ISO 13485 and the Canadian Scope of MDSAP Audits

1. Key takeaways

ISO 13485:2016 is the quality system foundation on which the MDSAP audit is built, but the audit tasks on the Canadian side extend beyond ISO 13485. According to industry compilation, the Canadian-specific requirements are set out in the Canadian Companion Document of the MDSAP programme and include mandatory problem reporting, recall procedures and execution capability, distribution records and traceability, labelling requirements (English and French bilingual), post-market requirements, design controls and risk management. In practical terms, this means that a quality manual and procedure set which satisfies ISO 13485 on its own terms is a starting point, not a finish line: the Canadian obligations live in the Medical Devices Regulations, and the audited system must demonstrably produce the evidence those provisions demand.

• ISO 13485:2016 underpins the MDSAP audit but does not exhaust its Canadian content.
• Canadian-specific audit tasks are defined in the MDSAP Canadian Companion Document (practical estimate).
• Regulation sections 21 to 23, 52, 57, 58, 59 to 61 and 63.2, 64, 65 map onto these audit tasks.
• From 2026-12-14, documented procedures become an express regulatory obligation under SOR/2026-110.
• Bilingual labelling, design controls and risk management are fixed audit focus points on the Canadian task list.

2. Legal basis

The table below gathers the sources used in this article. The Medical Devices Regulations provisions were verified against Justice Laws; the amendment introducing the documented-procedure obligations was verified against the Canada Gazette; the MDSAP programme information was verified against the official programme page. Items drawn from industry compilation are identified as practical estimates.

3. Expert insights

Insight 1: ISO 13485 clauses and Canadian Regulation clauses stand in a mapping relationship, not an equivalence relationship.

ISO 13485:2016 covers the general requirements of a quality management system; the specific clauses of the Medical Devices Regulations — for example the 10-day and 30-day reporting in sections 59 to 61 and the 24-hour notification in section 63.2 — are statutory obligations in their own right. The quality system documentation must be capable of producing evidence that these deadlines are met, on the timelines the Regulation sets rather than on timelines the organisation finds convenient. This is where the mapping exercise pays off: for each Canadian clause, identify the ISO 13485 clause that hosts it and the procedure and record that deliver it. Auditors working the Canadian task set will probe exactly these connection points, and a documented mapping makes the connections visible instead of leaving the auditor to reconstruct them.

Insight 2: from 2026-12-14, documented procedures change from declaration to express regulatory obligation.

Under SOR/2026-110, section 52(3) (distribution records), section 58 (complaint handling and related matters), the new section 58.1 (handling, storage, delivery, installation, servicing and corrective action for Class II to IV), section 59(3)(4) (incident reporting procedures) and section 61.2(4) (procedures for providing information) are amended to the express formulation of establishing, implementing and maintaining documented procedures. The effect is to move these requirements from implied good practice to named statutory duties. The intensity with which the MDSAP audit examines these documented procedures will rise accordingly, since the auditor can now anchor the Canadian task directly to an express regulatory text. Organisations should treat the effective date as a hard deadline for closing any gaps in the five procedure areas.

Insight 3: bilingual labelling is a concrete task within the system audit.

According to industry compilation, the Canadian-specific audit tasks include labelling requirements (English and French bilingual). Under section 23(3) of the Regulations, that bilingual obligation applies to devices sold to the general public. Within the quality system, the right response is not a general statement of conformity but an executable labelling control procedure: it should state how the public-sale determination is made for each product, how the language decision flows from that determination, how bilingual artwork is created, reviewed and released, and how the released labels are verified against the approved versions. A procedure at that level of specificity gives the auditor something concrete to sample and gives the organisation a repeatable way to keep labels compliant as products change.

Insight 4: design controls and risk management are fixed focus points of the audit.

According to industry compilation, the Canadian-specific audit tasks include design controls and risk management. Risk management is typically performed using ISO 14971 as the method standard, and the outputs should appear consistently in two places: in the dossier, where they support the safety and effectiveness evidence, and in the quality system, where design changes, production changes and post-market information are routed through risk evaluation. Keeping the two presentations aligned — same hazards, same controls, same verification references — avoids the common finding of a risk file that says one thing and a design history that says another.

4. Practical recommendations

• Build a mapping table of ISO 13485 clauses against Canadian Regulation clauses and mark the connection points one by one.
• Write the statutory deadlines — the 10-day and 30-day periods and the 24-hour notification — into the quality system as executable process steps with matching record forms.
• Structure the labelling control procedure so that section 23 distinguishes devices sold to the general public from devices not sold to the general public.
• Complete the five documented procedures (52(3), 58, 58.1, 59(3)(4), 61.2(4)) ahead of 2026-12-14.
• Keep design control and risk management records traceable to specific device versions.

5. Verification checklist

• □ A mapping table of ISO 13485 clauses against Canadian Regulation clauses has been established.
• □ The quality system documentation embeds the 10-day and 30-day and 24-hour deadline workflows.
• □ The labelling control procedure distinguishes devices sold to the general public from those that are not.
• □ The five documented procedures have been completed in line with SOR/2026-110.
• □ Design control and risk management records are traceable to device versions.
• □ The distribution record procedure can support recall traceability.

Regulatory information verified as of October 28, 2026.

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support for the Canadian market. Our team manages Health Canada Medical Device Licence and MDEL applications, prepares risk-classified dossiers, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com