*Update to Compliance Date for MDSAP: A grandfather period is allowed in 2019 if you don’t have an MDSAP certificate by 31/12/18. Once you have a valid 13485/CMDCAS certificate issued after 1/1/16 by a registrar who is recognized to audit to MDSAP and have either undergone the MDSAP audit or scheduled an audit.
In this blog we will answer the following questions:
- Will CMDCAS be available after 01/01/2019?
- What must manufacturers do in order to join the MDSAP programme?
- What is the MDSAP programme?
- What are the 3 Steps to MDSAP Approval?
- Which Auditing Organizations (AOs) are Authorised to do MDSAP audits?
- What are the 4 actions that manufacturers who sell into Canada need to do now?
In the second instalment, I will go on to discuss the MDSAP programme in more detail. In the third and final part of the blog, I will discuss some of the particular requirements of the five jurisdictions involved and how to achieve compliance with these.
Why is everyone talking about MDSAP and Health Canada?
From 1st January 2019 any manufacturer selling medical devices into Canada must be part of the MDSAP programme. MDSAP is the Medical Device Single Audit Programme which consists of a single Quality Management System (QMS) audit for the following five regions; Australia, Brazil, Canada, Japan and the USA. The programme is voluntary for the other four regions but Canada has mandated that manufacturers who sell medical devices (Class 2 or higher) in Canada after 1st January 2019 must have a QMS that has been approved through the MDSAP programme.
Will CMDCAS be available after 01/01/2019?
Up to now medical devices sold in Canada had to have their QMS assessed under the CMDCAS system, this option will not be available from January 2019 onwards. Health Canada had flagged this fact as early as December 2015 but it went somewhat under the radar until the RAPS meeting in September 2017 when representatives from Health Canada stated that the 1st January 2019 deadline would not change. The MDSAP process may nominally take 6 months, but could take much longer, so manufacturers who haven’t already done so must act now.
What must manufacturers do in order to join the MDSAP programme?
First let us start by looking at what is involved in the MDSAP process and then I will go on to outline what actions the manufacturer must take at this stage.
What is the MDSAP programme?
The MDSAP programme was initiated by the IMDRF (International Medical Device Regulators Forum) as a pilot programme which concluded in June 2017, continuing as a voluntary programme with exception of Canada where it will be mandatory, as discussed above. MDSAP does not currently apply to Europe which has observer status in the MDSAP programme. The programme involves assessment of the QMS by an ‘Auditing Organisation’ (Organisation’ (AO) on behalf of the regulatory bodies from the five participating countries. A manufacturer can apply for inclusion in the MDSAP programme for one or all of the five participating countries. Upon successfully going through the MDSAP process the manufacturer receives areceives a MDSAP certificate which demonstrates that they have successfully complied with the QMS requirements of the MDSAP countries for which they applied.
What are the 3 Steps to MDSAP Approval?
Gaining MDSAP approval involves three steps all of which involve the AO.
1. Application review
2. Phase 1 Audit (off site documentation audit)
3. Phase 2 Audit (on site audit)
Following approval the manufacturer will be subjected to annual audits by the AO on a three year cycle with the third annual audit being a re-certification audit. The MDSAP programme is based around adherence to the Quality Management Systems Standard for Medical Devices ISO 13485: 2016 along with additional requirements from the five participating countries; Australia, Brazil, Canada, Japan and the USA.
Which AOs are Authorised to do MDSAP audits?
Currently 14 AOs are authorised to complete MDSAP audits; a list of the authorised AOs is given at the end of this article. If you were already using an EU Notified Body as your Conformity Assessment Body for one of the five MDSAP countries, then the chances are that your Notified Body will be listed among authorised AOs and you will be able to use them for the MDSAP process.
What do manufacturers who sell into Canada need to do now?
Manufacturers who have not already done so should take the following four steps immediately;
1. Contact your AO Now
2. Limit the Scope of Your Application
3. Comply with Specific Country Requirements
4. Train all Key Staff in MDSAP Requirements
Below we will look at each of these actions in more detail.
Many manufacturers have begun the process of registering for MDSAP already, but as the graph below indicates, many more have not. By the end of July 2017, only 326 manufacturers worldwide had applied for MDSAP. The figure will have increased significantly in the past 6 months but this has had the unwanted effect of putting an enormous demand on the resources of the authorised AOs which will in turn lead to increased MDSAP approval lead-times.
Contact your AO Now
Due to the timelines involved, it is imperative that manufacturers contact their AO immediately to begin the MDSAP process and get their application underway. This author has first-hand knowledge of AOs being unable to schedule audit dates due to the volume of work already undertaken and of manufacturers who are actively considering discontinuing sales in Canada due to inability to meet the MDSAP timelines.
Limit the Scope of Your Application (where necessary)
At this point manufacturers should consider limiting the scope of their application, wherever possible, so as to ensure successful MDSAP registration before 1st January 2019. MDSAP requires that all sites under the application be audited and the audit reports be sent to all of the regulatory bodies of the participating countries. In addition, the MDSAP audit may include certain outsourced operations. It may be wise to limit your application to only the countries and products that it is absolutely necessary to include at this stage. The scope of your MDSAP certificate can be broadened at any time in the future; this will involve a recertification audit.
Comply with Specific Country Requirements
The manufacturer must then ensure that his QMS complies with ISO 13485:2016 and all the relevant requirements of the countries that are within scope. This will involve updating certain Quality System documents such as the Quality Manual and the internal auditing procedure among others. A number of the participating countries require specific roles to be documented and fulfilled, such as the Japanese requirement for a Marketing Authorization Holder (MAH). It is important to ensure that the roles required by each country are defined in your QMS as required by ISO 13485: 2016 Clause 4.1.1. It is important to ensure adequate resources are available for updating the QMS and managing the MDSAP registration process to ensure achievement of the 1st January deadline. If necessary, the manufacturer should consider utilizing external resources in order to ensure that they can continuecan continue to sell product in Canada next year.
Train all Key Staff in MDSAP Requirements
Ensuring that Top Management, Regulatory Affairs, Quality Assurance, Internal Auditors and other staff are trained in the requirements of the MDSAP process is a vital step in ensuring a successful MDSAP outcome. The AO auditors will interview top management to determine if they are actively engaged in compliance with the requirements of all of the countries that are within the MDSAP certificate scope. It is an expectation that the QMS will have been operated and audited to the requirements of all these countries in advance of the Phase 2 audit.
As we can see, the timeline for MDSAP registration for Canada is extremely tight. For those that have already applied the focus should be on ensuring that personnel are trained and the QMS is updated and audited by internal auditors For those who have not yet applied the priority should be to contact an AO right away.
List of Authorised Auditing Organizations:
List of Authorised Auditing Organisations
MDSAP Authorised Auditing Organizations:
BSI Group America Inc.
DEKRA Certification B.V.
DQS Medizinprodukte GmbH
Intertek Testing Services NA Inc.
Laboratoire National de métrologie et d'Essais (LNE)
-Division certification G-MED
Lloyd's Register Quality Assurance Inc
National Standards Authority of Ireland
NSF Health Sciences
QMI-SAI Canada Limited
TÜV SÜD America Inc.
TÜV USA, Inc.
UL Medical and Regulatory Services UL, LLC
If you need assistance with MDSAP compliance, contact John Lafferty on www.northridge.ie or 00353 (0)87 2801793
John Lafferty is a Quality and Validation Consultant to the Medical Device industry. His specialities include MDSAP, ISO 13485, ISO 14971 and MDR. John is the holder of a Degree in Manufacturing Technology, Certificate in Training & Continuing Education, Certificate in Quality Management. He has over 25 years’ experience in the medical device and pharmaceutical industry. He was a Senior Manager of a multinational Medical Devices plant where he managed the Quality, Regulatory, Environmental and Health & Safety Management Systems. He has successfully completed numerous consultancy projects with medical device manufacturers in Ireland and throughout Europe. John is also a Life Sciences Tutor with SQT Training www.sqt-training.com
M: 087 2801793
E mail: firstname.lastname@example.org
AO Auditing Organization
CMDCAS Canadian Medical Device Conformity Assessment System
IMDRF International Medical Device Regulators Forum
ISO International Organization for Standardization
MAH Marketing Authorization Holder
MDSAP Medical Device Single Audit Programme
QMS Quality Management System
RAPS Regulatory Affairs Professionals Society