MDSAP in 2026: Revised Audit Approach, TGA Migration, and Post-QMSR Value
A strategic evaluation of MDSAP in 2026: analyzing the February 2026 revised audit approach, the TGA mdsap.global migration, and a post-QMSR ROI decision framework.
Executive Summary & Direct Decision Brief
For decade-long participants in the Medical Device Single Audit Program (MDSAP), 2026 marks a pivotal structural inflection point. On February 2, 2026, the U.S. Food and Drug Administration's Quality Management System Regulation (QMSR) officially took effect, replacing the legacy 21 CFR Part 820 Quality System Regulation (QSR) and explicitly incorporating ISO 13485:2016 by reference.
Simultaneously, the MDSAP Regulatory Authority Council released a major update to the core audit baseline: the Revised MDSAP Audit Approach (MDSAP AU P0002.010), bearing a document revision date of February 6, 2026. This revision eliminates legacy Part 820 section citations, aligns the audit model directly with ISO 13485 and QMSR, incorporates audit criteria for Predetermined Change Control Plans (PCCPs) in artificial intelligence devices, and reflects the program's governance migration to Australia’s Therapeutic Goods Administration (TGA) via mdsap.global.
With FDA inspections now evaluating ISO 13485 compliance directly through QMSR, quality and regulatory leaders face a pressing strategic question: Is maintaining MDSAP certification still worth the substantial Auditing Organization (AO) fees and operational audit burden in 2026?
What this article is — and isn't. This is a go/no-go decision guide: whether to enter or maintain MDSAP now that FDA's QMSR aligns the agency with ISO 13485:2016. For the operational execution of an MDSAP audit once you decide to proceed — the step-by-step preparation checklist, cost detail, and common nonconformities — see our MDSAP Audit Preparation Guide.
Direct Decision Brief
For VP/Director-level Quality Assurance (QA) and Regulatory Affairs (RA) leaders, the operational decision rules are:
- Canada Mandate Remains Absolute: Health Canada requires mandatory MDSAP certification under Section 32 of the Canadian Medical Devices Regulations (CMDR) for all Class II, III, and IV device licenses. If you sell into Canada, MDSAP is non-negotiable.
- High-Value Markets (Brazil, Australia, Japan): MDSAP continues to provide high regulatory return on investment (ROI) for manufacturers targeting ANVISA (Brazil), TGA (Australia), or MHLW/PMDA (Japan). ANVISA accepts MDSAP audit reports to issue Brazilian Good Manufacturing Practice (BGMP) certificates for Class III and IV devices, avoiding multi-year ANVISA inspection backlogs.
- FDA Inspection Substitution: FDA continues to accept MDSAP audit reports in lieu of routine, surveillance-level FDA Quality System inspections. However, MDSAP does not replace FDA pre-approval inspections (PAIs), cause-driven/for-cause inspections, or inspections covering Electronic Product Radiation Control (EPRC) under FD&C Act Chapter V, Subchapter C.
- Zero Value for EU MDR / IVDR Notified Body Audits: MDSAP certificates are not accepted by European Notified Bodies as a substitute for EU MDR (Regulation EU 2017/745) or EU IVDR (Regulation EU 2017/746) quality system audits. Notified Bodies conduct independent EU QMS audits.
- The Post-QMSR ROI Verdict: For manufacturers selling exclusively in the United States and Europe, maintaining MDSAP yields minimal marginal value post-QMSR, as an ISO 13485 audit plus FDA QMSR compliance achieves regulatory baseline coverage without MDSAP AO surcharge fees. For multi-jurisdictional manufacturers active in Canada, Brazil, or Australia, MDSAP remains essential.
What Changed in the February 2026 Revised MDSAP Audit Approach (MDSAP AU P0002.010)?
The release of MDSAP AU P0002.010 (issued February 2, 2026; document revision date February 6, 2026) represents the most significant update to the single-audit methodology since the conclusion of the MDSAP pilot in 2017.
MDSAP AUDIT APPROACH EVOLUTION
==============================
2014 - 2017 2018 - 2025 FEBRUARY 2026
+-------------------+ +-------------------+ +---------------------------+
| MDSAP Pilot | ---> | Legacy Approach | ---> | Revised Audit Approach |
| IMDRF Baseline | | ISO 13485:2016 | | (MDSAP AU P0002.010) |
| Final Report 2017 | | + 21 CFR Part 820 | | Direct QMSR Alignment |
+-------------------+ +-------------------+ | Part 820 Citations Purged |
| PCCP AI Audit Criteria |
| TGA mdsap.global Hosting |
+---------------------------+
1. Complete Removal of Legacy 21 CFR Part 820 Citations
Prior to February 2026, MDSAP auditors evaluated US country-specific requirements using explicit citations from the 1996 Quality System Regulation (e.g., 21 CFR 820.30 for Design Controls, 820.50 for Purchasing Controls, 820.100 for CAPA).
Under MDSAP AU P0002.010:
- All legacy Part 820 clause references have been purged from the audit task checklists.
- Auditors now evaluate US compliance through FDA's QMSR, which incorporates ISO 13485:2016 by reference while enforcing specific US supplemental requirements under 21 CFR Part 820 (as amended), such as 820.10 (clarification of concepts), 820.35 (control of records, including UDI and MDR linkage), and 820.45 (device labeling and packaging controls).
2. Integration of Predetermined Change Control Plans (PCCPs) for AI Devices
Reflecting FDA and international guidance on artificial intelligence and machine learning (AI/ML)-enabled medical software, the revised audit approach adds explicit audit tasks for Predetermined Change Control Plans (PCCPs):
- Auditors evaluate whether the manufacturer's Design and Development process (ISO 13485 Clause 7.3) and Change Management procedures contain authorized PCCP boundaries.
- When an AI/ML device algorithm updates automatically within an approved PCCP envelope, auditors verify that the manufacturer followed documented re-validation, risk management (ISO 14971), and verification protocols without triggering an unauthorized design change.
3. Streamlined Process-Flow Architecture
The core MDSAP audit sequence retains its seven-process structure (Management; Measurement, Analysis and Improvement / CAPA; Design and Development; Production and Process Controls; Purchasing; Device Marketing Authorization and Facility Registration; and Medical Device Reporting), but task linkages between Design Controls, Risk Management (ISO 14971:2019), and Post-Market Surveillance have been tightly unified into a single continuous evidence loop.
Process-by-Process Teardown of the 7 MDSAP Audit Modules (P0002.010)
MDSAP auditors do not audit clause-by-clause in numerical order; they follow a predefined process sequence designed to trace quality decisions through the organization:
Module 1: Management Process (Tasks 1–4)
- Objective: Verify top management commitment, resource provision, quality policy, and management review effectiveness.
- Key Evidence: Management review minutes, quality manual, organizational charts, quality policy communication, and evidence that management reviews customer complaints, audit findings, and regulatory authority correspondence.
Module 2: Device Marketing Authorization and Facility Registration (Tasks 1–4)
- Objective: Ensure the manufacturer has obtained valid marketing authorizations in all jurisdictions where devices are distributed, and that facility registrations are current.
- Key Evidence: FDA Device Registration & Listing records, Health Canada Medical Device Licenses (MDLs), ANVISA BGMP registrations, TGA inclusion certificates, PMDA approvals.
Module 3: Measurement, Analysis and Improvement / CAPA (Tasks 1–16)
- Objective: Audit the central quality engine. Evaluates complaint handling, adverse event reporting, internal audits, non-conforming product control, and CAPA execution.
- Key Evidence: Complaint logs, Root Cause Analysis (RCA) records, CAPA files, trend analysis metrics, health hazard evaluations (HHEs), recall documentation.
Module 4: Medical Device Reporting & Recalls (Tasks 1–4)
- Objective: Verify compliance with mandatory adverse event and advisory notice reporting rules across all 5 participating jurisdictions.
- Key Evidence: US FDA 3500A / eMDR filings (21 CFR Part 803), Health Canada Mandatory Medical Device Problem Reports, ANVISA Tecnovigilância notifications, TGA Incident Reports, PMDA Malfunction Reports.
Module 5: Design and Development (Tasks 1–15)
- Objective: Trace a specific device project from design inputs through design verification, validation, risk management (ISO 14971), software validation (IEC 62304), PCCP boundary controls, and design transfer.
- Key Evidence: Design History File (DHF), Design Traceability Matrix, risk management file, clinical evaluation reports, usability engineering files (IEC 62366).
Module 6: Production and Process Controls (Tasks 1–11)
- Objective: Audit the manufacturing floor, cleanroom environmental controls, equipment calibration, maintenance, software validation, and process validation (IQ/OQ/PQ).
- Key Evidence: Device History Records (DHR), batch production records, environmental monitoring logs, sterilization validation reports (ISO 11135 / ISO 11137), labeling inspection records.
Module 7: Purchasing Controls (Tasks 1–7)
- Objective: Evaluate supplier selection, supplier quality agreements, ongoing supplier monitoring, and incoming receiving inspection.
- Key Evidence: Approved Supplier List (ASL), supplier audit reports, quality agreements, receiving inspection records, Certificate of Analysis (CoA) verification logs.
Clause-by-Clause Audit Task Mapping: ISO 13485 vs MDSAP P0002.010 vs QMSR
To assist quality managers preparing for an MDSAP audit under the 2026 approach, the matrix below maps the primary ISO 13485:2016 clauses to the corresponding MDSAP Audit Tasks and FDA QMSR supplemental requirements:
| ISO 13485:2016 Clause | MDSAP Process & Task (P0002.010) | FDA QMSR Supplemental Requirement | Specific Audit Focus & Evidence Requirements |
|---|---|---|---|
| Clause 4.2 (Documentation) | Device Marketing & Registration (Task 1) | 21 CFR 820.35 (Control of Records) | UDI assignments, Device Master Record / Medical Device File completeness, language requirements. |
| Clause 5.6 (Management Review) | Management Process (Tasks 1–4) | 21 CFR 820.10 (Clarification of Concepts) | Quality policy, resource allocation, review of audit results, regulatory authority communications. |
| Clause 7.3 (Design & Dev) | Design & Development (Tasks 1–15) | ISO 13485 + PCCP Verification | Risk management (ISO 14971 integration), verification/validation, design transfer, PCCP boundary compliance. |
| Clause 7.4 (Purchasing) | Purchasing Process (Tasks 1–7) | ISO 13485 Clause 7.4 (Purchasing) | Supplier evaluation, quality agreements, incoming inspection, critical component traceability. |
| Clause 7.5 (Production Control) | Production & Process Controls (Tasks 1–11) | 21 CFR 820.45 (Labeling/Packaging) | Cleanroom environmental controls, process validation (IQ/OQ/PQ), labeling inspection controls. |
| Clause 8.2.2 (Complaint Handling) | CAPA Process (Tasks 1–8) | 21 CFR 820.35 / 21 CFR 803 (MDR) | Complaint evaluation, MDR escalation timelines (30-day / 5-day), adverse event reporting to foreign authorities. |
| Clause 8.5.2 / 8.5.3 (CAPA) | CAPA Process (Tasks 9–16) | ISO 13485 Clause 8.5.2 | Root cause analysis (RCA), systemic CAPA implementation, post-implementation effectiveness checks. |
TGA Governance Migration and mdsap.global Transition
On December 18, 2025, the FDA Center for Devices and Radiological Health (CDRH) issued an official notice announcing that the governance and central document repository for the Medical Device Single Audit Program had successfully migrated to a dedicated platform managed by Australia’s Therapeutic Goods Administration (TGA) at mdsap.global.
Program Evolution Timeline
Understanding the origin of MDSAP provides essential context for its current governance structure:
| Milestone Date | Governing Body | Program Event / Historical Significance |
|---|---|---|
| 2012 (Singapore) | IMDRF | International Medical Device Regulators Forum (IMDRF) initiates MDSAP working group at inaugural meeting. |
| Jan 1, 2014 – Dec 31, 2016 | RAC (Regulatory Authority Council) | Three-year MDSAP Pilot conducted across participating countries, testing AO audit execution. |
| June 29, 2017 | FDA / IMDRF | Official release of the Final MDSAP Pilot Report, confirming program viability and transition to operational status. |
| January 1, 2019 | Health Canada | Health Canada fully replaces Canadian Medical Devices Conformity Assessment System (CMDCAS) with mandatory MDSAP. |
| December 18, 2025 | TGA / FDA | Document repository and operational administration officially transferred to TGA-managed mdsap.global. |
| February 2, 2026 | RAC / FDA | Revised MDSAP Audit Approach (P0002.010) takes effect concurrently with FDA QMSR enforcement. |
Under TGA operational management, mdsap.global serves as the authoritative source for all MDSAP policies, Auditing Organization recognition documents, country-specific requirement annexes, and audit report forms.
Post-QMSR ROI Decision Framework: Is MDSAP Still Worth It?
To determine whether maintaining or pursuing MDSAP certification makes strategic sense for your organization in 2026, evaluate your commercial footprint against the Post-QMSR Value Decision Matrix:
| Target Market Footprint | MDSAP Regulatory Status | FDA / Authority Inspection Substitution | Annual AO Fee / Audit Burden | 2026 Strategic ROI Verdict |
|---|---|---|---|---|
| Canada (Class II, III, IV) | MANDATORY (CMDR Section 32) | Replaces Health Canada routine inspections | High ($15k–$35k AO fees + audit days) | ESSENTIAL (No Choice): License revoked without MDSAP. |
| Brazil (Class III, IV) | Voluntary / Accepted | Replaces ANVISA BGMP physical inspection | High | HIGH ROI: Avoids 2–4 year ANVISA inspection backlog. |
| Australia (Class IIa, IIb, III) | Voluntary / Accepted | Accepts MDSAP for TGA Conformity Assessment | High | HIGH ROI: Accelerates TGA market inclusion. |
| Japan (Class II, III, IV) | Voluntary / Accepted | Reduces off-site document submission to MHLW/PMDA | High | MODERATE/HIGH ROI: Streamlines QMS compliance. |
| United States Only | Voluntary | Substitutes for routine FDA QS inspections (not PAIs/EPRC) | High | LOW/MODERATE ROI: FDA QMSR now covers ISO 13485 natively. |
| United States + Europe Only | Voluntary | Replaces routine FDA QS inspection; NO EU MDR recognition | High | LOW ROI: Must pay Notified Body for EU MDR audit regardless. |
POST-QMSR DECISION TREE
=======================
Do you sell Class II/III/IV devices in Canada?
/ \
YES / \ NO
v v
+-------------------+ Do you sell in Brazil,
| MUST MAINTAIN | Australia, or Japan?
| MDSAP (MDR s.32) | / \
+-------------------+ YES / \ NO
v v
+-----------------+ Are you US + EU
| HIGH ROI | Market Only?
| Maintain MDSAP | |
+-----------------+ v
+-------------------+
| LOW MARGINAL ROI |
| Consider drop to |
| ISO 13485 + QMSR |
+-------------------+
Detailed Market-by-Market Breakdown
- Health Canada: Section 32 of the Canadian Medical Devices Regulations makes MDSAP mandatory. Dropping MDSAP results in the immediate suspension of Canadian Medical Device Licenses (MDLs) for Class II, III, and IV products.
- ANVISA (Brazil): Brazil’s Resolution RDC 687/2022 and subsequent updates permit ANVISA to issue BGMP certificates based on MDSAP audit reports. Because ANVISA direct overseas inspection wait times historically stretched to roughly 2-4 years (24-42 months), MDSAP represents a dramatic commercial acceleration.
- Australia (TGA): TGA accepts MDSAP audit reports as evidence of compliance when applying for a TGA Conformity Assessment Certificate or market inclusion under the Therapeutic Goods Act 1989.
- Japan (MHLW / PMDA): Under Ministerial Ordinance No. 169, Japan’s PMDA uses MDSAP audit reports to exempt manufacturers from significant portions of off-site document submission during periodic QMS inspection renewals.
- US FDA: FDA accepts MDSAP reports to satisfy routine QS surveillance inspections under Section 510(k), PMA, or De Novo post-market oversight. However, under the FD&C Act, FDA retains full statutory authority to conduct for-cause inspections, pre-approval inspections (PAIs), and inspections covering Electronic Product Radiation Control (EPRC) under 21 CFR Parts 1000–1050.
- European Union (EU MDR / IVDR): Zero Recognition. European Notified Bodies (such as TÜV SÜD, BSI, DEKRA) operate under European Commission designation and cannot accept MDSAP reports to grant EU MDR or IVDR Quality Management System certificates. Manufacturers exporting to Europe must undergo separate annual Notified Body audits.
ANVISA Brazil BGMP Bypass vs Direct Inspection Teardown
For medtech companies expanding into South America's largest healthcare market, understanding the interaction between MDSAP and ANVISA's Brazilian Good Manufacturing Practice (BGMP / CBPF) certification is vital:
ANVISA BGMP Certification Paths for Class III/IV Devices:
Path A: Direct ANVISA Inspection
Submit BGMP Application ---> Wait for ANVISA Inspection Slot (24-42 Months) ---> Physical Audit ---> BGMP Granted
(High Cost: ~$25,000 ANVISA inspection fee + inspector travel costs + multi-year market delay)
Path B: MDSAP Audit Report Submission
Complete Annual MDSAP Audit ---> Submit Audit Report + Form to ANVISA ---> Desk Review (60-120 Days) ---> BGMP Granted
(Fast Track: Saves 2-3 years of lost commercial revenue in Brazil)
By leveraging MDSAP, medical device manufacturers eliminate ANVISA's overseas inspection queue, achieving commercial authorization in Brazil in months rather than years.
Financial Cost Teardown: MDSAP AO Fees and Annual Audit Surcharges
Maintaining MDSAP certification incurs direct financial costs paid to recognized Auditing Organizations (such as BSI, TÜV SÜD, DEKRA, SGS, DNV, or NSAI):
| Fee Component | Estimated Cost Range (USD) | Cost Drivers & Factors |
|---|---|---|
| Initial Certification AO Fee | $25,000 – $55,000 | Number of manufacturing sites, headcount, device risk class. |
| Annual Surveillance AO Fee | $15,000 – $35,000 | Scope duration (typically 3–6 auditor days per site). |
| MDSAP Regulatory Authority Surcharge | $2,500 – $6,000 | Administrative fee levied per participating country scope. |
| Auditor Travel & Expenses | $3,000 – $10,000 | On-site auditor travel, lodging, per diem expenses. |
| Internal QMS Maintenance Burden | ~150–400 Resource Hours | Internal audit prep, country annex maintenance, document updates. |
For single-market or dual-market (US + EU) firms, spending $25,000+ annually on MDSAP AO surcharges post-QMSR provides low financial return. For multi-jurisdictional firms selling in Canada and Brazil, the cost is easily offset by avoided revenue loss and eliminated inspection fees.
Regulator Participation & UK MHRA Status (2026)
As of 2026, five international regulatory authorities maintain full participating membership in the MDSAP Regulatory Authority Council (RAC):
- U.S. Food and Drug Administration (FDA) — United States
- Health Canada — Canada
- Therapeutic Goods Administration (TGA) — Australia
- Agência Nacional de Vigilância Sanitária (ANVISA) — Brazil
- Ministry of Health, Labour and Welfare (MHLW) / Pharmaceuticals and Medical Devices Agency (PMDA) — Japan
UK MHRA Expansion Horizon
A critical development monitored at the 2026 MDSAP Forum in Kyoto, Japan, is the trajectory of the United Kingdom’s Medicines and Healthcare products Regulatory Agency (MHRA):
- Following its post-Brexit regulatory restructuring, MHRA participated in MDSAP RAC meetings as an Official Observer.
- MHRA has initiated formal steps toward full MDSAP membership, seeking to accept MDSAP audit reports as evidence for UKCA marking quality system compliance.
- Once finalized, MHRA inclusion will significantly increase the ROI of MDSAP for European and global manufacturers targeting the UK market.
Practical Audit Execution Under the 2026 Revised Approach
For organizations maintaining MDSAP, managing audit execution under MDSAP AU P0002.010 requires strict adherence to the GHTF/SG3/N19 Non-Conformity Grading System.
MDSAP NON-CONFORMITY GRADING MATRIX
====================================
Non-Conformity Step 1: Initial Score (1 to 4)
---------------------------------------------
Occurrence / Impact | Indirect QMS Impact | Direct QMS Impact
--------------------------+---------------------+------------------
First Occurrence | Grade 1 | Grade 3
Repeat Non-Conformity | Grade 2 | Grade 4
Step 2: Escalation Rules (+1 Modifiers)
---------------------------------------
+ Add 1 point if the non-conformity combines the ABSENCE of a documented
procedure WITH a failure to implement it.
+ Add 1 point if the non-conformity resulted in the RELEASE of a
nonconforming medical device to the market.
Step 3: Final Grade Action Thresholds (Grade Capped at 5)
-------------------------------------
Grade 1 - 4: Corrective Action Plan due to the AO (30-day window).
Grade 5: Critical Non-Conformity (Triggers 5-Day AO Escalation to Regulators).
Critical Audit Thresholds & Regulatory Reporting Rules
- Grade 5 Non-Conformities: Any non-conformity resulting in a final grade of 5 (grades of 6 are recorded as 5) triggers a mandatory 5-calendar-day notification by the Auditing Organization to all participating regulatory authorities.
- 30-Day Corrective Action Window: The manufacturer has exactly 30 calendar days from the close of the audit to submit a complete Root Cause Analysis (RCA), Correction, and Corrective Action Plan (CAPA) to the AO.
- Audit Annulment Risk: Failure to respond with an acceptable CAPA within 30 days, or accumulation of unaddressed Grade 4/5 findings, results in AO suspension or revocation of the MDSAP certificate, triggering immediate regulatory notification to Health Canada, FDA, ANVISA, TGA, and PMDA.
5-Day Grade 5 Non-Conformity Escalation & CAPA Response Workflow
When an Auditing Organization issues a Grade 4 or Grade 5 non-conformity during an MDSAP audit, the QA leadership team must execute an immediate crisis-response protocol:
[Day 0: Audit Closing Meeting]
│
├── Auditor issues Grade 4 or Grade 5 Non-Conformity (NC) Form.
└── 5-Day Regulatory Clock is initiated by the Auditing Organization (AO).
│
[Days 1–3: Immediate Containment & AO Escalation]
│
├── Issue internal Quality Hold on affected product lots / device software builds.
├── Conduct immediate containment review (quarantine inventory, review field risk).
└── AO transmits Non-Conformity Report to FDA, Health Canada, ANVISA, TGA, PMDA.
│
[Days 4–15: Root Cause Analysis (RCA) & CAPA Drafting]
│
├── Convene multidisciplinary CAPA team (Quality, Regulatory, Engineering, Manufacturing).
├── Execute formal RCA methodology (5-Whys, Fishbone / Ishikawa Diagram, Fault Tree Analysis).
└── Draft systemic CAPA plan with concrete milestone completion dates.
│
[Days 16–28: CAPA Package Submission to AO]
│
├── Compile formal MDSAP Response Package:
│ - Immediate Corrections executed.
│ - Documented Root Cause Statement.
│ - Systemic CAPA Plan & Action Items.
│ - Objective evidence of containment.
│ - Plan for Effectiveness Check.
└── Submit formal response to AO auditor prior to Day 30 deadline.
│
[Day 30+: AO Review & Regulatory Resolution]
│
├── AO evaluates CAPA package for acceptability.
└── Upon AO acceptance, notification sent to Regulatory Authorities clearing escalation.
The 3-Year Audit Cycle: Recertification vs Surveillance
MDSAP operates on a continuous 3-year audit cycle managed by the recognized Auditing Organization:
- Initial Certification Audit (Year 0): Comprises a Stage 1 audit (documentation and facility readiness review) and a Stage 2 audit (on-site evaluation of all seven MDSAP processes and country-specific requirements).
- Surveillance Audit 1 (Year 1): Conducted approximately 12 months after initial certification. Focuses on Management, CAPA, Purchasing, and selected Production controls, plus any new regulatory registrations or product changes.
- Surveillance Audit 2 (Year 2): Conducted approximately 24 months after initial certification. Re-evaluates CAPA, Design Controls, Device Marketing Authorization, and medical device reporting across all participating jurisdictions.
- Recertification Audit (Year 3): Conducted prior to the expiration of the 3-year MDSAP certificate. Represents a complete re-audit of all seven MDSAP processes, equivalent in depth to a Stage 2 initial audit.
Frequently Asked Questions (FAQs)
Does QMSR make MDSAP obsolete?
No. While FDA’s QMSR aligns US regulations with ISO 13485:2016, QMSR is a domestic US regulation enforced by FDA inspectors. It does not provide regulatory clearance or inspection substitution in Canada, Brazil, Australia, or Japan. MDSAP remains mandatory for Canada and essential for streamlined access in ANVISA, TGA, and PMDA jurisdictions.
Which five regulators currently participate in MDSAP?
The five participating regulatory authorities are the US FDA, Health Canada, Australia TGA, Brazil ANVISA, and Japan MHLW/PMDA. The UK MHRA currently holds observer status with active progress toward full participation.
Where are MDSAP documents now hosted?
Following the December 18, 2025 administrative transfer, all official MDSAP documents, audit approaches, AO listings, and regulatory announcements are hosted on the TGA-managed portal at mdsap.global.
Does an MDSAP audit replace a routine FDA inspection?
Yes. FDA accepts an operational MDSAP audit report in lieu of a routine, surveillance-level FDA Quality System inspection. However, MDSAP does not replace pre-approval inspections (PAIs), for-cause enforcement inspections, or inspections covering Electronic Product Radiation Control (EPRC) under 21 CFR Parts 1000–1050.
What is the difference between an MDSAP audit and an EU MDR Notified Body audit?
MDSAP audits evaluate compliance against ISO 13485:2016 and specific country regulations of the 5 participating authorities (US, Canada, Australia, Brazil, Japan). EU Notified Body audits evaluate compliance against ISO 13485:2016 and specific European regulations (EU MDR 2017/745 or EU IVDR 2017/746), including Annex IX or XI quality management system requirements. Notified Bodies do not accept MDSAP reports in place of EU MDR audits.
Can a manufacturer transfer an MDSAP certificate between Auditing Organizations?
Yes. Under MDSAP policy (MDSAP AU P0009), a manufacturer may transfer its MDSAP certificate from one recognized Auditing Organization to another. The receiving AO must conduct a pre-transfer review of past audit reports, open non-conformities, and CAPA status before issuing a replacement certificate.
Quality & Regulatory Leadership Action Checklist
QA/RA leadership should execute this evaluation checklist for 2026:
- Market Footprint Mapped: Verified revenue contribution across Canada, Brazil, Australia, Japan, US, and EU.
- MDSAP AU P0002.010 Gap Audit Conducted: Updated internal audit procedures to reflect the February 2026 revised audit approach and purged legacy Part 820 citations.
- PCCP Procedure Integrated: Ensured AI/ML software change control procedures incorporate Predetermined Change Control Plan audit criteria.
- AO Fee vs Market Value Audited: Calculated annual AO audit fees against commercial margins in MDSAP-dependent markets.
- mdsap.global Reference Updated: Updated document management links to point to the official TGA
mdsap.globalrepository.
Related Guides & Resources
- MDSAP Audit Preparation Guide — Operational checklists, non-conformity grading rules, and audit execution.
- QSR to QMSR Transition Guide — Navigating FDA's alignment of 21 CFR Part 820 with ISO 13485:2016.
- ISO 13485 Certification Guide — Core quality management system requirements for medical device manufacturers.