Malaysia MDA medical device registration: complete 2026 guide for SaMD

Malaysia's regulatory framework for medical devices

Malaysia's Medical Device Authority (MDA) operates under the Medical Device Act 2012 (Act 737) and the Medical Device Regulations 2012. The MDA sits within the Ministry of Health Malaysia and is responsible for pre-market registration, post-market surveillance, and enforcement for all medical devices sold in Malaysia — including software as a medical device (SaMD).

The regulatory framework follows the ASEAN Medical Device Directive (AMDD) model, using a four-class risk-based system aligned with the EU's classification logic. This alignment is deliberately designed to make market entry easier for companies already certified under EU MDR or ISO 13485 — Malaysia recognises established international conformity assessments rather than requiring entirely new testing.

The MDA publishes all registration guidance through the MeDC@St online portal and via its Guidance Documents series (MDA/GD/xxxx). The two guidance documents most relevant to SaMD companies are MDA/GD/0041 (registration requirements) and MDA/GD/0070 (Verification Route via Singapore SMDR).

SaMD classification under Malaysia MDA: Class A, B, C, D

All medical devices in Malaysia — including software — must be classified before registration. Classification determines which pathway applies, whether CAB involvement is required, and the level of technical documentation needed. The four classes map closely to the EU MDR four-class system, though the classification rules differ in some details for software.

Most SaMD companies targeting Malaysia fall into Class B or Class C. Class A software — genuine administrative or wellness tools — can self-certify. If your software provides clinical recommendations, assists in diagnosis, or influences treatment decisions, expect Class B minimum and possibly Class C depending on the clinical context and severity of the condition addressed.

One important nuance: Malaysia uses the AMDD classification rules, not EU MDR Rule 11 directly. While the outcomes are often the same, there are edge cases — particularly for AI/ML software and software with indirect diagnostic functions — where the Malaysian classification may differ from your EU MDR class. Verify your Malaysian classification independently rather than assuming direct EU MDR equivalence.

Two pathways to Malaysian registration for EU MDR holders

EU MDR certified companies have two practical routes to Malaysian registration. The right choice depends on whether you already hold Singapore HSA registration and your target timeline.

Pathway 1: Direct registration with EU MDR as reference

Under MDA guidance MDA/GD/0041, manufacturers with EU MDR CE mark submit a CSDT (Common Submission Dossier Template) to an MDA-approved CAB. The CAB conducts a technical conformity assessment, relying on the EU NB certificate as the primary conformity evidence. After a positive CAB assessment report, the application is submitted to MDA for product registration.

This pathway is appropriate when you are entering Malaysia before Singapore, or for device categories not covered by the HSA–MDA reliance programme. It is also the only option if your device class in Malaysia differs from Singapore (rare, but possible for certain AI SaMD).

Pathway 2: Verification Route via Singapore HSA

For Class B, C, and D SaMD already listed in Singapore's Singapore Medical Device Register (SMDR), the Verification Route (MDA/GD/0070) is the faster and lighter pathway. The CAB reviews your application in 30 working days — relying on HSA's prior assessment — followed by MDA registration within a further 30 working days.

The Verification Route was permanently confirmed in March 2026 after a successful pilot period. It is now standard policy, not an exception. For any EU MDR certified company planning Southeast Asian expansion, the recommended sequence is: EU MDR → Singapore HSA → Malaysia MDA via Verification Route → (optionally) Thailand, Indonesia, Philippines using ASEAN reliance mechanisms.

MDA-approved CABs for SaMD in Malaysia

All Class B, C, and D device registrations require a Conformity Assessment Body (CAB) approved by MDA. Not all CABs have experience with software — choosing a CAB with SaMD-specific expertise reduces the risk of supplementary information requests and delays.

When selecting a CAB, ask specifically about their experience with SaMD submissions and their familiarity with IEC 62304 and ISO 14971 documentation reviews. A CAB reviewer who primarily handles physical devices may request unnecessary supplementary information on software-specific documentation. Request references from previous SaMD clients before committing.

Malaysian Authorised Representative: requirements and selection

Non-Malaysian manufacturers must appoint a licensed Authorised Representative (AR) before submitting to MDA. The AR is not optional — it is a legal prerequisite. MDA will not accept applications from foreign manufacturers without a local AR.

What your Malaysian AR must hold

• MDA Establishment Licence: Issued by MDA, covering the AR's regulated activities — importation, distribution, or both. Verify the licence scope matches your intended distribution arrangement
• GDPMD certificate (Good Distribution Practice for Medical Devices): Mandatory for all licensed establishments. An expired GDPMD immediately suspends all products held by that AR — including yours. Build GDPMD currency checks into your AR qualification process
• MeDC@St portal access: All Class B, C, and D applications are submitted through MDA's MeDC@St system. Only licensed AR accounts can submit — you cannot submit directly as a foreign manufacturer

AR responsibilities and what to verify

The Malaysian AR holds the product registration certificate in their name and is legally responsible for post-market obligations in Malaysia — adverse event reporting, field safety corrective actions, and re-registration. Their compliance failures become your market access failures. Before appointing an AR:

• Verify their MDA Establishment Licence number and expiry via the MDA portal
• Verify their GDPMD certificate number and expiry — do not rely on self-declaration
• Confirm their experience with SaMD specifically (not just physical devices)
• Clarify who holds the MeDC@St account and who manages submission communications with MDA
• Review their process for multi-market vigilance reporting if you also hold EU MDR and UKCA obligations

Step-by-step registration process for Class B SaMD

The following sequence assumes you are pursuing the direct pathway (EU MDR as reference). For the Verification Route, steps 1–3 are the same — the difference is in the CAB review depth at step 5.

1. Confirm classification: Apply AMDD classification rules to your SaMD intended use. If borderline B/C, prepare conservative documentation. Document your classification rationale — MDA may challenge it
2. Appoint Authorised Representative: Engage and formally appoint a licensed Malaysian AR. Execute an AR Agreement covering responsibilities, termination, and data access. Obtain their Establishment Licence and GDPMD copies
3. Prepare CSDT dossier: Compile the Common Submission Dossier Template per MDA/GD/0041. For SaMD, the key sections are: device description (software description, intended purpose, indications), IEC 62304 software documentation summary, ISO 14971 risk management summary, clinical evidence summary, and usability engineering summary
4. Select and engage CAB: Submit your application to an MDA-approved CAB. Provide complete CSDT with EU NB certificate as conformity reference. CAB will acknowledge receipt and begin review
5. CAB review: 60 working days (direct) or 30 working days (Verification Route). CAB may issue Supplementary Information Requests (SIR). Respond promptly — each SIR resets part of the clock. Target: zero SIRs through complete initial submission
6. CAB assessment report: CAB issues a positive assessment report and Certificate of Conformity. This triggers the MDA registration phase
7. MDA registration submission: AR submits the MeDC@St application with CAB report, product details, labelling, and registration fee payment. MDA reviews and issues the Product Registration Certificate (PRC)
8. MDA registration: 30–60 working days post-CAB submission. MDA issues the PRC — valid for 5 years, renewable before expiry

Documentation requirements for Class B SaMD

The CSDT for Class B SaMD registration must include the following elements. Missing or incomplete sections are the most common cause of CAB Supplementary Information Requests and registration delays.

Administrative section

• AR declaration in MDA Annex B format (per MDA/GD/0041)
• AR Establishment Licence and GDPMD certificate — current copies
• Product list with GMDN codes
• Completed MeDC@St application form
• Registration fee payment confirmation

Technical documentation

• Device description and intended purpose — in plain language, matching your EU MDR intended purpose
• Software documentation summary: IEC 62304 software safety classification (Class A/B/C), SOUP list, software architecture description, verification and validation summary
• Risk management summary: ISO 14971 risk management process, top risks and controls, residual risk acceptability statement
• Clinical evidence summary: clinical evaluation summary aligned with your EU MDR CER (full CER not required — summary sufficient for Class B)
• Usability engineering summary: IEC 62366-1 process summary, key usability findings

Conformity assessment evidence

• EU MDR Notified Body certificate — current, within validity period
• ISO 13485 QMS certificate — current, covering software design and manufacture
• Declaration of Conformity in Malaysian Appendix 1A format (slightly different from EU DoC format)

Labelling

• Labels and IFU as used in the EU market
• Malaysian-specific label addition: AR name, address, and Establishment Licence number must appear on or with the device
• Language: English is sufficient for professional SaMD; Bahasa Malaysia translation is mandatory only for devices intended for lay/home use
• Once registered, the MDA product certificate number must be added to Malaysian market labelling

Registration fees and costs

Plan for the following cost components when budgeting Malaysia MDA registration. Fees quoted are approximate 2026 rates — confirm current amounts with MDA and your CAB before submission.

Costs are significantly lower when EU MDR documentation is well-maintained and adapted efficiently for the CSDT format. Companies that attempt Malaysia MDA without prior regulatory experience typically spend at the higher end of these ranges due to SIR delays and rework. The Verification Route (via Singapore) also reduces CAB assessment fees in some cases, as the review scope is narrower.

GDPMD licence: what it is and why it determines your market access

The GDPMD (Good Distribution Practice for Medical Devices) certificate is one of the most overlooked requirements in Malaysia MDA registration — and one of the most operationally critical. Every entity holding an MDA Establishment Licence, including your Authorised Representative, must maintain a current GDPMD certificate issued by MDA.

GDPMD is not a one-time approval. It is an ongoing certification that must be renewed and is subject to MDA inspection. The consequences of an expired or suspended GDPMD are immediate and total: all medical device registrations held by that establishment are suspended until the GDPMD is reinstated. This means your SaMD registration — and your ability to sell in Malaysia — can be suspended by your AR's compliance failure, not yours.

What GDPMD covers for SaMD

For software as a medical device, GDPMD requirements apply to the distribution and supply chain activities of your AR — how the software is supplied, how licences are managed, how complaints are handled, and how adverse events are escalated. Unlike physical device distribution, SaMD GDPMD compliance focuses on electronic supply channels, licence key management, and software update distribution procedures.

MDA inspects GDPMD holders against MDA's Good Distribution Practice guidelines. Key areas reviewed: storage and handling procedures (for SaMD: secure software delivery and licence management), complaint handling system, adverse event reporting procedures, and traceability of supply to end users.

GDPMDs (Good Distribution Practice for Medical Device Suppliers)

GDPMDs is a related but distinct certification for medical device suppliers — entities that supply devices to licensed importers and distributors but do not hold direct regulatory licences. For most foreign SaMD manufacturers, GDPMDs is not directly relevant; it applies to your AR's supply chain rather than to your registration. However, if your AR sources services from third-party local suppliers (for implementation, integration, or technical support of your SaMD), those suppliers may require GDPMDs certification. Clarify this with your AR during due diligence.

How to verify GDPMD status

• Go to the MDA public portal and search by establishment name or licence number
• Confirm the GDPMD certificate covers the activity type relevant to your distribution arrangement (importation, distribution, or both)
• Check the expiry date — build a reminder 6 months before expiry into your AR management calendar
• Request a certified copy of the GDPMD certificate as part of your AR onboarding documentation
• Repeat this verification annually, and whenever your AR reports any MDA inspection or compliance event

Post-market obligations in Malaysia

Malaysian registration is a 5-year certificate, but ongoing post-market obligations begin the moment your device is on the Malaysian market (see also: EU MDR PMS obligations that run in parallel). These are not administrative formalities — MDA enforcement has strengthened since 2024, and non-compliance can result in suspension of the product registration certificate.

Adverse event reporting

Malaysia requires adverse event reporting to MDA under mandatory timelines. Serious incidents (those involving death or serious deterioration) must be reported within 10 working days of becoming aware. Non-serious incidents must be reported within 30 calendar days. Reports are submitted through MeDC@St by your AR.

Your QMS must include a Malaysia-specific adverse event reporting procedure. If you hold EU MDR obligations simultaneously, a single event may require concurrent reporting to your EU Notified Body, MHRA (if UKCA), MDA, and potentially Singapore HSA. Build a multi-market vigilance workflow — this is a common gap in companies expanding from EU-only to Asia markets.

Field Safety Corrective Actions

Any FSCA — recall, safety notice, field correction — must be communicated to MDA in parallel with EU and UK notifications. MDA expects to be notified of FSCAs affecting Malaysian market products within the same timeframes as the originating market. Your AR executes FSCA notifications in Malaysia; your QMS must specify how to trigger and manage multi-market FSCAs.

Certificate renewal

Product Registration Certificates are valid for 5 years. Renewal applications must be submitted before expiry — a lapsed certificate means the product is no longer legally on the Malaysian market. Build certificate expiry tracking into your regulatory calendar from the day you receive registration.

MDA regulatory sandbox for AI SaMD

MDA launched Malaysia's first regulatory sandbox for medical devices in 2025, specifically designed for AI-driven medical technologies. The sandbox allows innovative AI SaMD to be tested under real-world conditions in a controlled, supervised environment before full market registration. For companies with novel AI intended uses that may not fit neatly into existing classification rules, the sandbox provides both a pathway to early market presence and direct regulatory dialogue with MDA. Contact MDA's Medical Device Evaluation Division directly for eligibility and application procedures.