Malaysia Medical Device Regulations: One Act, One Set of Rules, Three Subsidiary Regulations

1. Key takeaways

The Malaysian medical device framework is built in four descending layers, and knowing which layer a requirement lives in decides how much weight to give it. The first layer is the Medical Device Act 2012 (Act 737), the statute itself, which creates the duties. The second layer is the Medical Device Regulations 2012 [P.U.(A) 500/2012], which turns those duties into procedures and carries the five schedules that contain most of the technical content. The third layer consists of the subsidiary regulations issued from 2019 onwards, which address specific obligations such as those of establishments and the advertising of devices. The fourth layer is the MDA guidance series, the MDA/GD and MDA/GL documents together with the Circular Letters, which explain how the Authority reads its own instruments.

• Four layers, in order of authority: Act 737, then the Medical Device Regulations 2012 [P.U.(A) 500/2012], then the subsidiary regulations issued from 2019, then MDA guidance and Circular Letters.
• The First Schedule holds the classification rules and includes a dedicated Appendix 2 for IVDs; the Second Schedule holds the grouping rules.
• The Third Schedule governs conformity assessment, with Appendix 1 setting out the essential principles of safety and performance (EPSP) and Appendix 2 providing the CSDT submission template.
• The Fourth Schedule sets the qualification standards and technical fields for conformity assessment bodies; the Fifth Schedule sets the official fees.
• The 2019 subsidiary regulations cover the duties and obligations of establishments, including adverse event reporting and record keeping, and the advertising of medical devices, which requires MDA approval.
• Guidance explains but does not bind: the sections and the schedules are the hard constraints, and fee figures have effect only where they appear in the Fifth Schedule or in an amendment to it.

2. Legal basis

Act 737 is the parent law and states the obligations in general terms. The Medical Device Regulations 2012, cited as P.U.(A) 500/2012, supply the machinery: how an application is made, what a conformity assessment consists of, who may perform it, how devices are grouped, and what the fees are. The distinction is not academic. When a requirement is said to apply, the first question is whether it appears in the Act, in the Regulations or only in a guidance document, because the answer determines whether a deviation is a compliance failure or a presentational preference.

The subsidiary regulations issued from 2019 add obligations that sit alongside registration rather than inside it. The Medical Device (Duties and Obligations of Establishments) Regulations 2019 impose duties on establishments, covering matters such as adverse event reporting and record keeping. The Medical Device (Advertising) Regulations 2019 require that advertising of medical devices be approved by the MDA. These instruments are administered together with the Agency guidance that accompanies them, notably the advertising guidelines MDA/GD/0032, which is dated December 2020. A manufacturer that has secured a registration but has not read the establishment duties has secured only part of what the framework requires.

The fourth layer is where most day-to-day questions are actually answered. The MDA/GD and MDA/GL series, together with Circular Letters, tell applicants how the Authority expects a dossier to be assembled, how a particular class is to be argued, and how a submission is to be filed. Guidance of this kind, for example MDA/GD/0014, is an operational interpretation of the provisions. It is authoritative as an indication of how the MDA will act, but it does not displace the text it interprets, and where the two diverge the section or the schedule prevails.

The same discipline applies to money. Fee figures are valid only where they appear in the Fifth Schedule or in an amendment to the Fifth Schedule, of which P.U.(A) 330/2025 is an example. A fee quoted in a presentation, a portal screen or a consultant note is a working figure until it is traced to the schedule in force on the date of payment.

3. Expert insights

The practical value of the four-layer model is that it tells you where to look when a requirement is disputed. Teams that work only from guidance documents tend to treat every procedural preference as a legal requirement, which inflates dossiers and slows reviews; teams that work only from the Act tend to miss the schedules, which is where the classification rules, the grouping rules and the conformity assessment content actually live. The correct order of consultation is downwards: identify the section, then the schedule, then the regulation, then the guidance. Only when the first three are silent does the fourth become the operative reference.

A second observation concerns the Third Schedule. Because it carries both the EPSP in Appendix 1 and the CSDT template in Appendix 2, it is simultaneously a substantive standard and a format instruction. Manufacturers sometimes satisfy the format and under-argue the standard, producing a dossier that is structurally correct and evidentially thin. The reverse failure also occurs: a well-argued technical file that does not follow the template and therefore generates avoidable deficiency rounds. Both appendices have to be treated as binding at the same time.

The third observation is about version control. The framework is amended by instruments with P.U.(A) numbering, and the guidance series is revised in editions. An organisation that keeps a single undated summary of Malaysian requirements will, within a short period, be working from a mixture of current and superseded text without knowing which is which. The remedy is not more documents but one controlled document with dated entries, so that any statement can be traced back to the instrument and the edition it came from. In a structure of four layers, the risk is rarely that a rule is unknown; it is that the wrong version of a known rule is being applied.

4. Practical recommendations

• Build a regulatory ledger before building a dossier: list the key sections of Act 737, the five schedules, the three subsidiary regulations of 2019 and the GD and GL numbers in routine use, each with its citation and date.
• Record the layer for every requirement in the ledger, so that a question about whether something is mandatory can be answered by pointing at a section or a schedule rather than at a guidance paragraph.
• Check the Third Schedule against the technical file in both directions, confirming that the EPSP arguments are complete and that the CSDT template has been followed.
• Trace every fee figure to the Fifth Schedule or to a named amendment such as P.U.(A) 330/2025 before it enters a budget or a quotation.
• Keep the 2019 establishment duties and the advertising approval requirement in the same compliance plan as the registration, since they continue to apply after the certificate is issued.
• Update the ledger, not the whole company, when the MDA issues a new edition or a Circular Letter, and record the date of the change so that earlier advice can be identified as superseded.

5. Verification checklist

• □ Act 737 (Laws of Malaysia) table of contents and key sections confirmed, with the section numbers checked against the published text (pending verification).
• □ Medical Device Regulations 2012 [P.U.(A) 500/2012], First to Fifth Schedules, read in the current version (pending verification).
• □ Medical Device (Duties and Obligations of Establishments) Regulations 2019 confirmed by full citation (pending verification).
• □ Medical Device (Advertising) Regulations 2019 confirmed by full citation (pending verification).
• □ Advertising guidelines MDA/GD/0032, December 2020, reviewed (pending verification).
• □ Fifth Schedule fee figures reconciled with any amending instrument, including P.U.(A) 330/2025 (pending verification).

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support across Southeast Asia, including Malaysia. Our team prepares dossiers to ASEAN CSDT structure, manages submissions and deficiency responses with the MDA, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com