSAP audit or an approval in several markets? We help you build the human factors evidence in your development documentation so that it is traceable.

More about our usability engineering

Sources

Related terms

← Back to the wiki overview