Medical devices: how ISO 13485, MDSAP and the EU MDR fit together

ISO 13485 specifies requirements for a quality management system specific to medical devices. It is the foundation on which most regulatory submissions sit, but it is not itself market authorization: holding an ISO 13485 certificate does not place a device on any market by itself. Regulators use it as evidence that your processes are capable of consistently producing conforming devices.

The Medical Device Single Audit Program (MDSAP) lets a single regulatory audit, conducted by an Auditing Organization, satisfy the quality management requirements of the United States FDA, Health Canada, Brazil's ANVISA, Japan's MHLW, and Australia's TGA. For manufacturers selling into several of those markets, one audit cycle replaces five separate inspections — the efficiency case is straightforward.

The EU Medical Device Regulation (MDR) is a different instrument entirely: it governs market access, not just quality systems. It requires clinical evidence proportionate to device class, technical documentation reviewed by a notified body, post-market surveillance, and unique device identification. An ISO 13485 certificate supports an MDR submission but does not replace it.

Planning the sequence matters. Building the ISO 13485 system first, then layering MDSAP and market-specific submissions, avoids reworking documentation that was written for one framework in isolation. Classification drives everything: the same product can sit in different risk classes in different jurisdictions, changing the assessment route and the evidence burden.

Every approval decision in this field rests with the regulator or notified body concerned. Consulting work here means preparing the quality system, the technical file, and the clinical evidence so that those decisions can be made on complete, defensible submissions.