MDSAP Audit Approach v10: What Changed on February 2, 2026, and Why It Matters to You

On the very day the QMSR went into effect, a substantial update to the MDSAP Audit Approach was released. What's changed, what you need to update, and where people go wrong in understanding the relationship between MDSAP and an FDA inspection.

February 2, 2026, was a particularly busy day in the regulatory world. Everyone was talking about the QMSR coming into effect, bidding farewell to the old version of 21 CFR Part 820, and what this means for FDA inspections. But many people missed something that happened on that exact same day: version 10 of the MDSAP Audit Approach, AU P0002, was officially released.

This is not a cosmetic update. For organizations that hold MDSAP certification, work with Canada, the USA, Australia, Brazil, or Japan, or are preparing for an upcoming MDSAP audit, there are several changes here that need to be understood and reflected in the quality system.

A Little Background: What is the MDSAP Audit Approach and Why Does It Matter

It's important to distinguish between two things that are sometimes confused:

MDSAP (Medical Device Single Audit Program) is the program itself, which allows a recognized Auditing Organization to conduct a single audit that satisfies the quality management system requirements of five regulatory authorities. MDSAP is the arrangement, the regulatory agreement, the framework.

The MDSAP Audit Approach (AU P0002) is the operational guide. This is the book by which auditors work in the field. It defines the audit sequence, the specific tasks the auditor must perform, and the links to each country's regulatory requirements. If you've ever witnessed an MDSAP audit up close, you'll have realized that the auditor works according to a very structured document. This is that document.

Version 10 was released about 18 months after version 9 (August 2024) and reflects significant regulatory changes that the partner countries have undergone during this period, particularly the entry into force of the QMSR in the USA.

The Main Change: ISO 13485 First and Foremost

The biggest change in version 10 is also the simplest to describe: all references to the QSR (21 CFR Part 820 in its old version) have been removed from the document. In their place, the QMSR "integrates" into ISO 13485 as an additional layer on top of the standard, not alongside it.

In previous versions, MDSAP auditors treated the QSR and ISO 13485 as two parallel systems that required cross-referencing. It was necessary to verify that the company complied with both. Now, in version 10, the approach is different: ISO 13485 is the foundation. The QMSR adds specific FDA requirements on top of it that still exist and must be verified separately, such as Unique Device Identification (UDI), specific reporting obligations, and device listing.

What does this mean in practice? Companies that maintained two parallel requirements, one for ISO 13485 and one for the FDA QSR, and have not yet synchronized them into the QMSR, will find that the auditor in 2026 works with a different mindset. They won't look for "where is 21CFR 820.30" as a standalone clause. They will ask, "How does your design control process implement the requirements of ISO 13485:2016, clause 7.3, and where are the additional FDA requirements documented on top of it?"

Other Important Changes to Know

Supplier Management: Parting Ways with "Critical Supplier"

The term "critical supplier" has been completely removed from the document and replaced with a more operational definition: "suppliers that should be considered for an audit as part of the organization's MDSAP audit."

This change reflects a more flexible approach to the supply chain. Instead of trying to rigidly define what is "critical," the new approach focuses on the question: which suppliers are important enough to be audited as part of the organization's current audit cycle?

For quality managers, this means the list of suppliers to be audited should be dynamic, risk-based, and documented accordingly. A future MDSAP audit will not just ask, "Who are your critical suppliers?" but rather, "According to what process did you determine which suppliers require an audit, and when did you actually audit them?"

PCCPs Enter the Picture

For the first time, the Audit Approach explicitly refers to Predetermined Change Control Plans (PCCPs) for AI- or software-based devices. The auditor will examine whether changes made to the device are indeed within the scope of the PCCP cleared in a 510(k) or approved in a PMA, and if the changes were documented and approved accordingly.

This is mainly relevant for companies developing SaMD with updating AI algorithms, who have pre-arranged the change mechanism with the FDA.

TGA Update for Australia: Farewell to the URPTG

Australia has changed its recall protocol: the URPTG (Uniform Recall Procedure for Therapeutic Goods) protocol has been replaced by the new PRAC, which deals with procedures for recalls, product alerts, and product corrections. Any company that sells to Australia and holds MDSAP certification must ensure its reporting procedures are updated to the new protocol.

A Common Mistake to Avoid

Many companies think that MDSAP "replaces" an FDA inspection. This is incorrect, and version 10 has not changed this.

An MDSAP audit is an audit of compliance with the quality system standard. An FDA inspection is a statutory enforcement action. The FDA can conduct an inspection by law at any time, regardless of the MDSAP results. A successful MDSAP audit may influence the FDA's surveillance planning, but it does not preclude the possibility of a routine, risk-based, or for-cause inspection.

More importantly: since the QMSR came into effect, FDA investigators can request to see internal audit reports, management review records, and supplier audit reports. This is not part of MDSAP. This is a new addition to direct FDA inspections. Companies that were accustomed to these documents being "protected" from inspectors need to change this assumption.

What to Update in Your Quality System

If you hold MDSAP certification or are preparing for an audit soon, these are the items you should check:

Supplier Management: Review your supplier list and their risk documentation. Ensure there is a clear, documented criterion for selecting suppliers for an audit, separate from the old terminology of "critical supplier."

QMS Documents: If you still have references to the QSR as a "standalone requirement," update them so the QMSR is described as a layer on top of ISO 13485.

TGA: If Australia is in scope, ensure your recall procedure is updated to the PRAC protocol.

Device Listing: Version 10 of the MDSAP Audit Approach emphasizes the obligation to update device listing with the FDA between October 1 and December 31 each year, or whenever a relevant change occurs.

PCCP (relevant for software and AI): If your device is covered by a PCCP, ensure the internal process for managing changes is defined and documented according to it.

In Conclusion

Version 10 of the MDSAP Audit Approach is a direct reflection of the major changes that occurred on February 2, 2026. The introduction of the QMSR, flexibility in supplier management, and the integration of PCCPs for the first time. For companies that manage MDSAP as a routine procedure, now is the time to ensure the system is aligned with the new version before the next audit.

The full document is available for download directly from the MDSAP website: mdsap.global/documents/library/audit-approach