Canada - Health Canada

Health Canada, Medical Devices Bureau

Jun 2019

Medical Devices Regulations (SOR/98-282)

~95%

Pre-market

Risk management, secure design, verification evidence in licence application; aligns with FDA SPDF.

Post-market

Mandatory problem reporting, CVD plan, software change reports.

SBOM

Not strictly mandatory but strongly aligned to FDA expectations; reuse FDA package.

Vulnerability disclosure

Recommended via Canadian Centre for Cyber Security (CCCS).

Licence cancellation, suspension, public advisories.

Unique requirements

• 01Bilingual labelling and IFU
• 02Canadian Importer or Resident
• 03MDSAP audit accepted in lieu of dedicated QMS audit

Highlights

• Aligned with FDA premarket cybersecurity guidance (Feb 2026)
• MDSAP-friendly evidence reuse
• Bilingual labelling (EN/FR)

How to submit in Canada

Playbook reviewed · 2026-07-16

Submission route

Medical Device Licence application to Health Canada under the Food and Drugs Act, with cybersecurity per Health Canada's 2019 Pre-market Guidance

Health Canada explicitly recognises FDA content and IMDRF principles. A well-prepared FDA cybersecurity subsection covers most Canadian expectations, with only minor labeling and MDSAP-linked QMS additions.

Step-by-step

1. Step 01

   Confirm MDSAP certificate

   MDSAP is mandatory for Class II-IV; make sure the certificate covers your manufacturing site.

2. Step 02

   Adapt FDA cybersecurity subsection

   Reuse the FDA package; add Canadian-specific labeling references and update authority names.

3. Step 03

   Submit MDL application

   Electronic submission via CESG portal; cybersecurity documentation is embedded in the technical file.

4. Step 04

   Respond to screening + review questions

   Health Canada issues a screening letter within 15 days; substantive questions follow.

Evidence checklist

Common Health Canada rejections

Typical timeline

End-to-end window: 4-9 months for Class III/IV with a strong FDA-reusable package.