The International Medical Device Regulators Forum (IMDRF) has updated its audit approach for the Medical Device Single Audit Program (MDSAP) to align with new requirements found in the Quality Management System Regulation (QMSR) in the US, among other changes.
Carrying a revision date of Feb. 6, the revised MDSAP audit approach – found here – no longer includes references and citations to the Food and Drug Administration’s (FDA) former Quality System Regulation, or QSR, which was supplanted by the QMSR on Feb. 2. (Related Story: “QMSR Insights: From Assessing FDA’s Inspections CPM to Enhancing Supplier Oversight, Here’s 7 Things MedTechs Should Do Right Now,” QualityHub, Feb. 3, 2026.)
The MDSAP program allows a MedTech manufacturer to undergo one quality systems audit to satisfy the regulatory requirements of the US, Canada, Japan, Brazil, and Australia.
In one of the more notable changes, the MDSAP approach now reminds users that US regulations don’t require technical documentation, but notes that “most data composing the technical documentation are [a] direct output of the Design and Development Files (ISO 13485:2016, Clause 7.3.10) and the Medical Device File (ISO 13485:2016, Clause 4.2.3).”
The QMSR is the product of the FDA harmonizing its now-defunct QSR with ISO 13485, the international quality systems standard from the International Organization for Standardization (ISO).
Medical device manufacturers that use MDSAP as a tool to conduct internal quality audits or for FDA inspection prep are advised by QualityHub Principal Consultant Elisabeth George to educate their team on changes made by the new QMSR.
“Previously, FDA investigators couldn’t see audit reports and they couldn’t see management review records, but now they can, and staff should be aware of that,” George said. “They also need to address with staff any changes in terminology between the QMSR and ISO 13485.” (Related Story: “A ‘Major Change’: Is Your MedTech Company Ready for FDA’s Review of Audit Reports?” QualityHub, Jan. 1, 2026.)
During inspection prep, George further recommends that companies “increase their focus on risk management as a key area, not only throughout a product’s design, but across the total product lifecycle,” she said. Manufacturers “also need to take into consideration the risk of quality system activities and how those could potentially impact product quality.” (Related Story: “Risk Management & QMSR: 7 Questions Answered By FDA,” QualityHub, Jan. 15, 2026.)
FDA’s PCCP Also Gets MDSAP Mention
Meanwhile, IMDRF also updated the MDSAP approach to include information on the FDA’s Predetermined Change Control Plans, or PCCP, which are designed to shave time off a product’s entrance to market.
A PCCP is documentation that is part of a company’s device submission to FDA reviewers that describes “what modifications will be made to a device and how the modifications will be assessed” so a new 510(k) or a premarket approval (PMA) supplement isn’t needed every time a product is updated, the agency says in an August 2024 draft guidance document on the topic. As an FDA initiative, PCCP was given the green light by Congress in 2022 when lawmakers wrote it into the Food and Drug Omnibus Reform Act (FDORA).
While PCCPs can be submitted to the FDA for any type of medical device, such a plan appears to make most sense for products that include software and/or use artificial intelligence (AI) and machine learning (ML). Cardiac devices, surgical robots, and diagnostic imaging devices all fit that bill.
The MDSAP audit approach’s new section on PCCP notes that for AI-enabled medical devices covered by PCCP, “the audit team should review the PCCP section(s) of the cleared 510(k) or approved PMA that prespecifies modifications to a device (agreed to by FDA) that can be implemented without the need for a future marketing submission.”
It also points out that the audit team “should confirm that changes to the device are within the scope of modifications allowed in the PCCP.”
