Does MDSAP replace ISO 13485, or do both have to be maintained?

Mark Meer

Trusted Information Resource
#1
With just over 17 months until MDSAP is mandatory for Canadian sales, our current ISO 13485 certification body is pressuring us to get on the program.

(and I don't blame them...I suspect a flood of requests come 2018, and not enough CB resources to accommodate. :nope: )

Can anyone on the MDSAP (or in the process) help me with the following: How does MDSAP affect your ISO 13485 certification? Did you:

a) Continue to maintain ISO 13485 certification? If so, does this involve the (odious) number of MDSAP audit hours PLUS audit hours for 13485? ...or is there some way to combine the two efficiently to avoid additional audit burden/expense? or,

b) Drop your ISO 13485 certification? I'm not sure what the implications would be. Assuming global sales (Europe, Asia, South America...) in addition to the 5 MDSAP countries, is there a reason ISO 13485 would have to be maintained if you have MDSAP? Certain distributors have asked for our ISO 13485 in the past, but maybe now they will also accept MDSAP?


Mandatory MDSAP is going to be an industry gong show it seems... :nope:

Any experience or input much appreciated!
MM
 
Elsmar Forum Sponsor

DannyK

Trusted Information Resource
#2
MDSAP does not replace ISO 13485.
It replaces the CMDCAS program for Canada and adds the regulatory requirements for USA, Australia, Japan, and Brazil.
You will still need to registered to either ISO 13485:2003 and ISO 13485:2016 before March 1, 2019.
The shock will come for small businesses that were used to 1 or 1.5 days surveillance audits. These audit can 4 or 5 days easily. And with the new standard comes an increase in day rates.
Some companies are considering to abandon the Canadian market because of the huge increase in fees. Canada is the only country that makes MDSAP mandatory.
There will be a crisis situation toward the end of 2018.
 

Mark Meer

Trusted Information Resource
#3
You will still need to registered to either ISO 13485:2003 and ISO 13485:2016 before March 1, 2019.
Why? What is the significance of March 1, 2019?

As far as global markets go, if you were wanting to keep access as flexible as possible, am I correct in assuming that companies will have to maintain BOTH MDSAP (just for Canada) and ISO13485?

The shock will come for small businesses that were used to 1 or 1.5 days surveillance audits. These audit can 4 or 5 days easily. And with the new standard comes an increase in day rates.
Some companies are considering to abandon the Canadian market because of the huge increase in fees. Canada is the only country that makes MDSAP mandatory.
There will be a crisis situation toward the end of 2018.
Yup. We are in this category. It's difficult to imagine what on earth auditors would do with a 7-day audit, given the limited products (and corresponding limited records) we maintain.
Abandoning the Canadian market altogether seems an option worth considering at this point... :(
 

Mark Meer

Trusted Information Resource
#4
Some other considerations that might help our decision:

Does anyone know if there's any talk of other countries adopting MDSAP as mandatory in the future? Any anticipation that, for example, the US FDA or Australian TGA may also mandate MDSAP?

Does anyone know if other countries/regions may also recognise MDSAP in the future? Is it a program other countries are lining up to join? ...or is it likely limited to the current 5 countries for the foreseeable future?
 

yodon

Staff member
Super Moderator
#6
Let's back up a second. My understanding is that MDSAP is intended to be a vehicle to allow results of a single audit to be accepted by multiple countries (regulatory bodies) - you don't "maintain" MDSAP, you only comply with all the applicable regulatory requirements for your target markets. These audits would cover the country-specific requirements. As far as I know, only Canada has mandated an MDSAP audit.

Per the FDA (https://www.fda.gov/MedicalDevices/InternationalPrograms/MDSAPPilot/), they will accept an MDSAP as a substitute for a routine inspection.

The EU, as far as I know, has not embraced MDSAP so if you want to continue to market there, you'll still be subject to the same audits. I expect, if you wanted to market in the US, Canada, and EU, you could have the MDSAP audit and they could also cover the 13485 audit (no doubt with extra cost).

I think DannyK is spot on with his assertion that this is heading towards a crisis. To do an MDSAP audit, the audit agency needs to be accredited to do so. I think, to date, only a very few agencies have been accredited.

Couple that with the already reduced number of registrars / notified bodies plus all the additional work they're going to have to do under the MDR and the situation starts looking pretty grim!

Further, as the FDA statement is worded, they can accept the MDSAP audit as a substitute for a *routine* inspection. They are still authorized to do any for-cause inspections. If they don't like something in the MDSAP report, they are free to do an inspection.

So while the concept sounds good (one audit to rule them all -- sorry, had to), application is going to be, well, interesting.
 

mihzago

Trusted Information Resource
#7
MDSAP is not a separate certification or a quality management system, it's an auditing approach.
ISO13485 is still defining your QMS requirements, and MDSAP is an audit process that verifies your compliance with ISO 13485 and applicable country regulations.

Take a look at the audit model
https://www.fda.gov/downloads/MedicalDevices/InternationalPrograms/MDSAPPilot/UCM390383.pdf

(note, there is a version specific to 2003 and 2016 version of ISO 13485).
All questions and evidence collected during the audit are based on ISO 13485.

The audit time is longer because it's no longer based on the size of the company (effective number of employees), but on the number of activities that a manufacturer is performing.

There are no additional requirements beyond ISO 13485, at least none that I am aware of, except for the regulatory requirements; though, the 2016 version requires you to comply with applicable regulatory requirements anyway.
 

Mark Meer

Trusted Information Resource
#9
MDSAP is not a separate certification or a quality management system, it's an auditing approach.
ISO13485 is still defining your QMS requirements, and MDSAP is an audit process that verifies your compliance with ISO 13485 and applicable country regulations.
So, am I correct to assume that by being on the MDSAP program you necessarily maintain ISO 13485 certificate as well?

In otherwords, MDSAP is not separate from ISO 13485, but rather just an extension of ISO 13485 to cover other countries' specific QMS requirements (in addition to the base ISO 13485 requirements)?
 

Marcelo

Inactive Registered Visitor
#10
So, am I correct to assume that by being on the MDSAP program you necessarily maintain ISO 13485 certificate as well?

In otherwords, MDSAP is not separate from ISO 13485, but rather just an extension of ISO 13485 to cover other countries' specific QMS requirements (in addition to the base ISO 13485 requirements)?
This is not right.

First, there's no "ISO 13485 certification". What exists are certification schemes - a certification program with its own rules, which includes, for example, a specific audit methodology and usually includes a recognition agreement such as an MLA - that uses ISO 13485 as a basis. For example, the IAF has a certification scheme for ISO 13485. The end result of these schemes is a certificate that shows compliance with something, in particular, with the requirements defined in the certification scheme rules. In the case of the mentioned IAF, the certificate shows compliance with ISO 13485 following IAF rules.

MDSAP is another certification scheme, with it's own rules. The end result is a MDSAP Certificates - they represent the application of an audit methodology to determine compliance with the requirements of ISO13485:2016 and relevant regulatory requirements for QMS through a single audit for multiple regulators.

Can you use your MDSAP certificate to show compliance to ISO 13485? Or even the IAF, or any certification scheme based on ISO 13485?
The answer depends on what you are using it for.

For example, to get the benefits of the MDSAP program, you have to use and MDSAP certificate, they don't accept an ISO 13485 certificate from other schemes (this is generally true for most schemes, unless there's a recognition agreement between schemes).
 
Last edited:
Thread starter Similar threads Forum Replies Date
A Does Class 1 Medical Device need to be certified to MDSAP? Canada Medical Device Regulations 5
K COPLANARITY: Composite profile tolerance on multiple surfaces- what does" lower dimensional reference frame tolerance" control? Inspection, Prints (Drawings), Testing, Sampling and Related Topics 4
P Does FDA require certification for quality system internal audit for auditor? Qualification and Validation (including 21 CFR Part 11) 1
H Does anyone has feedback on a notified body for small companies? EU Medical Device Regulations 2
M Does 4.5 - Alternative RISK CONTROL apply to the Particular Standards? IEC 60601 - Medical Electrical Equipment Safety Standards Series 3
E Does IVD need to integrate with hospital IT infrastructure? Medical Information Technology, Medical Software and Health Informatics 2
D What does a level 1 (PSW) PPAP actually promise? APQP and PPAP 16
R GS1 DataMatrix code does not meet GS1 Specification EU Medical Device Regulations 0
M Does the scope of ISO 9001:2015 applies to tenders, pricing and sales department of a medical devices distributor? ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 3
K Why does load cell supplier requires force verification General Measurement Device and Calibration Topics 3
M Does C=0 strictly mean 1 bad, all bad, all the time? ISO 13485:2016 - Medical Device Quality Management Systems 6
C Does a medical device active (zinc oxide) needs BPR registration in EU? Other ISO and International Standards and European Regulations 5
D Does Risk Management apply to re-labeler (MDR) EU Medical Device Regulations 1
Ed Panek Does this FDA Requirement Apply to international (not USA) distributors for USA based manufacturing companies? 21 CFR Part 820 - US FDA Quality System Regulations (QSR) 0
S Does anyone have a checklist to prepare for ISO 13485, Stage I audit? ISO 13485:2016 - Medical Device Quality Management Systems 3
S Does a refurbished product required a new UDI? US Food and Drug Administration (FDA) 3
D Change to labelling - does it require a new 510(k)? US Food and Drug Administration (FDA) 5
M What does "constantly" mean ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 13
N Does anyone use SGS for ISO 13485 / CE certification Registrars and Notified Bodies 0
G Does FDA allows remote approvals of quality documentation. Is there any specific guidance on signing any quality records remotely? Document Control Systems, Procedures, Forms and Templates 1
B Does FDA Registration QSR need to cover non-medical devices for contract repackager? US Food and Drug Administration (FDA) 1
lanley liao Does all of the suppliers need to integrated into the supplier list qualified of the company? Oil and Gas Industry Standards and Regulations 2
0 To which part of 13485 does this refer? ISO 13485:2016 - Medical Device Quality Management Systems 3
A Medical Device Contract Manufacturer - Does the CM need to register with FDA? 21 CFR Part 820 - US FDA Quality System Regulations (QSR) 3
J Records Control - Does each individual record need to be numbered? Records and Data - Quality, Legal and Other Evidence 2
lanley liao Does the customer`s trademark belong to customer-supplied property? Oil and Gas Industry Standards and Regulations 2
H How does a gas turbine work on diesel fuel? Oil and Gas Industry Standards and Regulations 12
G What does performance specification include? US Food and Drug Administration (FDA) 1
W Where does a coatings and paint company fall in IATF? IATF 16949 - Automotive Quality Systems Standard 5
A How much does a complete biocompatibility test package cost? Other ISO and International Standards and European Regulations 1
B Does anybody know how to get older versions of Minitab to work in Windows 10? Quality Tools, Improvement and Analysis 9
M Does the ISO 9001:2015 standard require a disaster recovery plan or emergency response plan ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 16
C Does an accessory need an IFU if it use is discussed in the Parent device IFU? 21 CFR Part 820 - US FDA Quality System Regulations (QSR) 5
S How long does it take to register a product with MHRA? UK Medical Device Regulations 14
M Quality Manual - Where does Revision History Section go? Document Control Systems, Procedures, Forms and Templates 8
U Does *anyone* know a lab that will test to EN 455-4 Medical Gloves shelf life determination? EU Medical Device Regulations 1
A Brexit When does the UK responsible person need to be in place? UK Medical Device Regulations 10
M How does IEC-60601-1 apply to a non-medical device in the patient vicinity? IEC 60601 - Medical Electrical Equipment Safety Standards Series 1
N Does anyone have experience of GB/T 34986-2017? China Medical Device Regulations 1
Z Does anyone have experience with EN ISO 17664 ? IEC 62366 - Medical Device Usability Engineering 9
F Does anyone have an ESD quality/cooler talk to share? Training - Internal, External, Online and Distance Learning 4
A What does this line from MDCG 2020-3 (MDR art. 120 substantial change) mean to you? EU Medical Device Regulations 4
D Change Approval Requirements - Does every change need formal customer approval? Design and Development of Products and Processes 17
T What does AS9100 mean when it says you must establish a process to do X? AS9100, IAQG, NADCAP and Aerospace related Standards and Requirements 24
L Does a backdate form format can be changed if wrong revision is used? Document Control Systems, Procedures, Forms and Templates 8
B General Motors and Honda Alliance - What does this mean to suppliers? IATF 16949 - Automotive Quality Systems Standard 3
C ISO 13485 :2016 - CAPA - Does every CAPA need to be checked by regulations? ISO 13485:2016 - Medical Device Quality Management Systems 9
A Does ISO 9001:2015 cover all the requirements of ISO 10012:2003? ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 6
N FDA UDI - Label vs. Labeling - Does the insert need to include UDI? Other US Medical Device Regulations 1
A Does anyone have a checklist of API Spec 650 13th Edition? Oil and Gas Industry Standards and Regulations 0

Similar threads

Top Bottom