MDSAP Certification: One Audit for Five Medical Device Markets

What Our MDSAP Certification and Audit Support Covers

Every project is scoped to your devices, your sites and the MDSAP countries you sell in. Most clients use a mix of the services below.

What Is MDSAP?

MDSAP is a program run by medical device regulators to share one audit of a manufacturer's quality management system. Instead of separate inspections or audits for each country, an MDSAP-recognised Auditing Organization (AO) audits the manufacturer once. That audit covers ISO 13485:2016 and the extra QMS requirements of each participating regulator.

The audit report is shared with the regulators in the countries where you sell. Each regulator then uses it in its own way, for example to replace routine inspections, to support a licence or to reduce its own document review.

MDSAP is not a separate standard. It is an audit program built on ISO 13485, so a well-run ISO 13485 system is the starting point. Your existing ISO 13485 system needs to be extended to cover the country-specific requirements the MDSAP auditor will check.

Regulators Participating in MDSAP

Five regulators are full members and use MDSAP audit reports in their regulatory work.

The program also has official observers (the European Union, Singapore's HSA, the UK MHRA and the WHO Prequalification of IVDs Programme) and affiliate members (Argentina's ANMAT, Israel's Ministry of Health, Kenya's Pharmacy and Poisons Board, Korea's MFDS, Mexico's COFEPRIS, South Africa's SAHPRA and Taiwan's TFDA). An MDSAP audit does not replace EU MDR or IVDR notified body audits, so manufacturers selling in Europe still need CE marking.

Participant list as published by the US FDA, December 2025. Official source: FDA – Medical Device Single Audit Program (MDSAP).

Who Should Consider MDSAP?

MDSAP makes the most sense for manufacturers selling, or planning to sell, in more than one of the participating countries. Our MDSAP consulting clients include:

• Manufacturers that need a Health Canada medical device licence for Class II, III or IV devices, where MDSAP is mandatory
• US manufacturers who want routine FDA inspections replaced by a scheduled MDSAP audit
• Companies entering Brazil, Japan or Australia that want to avoid separate QMS inspections
• ISO 13485-certified manufacturers ready to move from an ISO 13485 certificate to an MDSAP certificate
• Contract manufacturers whose customers sell in MDSAP countries
• IVD and software as a medical device (SaMD) companies planning multi-country launches

MDSAP, ISO 13485 and the FDA QMSR

The FDA's Quality Management System Regulation (QMSR) took effect on 2 February 2026 and incorporates ISO 13485:2016 by reference. On the same date the MDSAP Audit Approach was revised. It now treats ISO 13485 as the base structure for MDSAP audits and removes the references to the old Quality System Regulation.

US-specific requirements under 21 CFR Part 820 and related rules still apply in targeted areas, including:

• Document and record controls
• Marketing authorisation and establishment registration
• Complaint handling and post-market surveillance
• Medical device reporting and corrections and removals
• Design and development controls
• Production, servicing and traceability records

Auditors now expect these requirements to sit inside your ISO 13485 processes, not in a separate FDA system. If your procedures were written for the old QSR, they usually need updating before an MDSAP audit. See our ISO 13485 consulting page for the QMS work behind this, and our FDA QMSR consulting page for the US-specific requirements.

The MDSAP Audit Model: Seven Processes

MDSAP auditors follow a set audit sequence across seven processes. Each process is audited against ISO 13485 and the matching country requirements.

Management, measurement and improvement, design and development, and production are the primary processes. Purchasing, marketing authorisation and registration, and adverse event reporting are supporting processes that auditors link back to them.

The MDSAP Audit Cycle

MDSAP certification runs on a three-year cycle, carried out by a recognised Auditing Organization.

Regulators or the AO can also call special audits, and unannounced audits are possible. Audit duration is set by the MDSAP audit time procedure, based on your sites, number of employees, device risk class and activities in scope.

How MDSAP Nonconformities Are Graded

MDSAP does not use the simple major and minor split of a typical ISO 13485 audit. Each nonconformity is graded from 1 to 5 using a matrix based on the GHTF/IMDRF grading method. The grade depends on whether the finding affects the QMS directly or indirectly, and whether it has been seen before.

Higher-grade findings are escalated to the participating regulators, and manufacturers have to submit a remediation plan within a short, fixed deadline. Repeated or high-grade findings can lead to extra audits or regulatory action in the MDSAP countries. Our mock audits use the same grading, so you know where you stand before the real audit.

Our MDSAP Audit Preparation Process

1. Scoping call. We confirm your devices, sites, activities and the MDSAP countries you sell in or plan to enter.
2. Gap analysis. We assess your QMS against ISO 13485 and each country's requirements and give you a written gap report.
3. Gap closure. We help update procedures and work with your process owners to close each gap and generate records.
4. Training. We brief management and staff on the MDSAP audit model and country-specific requirements.
5. Mock MDSAP audit. We audit the full system following the MDSAP audit sequence and grade the findings.
6. Auditing Organization selection. We help you compare MDSAP-recognised AOs and plan the audit dates.
7. Audit support. We help you prepare for the initial audit and respond to any nonconformities on time.

MDSAP Gap Analysis

For most clients the project starts with a gap analysis. Our consultants follow the MDSAP audit model process by process. We check your procedures, records and objective evidence against ISO 13485:2016 and the added requirements of each country you sell in.

We pay particular attention to the areas where ISO 13485 alone is not enough: country registrations, adverse event and recall reporting timelines, labelling, control of critical suppliers and record retention. You receive a written report listing each gap, the evidence reviewed, the likely MDSAP grade and the action needed to close it.

Choosing an MDSAP Auditing Organization

Only Auditing Organizations recognised by the MDSAP regulators can carry out MDSAP audits, and the list is published on the official MDSAP website. When comparing AOs, check their scope for your device types, auditor availability in your region and whether they can also cover your EU MDR, IVDR or UKCA audits.

If you already hold an ISO 13485 certificate, your current certification body may be able to convert it to MDSAP, which can save time. We are independent of Auditing Organizations. We help you compare quotes, but we never audit the systems we build.

How Long Does MDSAP Certification Take?

The timeline depends mostly on how mature your ISO 13485 system already is. A typical plan for a manufacturer with an existing ISO 13485 system looks like this:

Companies starting without an ISO 13485 system should plan for a longer project, usually 9 to 15 months, because the QMS has to be built and running first.

MDSAP Certification Cost: What Affects It

The total cost has two parts: the Auditing Organization's audit fees and the consulting fees.

MDSAP Consulting Fees

Our MDSAP consulting fees are published below. They apply to manufacturers worldwide.

Travel and accommodation are charged extra, and taxes apply as per government rules. Onsite consultants travel from our offices in India, the USA and the UK, and much of the gap closure work can be done remotely. Contact us for a fixed quote based on your sites and scope.

Common MDSAP Audit Findings We Help You Avoid

• Procedures that cover ISO 13485 but miss country-specific reporting timelines
• Device licences, registrations or listings not kept up to date in every MDSAP country
• Complaints not assessed for reportability in each market where the device is sold
• Weak controls over critical suppliers and outsourced processes
• Design changes made without assessing their regulatory impact in each country
• CAPA records with no root cause analysis or effectiveness check
• Labelling that does not meet the requirements of all countries in scope
• FDA requirements kept in a separate system from the ISO 13485 QMS

Benefits of MDSAP Certification

• Fewer audits. One audit program in place of separate inspections by five regulators.
• Planned audits. Routine FDA inspections are replaced by scheduled MDSAP audits.
• Faster market access. Shorter waits for QMS inspections in Brazil and Japan.
• Required for Canada. Needed to keep Class II, III and IV Health Canada licences.
• One system. A single ISO 13485-based QMS that covers several regulators.

MDSAP audits are longer and stricter than standard ISO 13485 audits, and the audit fees are higher. For a manufacturer selling in only one of the five countries, a plain ISO 13485 certificate may be enough. We will tell you honestly which route fits your markets.

Why Choose MedDeviceCorp for MDSAP Consulting?

• Consultants trained on the MDSAP audit model, with ISO 13485:2016 lead auditor qualifications
• Focused only on medical device and IVD companies
• Published fees and fixed quotes
• Offices in India, the USA and the UK, with remote support worldwide
• One team for ISO 13485, CE marking, FDA 510k submissions and country representation
• Full addresses and contact details on our Contact page

MDSAP Consulting FAQs