WORKER SAFETY: MDSAP, Chapter 2
MDSAP Chapter 2: What Device Marketing
Authorization Means for Your Facility
Authorization Means for Your Facility
The Medical Device Single Audit Program (MDSAP) Chapter 2 covers Device Marketing Authorization and Facility Registration, the process that confirms your facility is authorised to manufacture and distribute medical devices in each market where your employer sells. For workers in MDSAP-certified facilities, this chapter directly affects what documentation must be maintained, what happens during an audit, and what the consequences are when registration lapses or a marketed device changes without notification. Canada has required MDSAP certification for Class II through IV devices since January 1, 2019. This guide explains what Chapter 2 covers and what it means for the people who work in regulated device facilities.
5
Participating Regulatory Authorities
MDSAP covers five regulatory bodies: FDA (US), Health Canada, ANVISA (Brazil), TGA (Australia), and MHLW/PMDA (Japan). One MDSAP audit satisfies the quality system requirements of all five simultaneously.
FDA MDSAP Programme
2019
Canada Mandatory Since
Health Canada made MDSAP certification mandatory for Class II, III, and IV medical devices from January 1, 2019. Manufacturers without a valid MDSAP certificate cannot obtain or maintain a Canadian Medical Device Licence for these classes.
Health Canada MDSAP
3
Core Tasks in Chapter 2
MDSAP Chapter 2 has three core audit tasks: Task 1 (awareness and arrangements for marketing authorisation), Task 2 (confirmation of marketing clearance in all applicable jurisdictions), and Task 3 (notification of changes to marketed devices or the QMS).
MDSAP Audit Approach Document
Hazard Overview: Why Chapter 2 Matters to Workers
MDSAP Chapter 2 is not an administrative checklist that only affects regulatory affairs teams. It governs whether the facility you work in is authorised to manufacture and distribute the devices it produces. When Chapter 2 requirements are not met, the consequences are operational: production stops, shipments are held, and market access can be suspended. For workers, that means understanding why certain documentation requirements exist and why auditors ask the questions they ask during MDSAP audits.
Chapter 2 connects to two other parts of the MDSAP audit: the Management process and the Design and Development process. Auditors reviewing Chapter 2 will confirm that management was aware of and arranged for marketing authorisation in the right jurisdictions, that any device changes were notified to authorities where required, and that labelling reflects the correct authorisation status for each market.
Missing or lapsed marketing authorisation
A device distributed without valid marketing authorisation in a participating country is in violation of that country’s regulatory requirements. For Canada, manufacturing and distribution without a valid MDSAP certificate means the Medical Device Licence is invalid. Product already in the market may be subject to recall.
Undisclosed changes to marketed devices
Changes to a marketed device, including design changes, materials changes, and labelling changes, may require regulatory notification or reauthorisation before the changed device can be distributed. Distributing a changed device without completing the required notification process is a Task 3 Chapter 2 finding.
Facility registration not current
US FDA establishment registration must be renewed annually. Facilities that manufacture devices distributed in the US must be registered and renew that registration each fiscal year. An outdated registration is a citable finding during an MDSAP audit and can affect import clearance of US-destined shipments.
Labelling not consistent with the jurisdiction
Chapter 2 Task 1 requires auditors to review labelling for the product being supplied to a particular jurisdiction. Labels that cite an incorrect authorisation number, missing market-specific mandatory language, or an unauthorised intended use for that market are Chapter 2 findings with direct product impact.
Signs of a Problem: What Workers Should Watch For
Workers in MDSAP facilities do not manage regulatory submissions, but they are often the first to notice conditions that indicate a Chapter 2 gap. The following situations should be reported to a supervisor or quality department immediately.
!
REPORT: A device is being prepared for a new market with no visible change to its labels or authorisation documentation
If a product is being directed to a new country of distribution without any regulatory affairs activity, no updated labelling, no new authorisation documentation, no change control records, the facility may be distributing without the required marketing authorisation for that market. This is a Chapter 2 Task 2 issue.
!
REPORT: A design or materials change has been made to a marketed device but no change notification records are visible
Chapter 2 Task 3 requires the organisation to identify changes to marketed devices or its QMS that require notification to regulatory authorities. If a production worker knows that a component, material, or process has changed but no change control or regulatory notification records exist for that change, this should be reported to the quality department immediately.
!
REPORT: Labels on product being prepared for shipment look different from the approved label templates on file
Labelling must match the approved content for each market. If workers in packing or dispatch notice that labels differ from what they have previously seen or what is in the document control system, this should be stopped and raised before the shipment proceeds.
MDSAP Chapter 2: The Three Tasks Explained
MDSAP Audit Approach Chapter 2 contains three tasks that an MDSAP auditor will examine. Understanding what each task covers helps workers understand what the auditor is looking for, and why certain records must be maintained and accessible.
Do / Do Not: Chapter 2 Rules for Everyone in the Facility
DO
Follow document control procedures when using product labelling
Report any unplanned or undocumented change to a component, material, or process to your supervisor immediately
Keep records you are responsible for complete, dated, and traceable
Ask your supervisor if you are unsure whether a change requires a change control record
Cooperate fully and answer MDSAP auditors’ questions honestly and accurately
DO NOT
Use superseded or unapproved label versions on product going to market
Make an informal change to a material, component, or process without initiating a change control record
Ship product designated for a specific country with labels for a different country
Withhold information from an MDSAP auditor or prepare records after the fact to appear compliant
Assume that a design or labelling change that “seems minor” does not require change control review
What to Do if a Chapter 2 Problem Is Identified During or After an Audit
An MDSAP auditor raises a finding against Chapter 2 during the audit
Do not dispute the finding or attempt to provide alternative records on the spot that were not part of normal operating procedure. Acknowledge the finding, cooperate with the auditor’s request for information, and refer detailed responses to your quality or regulatory affairs team. MDSAP findings are graded, a Major finding requires a CAPA plan within a defined timeframe and may trigger a follow-up audit. Immediate escalation to the quality department is required regardless of the finding’s apparent severity.
A device has been distributed in a market without the required marketing authorisation
Stop further distribution of the affected device to that market immediately. Escalate to the quality and regulatory affairs team. Depending on the jurisdiction, distribution without authorisation may require voluntary notification to the relevant authority and, in some cases, a field action. Do not attempt to obtain the missing authorisation retroactively while continuing to distribute, the distribution must stop first.
A change was made to a marketed device without completing the required notification
Quarantine stock of the affected device where the change is reflected in product already in inventory. Escalate to quality and regulatory affairs to assess which jurisdictions require notification, what the notification process is, and whether a CAPA or field action is required. Document everything from the moment the gap is identified. The change control record must be opened, the regulatory impact assessed, and notifications completed before the changed device is released or continues to be distributed.
Supervisor Tips
Brief your team on what Chapter 2 findings look like in practice
Workers who understand that an undocumented material substitution or an unapproved label version used in production are potential Chapter 2 findings are more likely to escalate those situations before they reach an auditor. Annual pre-audit briefings that include Chapter 2 scenarios help workers understand why certain controls exist.
Maintain a current list of all markets where each device is authorised
Production and dispatch supervisors need access to a current list of the markets where each product code is authorised, so they can flag an order for a market where authorisation has not been confirmed. This does not require regulatory affairs expertise, it requires a clear, accessible document that is maintained by regulatory affairs and available at the point where shipping decisions are made.
Treat every informal change as a potential Chapter 2 trigger
Informal changes, substituting a component “just this once,” printing a label slightly differently to resolve a readability complaint, adjusting a parameter without a formal deviation, are among the most common routes to Chapter 2 Task 3 findings. Supervisors who reinforce the change control process consistently prevent these situations from reaching the auditor.
Prepare workers to interact confidently and honestly with MDSAP auditors
Workers who have never been in an MDSAP audit may feel anxious or provide unclear answers. Supervisors should remind workers before every audit that auditors are assessing the system, not evaluating individual workers. Workers should answer questions about their own job clearly and honestly, and refer questions outside their role to the appropriate team member.
MDSAP Chapter 2 Readiness Checklist
Marketing Authorisation (Task 1 and 2)
Current marketing authorisation status documented for each device and each market
US FDA establishment registration renewed in the current fiscal year
Health Canada Medical Device Licence valid and not expired for Canadian products
Labelling for each market reviewed and confirmed to match approved, market-specific content
Change Notification (Task 3)
Change control process identifies which changes require regulatory notification by jurisdiction
Notifications completed and confirmed before changed device entered distribution
Design and development change records link to regulatory notification records
No informal changes to device or QMS that have bypassed the change control process
Audit Readiness
Workers briefed on their role during an MDSAP audit
All records required for Chapter 2 review accessible and current
MDSAP certificate current and within its validity period
Supervisors designated as escorts and points of contact for auditors in their area
Key Takeaways
Marketing authorisation is not a one-time event, it requires ongoing maintenance
FDA establishment registration requires annual renewal. Health Canada MDLs must be maintained with a current MDSAP certificate. Changes to marketed devices may require new or updated authorisation. Chapter 2 findings commonly arise from registration that lapsed, certificate that expired, or a change that was implemented without checking the notification requirements.
Every worker in the facility contributes to Chapter 2 compliance through change control
Chapter 2 Task 3 depends entirely on the facility’s change control process working as designed. Workers who bypass change control, even for a “small” change, can create a situation where a marketed device has been changed without the required regulatory notification. That is a Chapter 2 finding regardless of how minor the change appeared.
Canada is the only MDSAP country where certification is mandatory, but the audit covers all five jurisdictions
Workers sometimes assume MDSAP compliance is only relevant for the Canadian market. In fact, an MDSAP auditor reviewing Chapter 2 will examine marketing authorisation status and facility registration in every jurisdiction where the facility distributes devices, including the US, Australia, Brazil, and Japan. A Chapter 2 finding related to the US or Australian market has the same standing in the audit report as one related to Canada. Compliance with Chapter 2 is a global obligation, not a Canadian one.
Frequently Asked Questions
What is MDSAP and how does Chapter 2 fit into the audit?
The Medical Device Single Audit Program (MDSAP) is a framework developed by the International Medical Device Regulators Forum (IMDRF) that allows a single quality management system audit, conducted by an approved Auditing Organisation, to satisfy the requirements of five regulatory authorities: FDA (US), Health Canada, ANVISA (Brazil), TGA (Australia), and MHLW/PMDA (Japan). The MDSAP audit is structured around seven chapters. Chapter 2 specifically covers Device Marketing Authorization and Facility Registration, verifying that the organisation has the required marketing authorisation in each jurisdiction where it distributes devices, that facilities are properly registered, and that changes to marketed devices have been notified as required.
Is MDSAP required in the United States?
MDSAP is voluntary in the United States. However, FDA accepts MDSAP audit reports as a substitute for its routine quality system inspections of medical device manufacturers without a history of substantial prior quality deficiencies. Manufacturers that participate in MDSAP are generally removed from the FDA’s routine inspection schedule. MDSAP cannot be used in lieu of FDA Pre-Market Approval (PMA) pre-approval inspections for Class III devices. Source: Qualio MDSAP Guide
What is a Major finding in an MDSAP Chapter 2 audit?
MDSAP findings are graded on a scale where Minor findings are the least severe and Major findings indicate a significant QMS failure. A Major finding in Chapter 2, such as distributing a device in a jurisdiction without marketing authorisation, or implementing a device change that required regulatory notification without completing that notification, requires the organisation to submit a CAPA plan to the Auditing Organisation within a defined timeframe. Major findings may trigger a follow-up audit and can affect the validity of the MDSAP certificate. For Canada, a Major finding can put a Medical Device Licence at risk.
What types of changes trigger a regulatory notification requirement under Chapter 2?
The types of changes that require regulatory notification vary by jurisdiction. For US-distributed Class II devices with a 510(k) clearance, FDA requires a new 510(k) for changes that could significantly affect safety or effectiveness. Health Canada requires notification of changes that affect the basis for a Medical Device Licence. Each jurisdiction has its own change notification criteria. MDSAP Chapter 2 Task 3 requires the organisation to have a documented process that identifies, for each jurisdiction where it distributes devices, what changes require notification and what the notification process is. Source: MDSAP Audit Approach Document
How does MDSAP Chapter 2 relate to ISO 13485:2016?
MDSAP builds on ISO 13485:2016 by adding country-specific regulatory requirements to the ISO quality management system framework. Chapter 2 Task 1 references ISO 13485:2016 clauses 4.1.1, 4.2.1, 5.2, 7.2.1, and 7.2.3, which cover QMS planning, the quality manual, management review, the determination of customer-related requirements, and customer communication. The Chapter 2 assessment is essentially asking whether the quality system has properly incorporated the regulatory requirements for marketing authorisation and facility registration in each applicable jurisdiction, a gap that would be an ISO 13485 non-conformance as well as a Chapter 2 finding.
What should a worker do if an MDSAP auditor asks them a question they cannot answer?
Say so honestly. MDSAP auditors expect workers to know the details of their own job, not the details of the entire QMS. If an auditor asks a question that is outside a worker’s knowledge or responsibility, the correct answer is “I do not know the details of that, that would be handled by [quality/regulatory affairs/my supervisor]” and then direct the auditor to the appropriate person. Do not guess, do not speculate, and do not attempt to provide an answer that sounds right but may be inaccurate. Honest answers that acknowledge the limits of knowledge are not findings.
Does the MDSAP audit cover all seven chapters in every audit cycle?
Yes, all seven MDSAP chapters are reviewed during each audit cycle, following a defined audit sequence. Chapter 2 (Device Marketing Authorization and Facility Registration) and Chapter 6 (Medical Device Adverse Events and Advisory Notices Reporting) are supporting processes that are audited alongside the five core processes: Management, Design and Development, Production and Service Controls, Measurement Analysis and Improvement, and Purchasing. An MDSAP audit typically spans multiple days, with auditors moving through the sequence and following process linkages between chapters. Source: MDSAP Audit Approach Document
Sources
Government and Regulatory Sources
- FDA: MDSAP Audit Approach Document (MDSAP AU P0002.009): the authoritative MDSAP audit process document, describing all seven chapters including Chapter 2 Task 1, Task 2, and Task 3 with associated ISO 13485:2016 clause references and country-specific regulatory links.
- FDA: Medical Device Single Audit Program (MDSAP): FDA’s MDSAP programme page covering participating regulatory authorities, audit acceptance policy, and how MDSAP audit reports satisfy FDA’s routine inspection requirements.
- Health Canada: MDSAP: Health Canada’s programme page confirming the January 1, 2019 mandatory requirement for Class II, III, and IV medical device manufacturers to hold a valid MDSAP certificate to obtain or maintain a Canadian Medical Device Licence.
- FDA: MDSAP Chapter 2 Training Module, Device Marketing Authorization and Facility Registration: FDA CDRH training slides covering Chapter 2 audit tasks, linkages to Management and Design and Development processes, and country-specific requirements for each MDSAP participating authority.
Research and Industry Sources
- Intertek: MDSAP in 2025, A Strategic Compliance Pathway (August 2025): industry overview of MDSAP participating authorities as of 2025, audit consolidation benefits, and the programme’s coverage of over 60% of the global medical device market.
- SourceNutra: MDSAP and Medical Device Licence in Canada (2025): analysis of Health Canada’s section 32(2)(f) MDR requirement for MDSAP certification and the programme’s role as the replacement for the former CMDCAS system.
Related VelSafe Articles
Insights
EU MDR 2017/745: What Articles 1 and 2 Mean for Compliance
Evidence-based analysis of EU MDR scope and definitions, a parallel regulatory framework for device manufacturers operating in both EU and MDSAP-participating markets.
Guides
21 CFR Part 803: Medical Device Reporting Requirements
A guide to FDA MDR reporting obligations for device manufacturers, a post-market surveillance obligation that links to the MDSAP adverse events chapter (Chapter 6).
Worker Safety
VelSafe Worker Safety Library
Practical worker safety guidance for regulated industries, covering OSHA obligations, quality system requirements, and the compliance responsibilities of frontline workers in medical device and pharmaceutical environments.
MDSAP AND REGULATORY COMPLIANCE LIBRARY
More MDSAP and Medical Device Regulatory Guidance
Explore VelSafe’s regulated industry library for worker safety guides, compliance references, and regulatory analysis covering MDSAP, FDA, EU MDR, and ISO 13485.
Explore Worker Safety Articles
