MDSAP Audits in Canada: What Medical Device Manufacturers Must Know About Health Canada GMP Requirements

Health Canada made the Medical Device Single Audit Program mandatory on January 1, 2019 — and yet, years into that requirement, we still see manufacturers entering the Canadian market who are caught off guard by what the program actually demands. Not just in terms of documentation, but in how Health Canada uses MDSAP audit reports to make licensing and enforcement decisions without ever setting foot in a facility.

That’s the part most manufacturers underestimate.

What MDSAP Is — and Why It Replaced Direct Health Canada Inspections

MDSAP isn’t a new quality standard. It’s an audit framework built on ISO 13485:2016 and ratified by five regulatory authorities: Australia’s TGA, Brazil’s ANVISA, Canada’s Health Canada, Japan’s MHLW/PMDA, and the United States FDA. The core idea was efficiency — replace multiple country-specific GMP inspections with a single, rigorous audit that satisfies all five jurisdictions simultaneously.

For Health Canada specifically, MDSAP participation allowed the department to redirect inspection resources away from routine GMP audits toward risk-based and compliance-triggered inspections. In practice, that means if your MDSAP certificate is current and clean, Health Canada is unlikely to visit your facility on a routine basis. But “clean” is doing a lot of work in that sentence.

Under the Canadian Medical Devices Regulations (SOR/98-282), all Class II, III, and IV medical device manufacturers — and importers who rely on foreign manufacturers — must hold a valid MDSAP certificate as a condition of their Medical Device Establishment Licence (MDEL). There’s no opt-out and no equivalent alternative. Miss your certificate renewal, and your MDEL condition is no longer met.

The Three-Year Audit Cycle — and Why the Gaps Matter

MDSAP operates on a three-year certification cycle. Year one involves the full initial certification audit — a thorough evaluation of your quality management system across seven regulatory process areas: management responsibilities; measurement, analysis, and improvement; design and development; production and service controls; purchasing/supplier management; corrective and preventive action; and customer focus. Years two and three involve annual surveillance audits, which are shorter but still substantive. At the end of the three-year period, a recertification audit restarts the cycle.

The surveillance audits are where manufacturers tend to slip. Because they’re shorter, there’s a temptation to treat them as administrative check-ins rather than genuine assessments. Auditors specifically target areas with previous non-conformances, and Health Canada’s review of surveillance findings is just as sharp as their review of initial certification results.

One number that surprises manufacturers new to MDSAP: the average time from engaging an Auditing Organization (AO) to receiving an initial certificate typically runs nine to twelve months. That’s planning time. If you’re preparing a market entry or launching a new device class requiring an MDEL, the MDSAP clock needs to start well before your regulatory submission lands at Health Canada.

How Health Canada GMP Non-Conformances Are Graded — and What Triggers Action

The MDSAP grading system is where manufacturers frequently misread their risk exposure. Non-conformances are categorized as Major or Minor, but Health Canada applies its own interpretive layer when it receives audit reports from Auditing Organizations.

A Major non-conformance indicates a systemic failure — either a complete absence of a required quality system process, evidence that a process has broken down across multiple products or lots, or a situation presenting a direct patient safety risk. Health Canada treats Major findings as potential grounds for regulatory action, including licence conditions, import alerts, or product recall, depending on the device risk class.

Minor non-conformances are process gaps that don’t immediately threaten product safety but do indicate incomplete implementation of the quality system. And here’s what many manufacturers don’t appreciate until they’re sitting across from an AO auditor: five or more minor non-conformances across a single audit can collectively trigger the level of regulatory scrutiny that a single Major finding would.

What’s critical to understand is the transparency built into the model. Health Canada receives all MDSAP audit reports through the program’s regulatory authority submission process — this isn’t optional or selective. The AO submits the report; Health Canada reviews it. A manufacturer doesn’t get to decide whether an audit outcome is worth sharing with the regulator.

Selecting an Auditing Organization: Not All Are Equal

MDSAP audits can only be conducted by Auditing Organizations formally recognized by the program — accredited by an IAF-member accreditation body and approved by the MDSAP steering committee. As of 2026, approximately 30 AOs are globally recognized, though the number actively serving Canadian clients across all major device sectors is meaningfully smaller.

The choice of AO matters more than manufacturers typically expect, and it rarely comes down to price alone.

A few things worth evaluating:

Industry sector experience. An AO that primarily audits software-as-a-medical-device (SaMD) companies brings a very different depth of knowledge than one specializing in sterile implantable devices or in vitro diagnostics. Match the AO’s auditor expertise to your product risk class and manufacturing complexity.

Familiarity with Canadian regulatory nuances. MDSAP covers five jurisdictions, but an AO with genuine experience interpreting Health Canada’s specific expectations — around bilingual documentation obligations, the MDEL interface, and Health Canada’s risk-based oversight model — is worth the extra diligence to find.

Auditor continuity across the three-year cycle. Surveillance audits benefit from auditor familiarity with your system. Ask prospective AOs how they handle auditor assignment across certification, surveillance year one, and surveillance year two. Consistency matters.

Non-conformance management expectations. Some AOs provide clear guidance on acceptable corrective action timelines and evidence requirements; others simply issue findings and step back. Know which type you’re working with before signing an agreement.

Where Pharmaceutical CROs and CMOs Intersect With MDSAP

MDSAP comes up regularly in conversations our team has with pharmaceutical CROs and CMOs — and the intersection is almost always combination products. Where a drug is delivered via a prefilled syringe, an autoinjector, a delivery pen, or another integrated device component, the regulatory classification question becomes important: is it primarily a drug, primarily a device, or a combination product?

Under Health Canada’s current framework, the primary regulatory pathway for a combination product is determined by its primary mode of action. A prefilled syringe containing a biologic is typically regulated as a drug under the Food and Drug Regulations, but the device component — the syringe system, the autoinjector mechanism — must still satisfy the Medical Devices Regulations. That means the device manufacturer or assembler may well need a valid MDSAP certificate.

For CROs supporting drug development programs that incorporate device delivery systems, this creates a supplier qualification obligation that sits squarely within Canada GMP requirements. You may not be the device manufacturer yourself, but your quality program must demonstrate that your device component suppliers hold current MDSAP certification where applicable. This is an area we see overlooked in supplier qualification programs more often than it should be.

What an Expired or Suspended MDSAP Certificate Actually Costs You

The practical consequences of an invalid MDSAP certificate are swift. An expired certificate means an invalid MDEL condition, which means you cannot legally import or sell Class II, III, or IV devices in Canada. There’s no regulatory grace period built into SOR/98-282.

For importers relying on foreign manufacturers, the risk is one step removed but equally real. If your foreign supplier’s MDSAP certificate is suspended — for whatever reason, including issues unrelated to your specific products — your Canadian MDEL condition is no longer met. Monitoring supplier certificate status isn’t a one-time onboarding check; it’s an ongoing quality system obligation. Health Canada’s MDEL annual renewal process includes attestation that all conditions, including MDSAP compliance, remain satisfied.

There’s a reputational dimension too. Health Canada’s database of licensed device establishments is publicly searchable. A gap in MDSAP status that forces a licensing interruption is visible to your customers, your distribution partners, and your competitors.

A Pre-Audit Readiness Checklist

Before your next MDSAP audit — whether initial, surveillance, or recertification — a short internal readiness review is worth the time investment:

1. Review all open non-conformances. Every finding from the previous audit should have a verified, documented correction and a completed corrective action. “In progress” is not a defensible status on the audit date.
2. Audit your management review records. Health Canada GMP expectations around management review are explicit. Your most recent minutes should demonstrate genuine analysis of quality system performance data — not a one-page sign-off with no supporting metrics.
3. Check supplier qualification currency. MDSAP auditors scrutinize purchasing controls carefully. Supplier approvals, performance records, and re-qualification documentation need to be current and accessible — not buried in a shared drive.
4. Document all change control activity since the last audit. Process changes, product modifications, equipment qualifications, and supplier changes all need complete change control records, including risk assessments where warranted.
5. Verify your MDR records are audit-ready. Medical Device Report obligations under the Medical Devices Regulations are a consistent audit focus. If you’ve had reportable events since the last audit, the submission records and any Health Canada correspondence must be readily retrievable.

Getting MDSAP right isn’t about passing an audit. It’s about running a quality management system that genuinely satisfies Health Canada’s expectations — and holds up across all three years of the cycle, not just in the weeks before an auditor arrives.

---

Written by Nour Abochama, Quality & Regulatory Advisor, Androxa. Learn more about our team

Talk to our team about Health Canada compliance Contact us

Related from our network

• Pharmaceutical GMP testing and analytical lab services — ISO 17025-accredited laboratory testing supporting Canadian GMP programs, including supplier qualification and lot release
• EU medical device regulatory compliance under MDR 2017/745 — Guidance for device manufacturers seeking European market authorization and REACH compliance