The Workbench · Craft

Canada's device licence runs on someone else's audit

This blog has already covered how Taiwan's device licence is held by the domestic agent rather than the manufacturer, and how Malaysia splits a five-year device registration from a three-year establishment licence running its own separate clock. Health Canada's own structure carries a wrinkle neither of those two shares: for the country's higher-risk device classes, the regulation doesn't just ask a manufacturer to describe its quality system in the application. It names a specific outside certificate the file has to already contain, which means a third party's own audit has to be finished before Health Canada's review can start at all.

The certificate sits inside the application, not alongside it

The Medical Devices Regulations, SOR/98-282, set out what a licence application has to contain in Section 32, one subsection per class — Class II, Class III, and Class IV each get their own list, growing longer as the class rises. Buried inside each of those three lists, not attached as a separate condition, is a requirement to include a copy of a quality management system certificate showing that the system under which the device is manufactured satisfies CAN/CSA-ISO 13485. A Medical Device Licence application for a Class II, III, or IV device that reaches Health Canada without that certificate already in hand isn't a weaker application waiting on a follow-up document. It's missing a listed item the regulation names by number, the same as a missing labeling sample or a missing device description would be.

Only one program's certificate has counted since 2019

Which certificate satisfies that requirement narrowed sharply after 2016. Health Canada ran its own conformity assessment system, CMDCAS, until the Medical Device Single Audit Program — a joint arrangement letting one audit satisfy the quality-system requirements of several countries' regulators at once — became available as an alternative starting in 2017. The overlap didn't last: after a two-year transition, Health Canada stopped accepting CMDCAS certificates entirely, and since January 1, 2019, only an ISO 13485 certificate issued by an MDSAP-recognized Auditing Organization satisfies Section 32's own requirement. A standalone ISO 13485 certificate issued for a CE mark, or any certificate outside the MDSAP program, doesn't count no matter how current it is. Canada was the first of the program's participating regulators to make that certificate mandatory rather than optional, and each one is valid for a period the regulation caps at three years — its own clock, running independently of the device licence it supports.

Class I skips the file, and the licence changes shape

None of this touches Class I devices at all. Section 32's own list, and the Medical Device Licence it supports, only applies to Class II through IV; a Class I device never goes through Health Canada's product-level review or needs an MDSAP certificate attached to anything. What a Class I device's manufacturer needs instead is a Medical Device Establishment Licence under Section 44 — unless it sells solely through a distributor who already holds one. That's not a lighter version of the same instrument. It's a different one: an MDEL is issued at the company level, not the product level, and it reaches further than Class I manufacturers alone, since any importer or distributor of a device of any class also needs one in its own right, regardless of what licence the device itself carries.

Two objects, easy to collapse into one status field

A registration tracker built around a single “Canada: licensed” column is trying to hold two structurally different records in one cell. A Medical Device Licence is product-specific, runs against a class-based application under Section 32, and depends on an MDSAP certificate with its own three-year expiry sitting underneath it. A Medical Device Establishment Licence is company-specific, runs against Section 44, and applies to a Class I manufacturer or to an importer or distributor of any class, independent of whichever MDLs that same company's own product line might separately hold. A device whose MDL is current and a company whose MDEL has lapsed are two different compliance failures, and a tracker that can't tell them apart has nothing to flag when only one of the two actually breaks.

Where this meets the file

A Canada registration record needs the MDSAP certificate's own expiry tracked as a distinct field feeding the MDL it supports, and the company's MDEL tracked separately from any device-level licence it holds — rather than one field standing in for both. A cross-border registration tracker built to carry that split, alongside the launch catalog's other device-registration templates, is previewed there now. If your program has tracked Health Canada's two licences differently, the shelf takes that correction directly.

The Regulatory Toolkit launches soon — a free shelf of source-mapped templates, checklists and browser-only tools for regulatory teams. Get one email when it opens, or contribute a template.

All Workbench notes