MDSAP Certificate Mandatory for Canadian Device Licences

1. Key takeaways

Since 1 January 2019, Canada has recognised the Medical Device Single Audit Program (MDSAP) in place of the former Canadian Medical Devices Conformity Assessment System (CMDCAS) as its accepted quality management system audit programme. Manufacturers of Class II, III and IV devices must hold a valid MDSAP certificate whose audit scope includes Canada in order to obtain or maintain a Medical Device Licence. A standalone ISO 13485 certificate does not constitute quality system evidence for Canada. This single point shapes the sequencing of an entire Canadian market entry project: the audit programme must be secured before, or in parallel with, the licence application itself, because the application will not succeed without it.

• MDSAP replaced CMDCAS as the recognised quality system audit programme for Canada from 1 January 2019.
• Class II, III and IV manufacturers need a valid MDSAP certificate with Canada in the audit scope to obtain or maintain an MDL.
• An ISO 13485 certificate alone is not Canadian quality system evidence.
• MDSAP is built on ISO 13485:2016 and adds jurisdiction-specific requirements, including the Canadian ones.
• Audits are conducted by recognised Auditing Organizations on a three-year certification cycle (practical estimate).

2. Legal basis

The regulatory sources for this article combine the official MDSAP programme information, the licence application provisions of the Medical Devices Regulations, and items identified as industry compilation. The official items were verified in 2026 against the MDSAP programme pages and Justice Laws; the industry compilation items are marked as practical estimates and should be read with the note at the end of this article in mind.

3. Expert insights

Insight 1: MDSAP is one audit serving five jurisdictions, not a certification for one country.

According to the official MDSAP page, the participating regulatory authorities are five: the Therapeutic Goods Administration (TGA) of Australia, the Brazilian Health Regulatory Agency (ANVISA), Health Canada, Japan’s Pharmaceuticals and Medical Devices Agency (PMDA) together with the Ministry of Health, Labour and Welfare (MHLW), and the United States Food and Drug Administration (FDA). A single audit conducted under the programme can serve the quality system needs of several of these jurisdictions at once, which is precisely where its cost value lies. For a manufacturer planning entry into more than one of these markets, the same audit effort that satisfies Canada can be leveraged for the others. Understanding MDSAP as a multi-jurisdiction instrument, rather than a purely Canadian certificate, changes how the audit is planned and how much value the organisation extracts from it.

Insight 2: the underlying standard is ISO 13485:2016, but the audit coverage goes beyond it (practical estimate).

According to industry compilation, the MDSAP audit is based on ISO 13485:2016 while adding the jurisdiction-specific regulatory requirements of each participating country. On the Canadian side these include mandatory problem reporting, recall procedures and execution capability, distribution records and traceability, labelling requirements (English and French bilingual), post-market requirements, design controls and risk management. These Canadian-specific tasks are set out in the Canadian Companion Document of the MDSAP programme. The practical consequence is that an organisation whose quality system satisfies ISO 13485 alone is not yet audit-ready for Canada: the additional tasks must be reflected in documented procedures, records and trained personnel before the audit takes place, because the auditor will test them as part of the Canadian task set rather than as optional extras.

Insight 3: the audit must be performed by a recognised Auditing Organization.

MDSAP audits may only be carried out by an Auditing Organization (AO) recognised under the programme. The list of recognised organisations changes over time; according to the official MDSAP page, in 2026 on 24 April the programme accepted applications from two additional AOs. When selecting an AO, a manufacturer should confirm the organisation’s current recognition status and its capability to cover the company’s region and device type. Requesting proof of MDSAP qualification and checking the current recognised list before contracting avoids the situation of an audit performed by an organisation that cannot issue a usable certificate.

Insight 4: the audit runs on a three-year cycle (practical estimate).

According to industry compilation, MDSAP follows a three-year certification cycle: in year zero, a Stage 1 document review and a Stage 2 full on-site audit; in year one and year two, one surveillance audit each, covering part of the system processes; and in year three, a full recertification audit. Planning should follow this rhythm so that the certificate does not lapse. A gap between certificate cycles can affect the validity basis of the MDL, so recertification dates should be entered into the organisation’s compliance calendar well in advance and treated with the same discipline as licence renewal dates.

4. Practical recommendations

• Treat this as the first gate of the Canadian project: companies holding only an ISO 13485 certificate should schedule MDSAP certification before, or in parallel with, the MDL application.
• Confirm the AO’s current recognition status and coverage, and request documentation of its MDSAP qualification.
• Explicitly require that the certificate’s audit scope includes Canada, and re-check after every audit that the scope has not been reduced.
• Prepare evidence item by item for the Canadian-specific tasks: problem reporting, recalls, distribution records, bilingual labelling, post-market requirements, design controls and risk management.
• Plan recertification on the three-year cycle so that a certificate gap does not affect MDL validity.

5. Verification checklist

• □ A valid MDSAP certificate is held, not merely an ISO 13485 certificate.
• □ The certificate’s audit scope includes Canada.
• □ The issuing AO is on the current list of recognised Auditing Organizations.
• □ Evidence for the Canadian-specific tasks (problem reporting, recalls, distribution records, bilingual labelling, post-market, design controls, risk management) is complete.
• □ Recertification is scheduled on the three-year cycle.
• □ The certificate validity covers the MDL application and review period.

Regulatory information verified as of October 28, 2026.

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support for the Canadian market. Our team manages Health Canada Medical Device Licence and MDEL applications, prepares risk-classified dossiers, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com