Mandatory Problem Reporting: Unpacking the 30-Day, 10-Day and 48-Hour Deadlines

1. Key takeaways

Mandatory problem reporting in Malaysia rests on a three-part test. An event is reportable when it has occurred, when it is associated with a medical device, and when it led to one of the listed consequences: serious deterioration in health, death of a patient, user or other person, a serious threat to public health, or a risk of harm without death or serious injury. Where the assessment is uncertain, the MDA’s stated orientation is to lean towards reporting.

Once reportable, the deadline is set by consequence rather than by product family. Three tiers apply, and a misclassified case is a timing failure as well as a substantive one. After the initial report, an investigation report is due within 30 days, and the MDA may approve an extension.

• Tier one, 30 days: device failure or deterioration in performance, or a defect in labelling or instructions for use, where the event has not caused death or serious deterioration but recurrence could cause harm.
• Tier two, 10 days: an event that has caused death or serious deterioration in health, or where recurrence could do so.
• Tier three, 48 hours: a serious threat to public health.
• Investigation report: due within 30 days of the initial report, covering root cause, corrective and preventive action, and the results of implementation.
• Channel: the online system MeDCReSt at medcrest.mda.gov.my; combination products are excluded from online submission.
• Combination products: submit the MPR form PART 1 and PART 2 by email to mpr@mda.gov.my.
• Closure: acceptance is confirmed by written feedback from the MDA; submission alone does not close the case.

2. Legal basis

The duty originates in section 40 of Act 737, which requires an establishment to report device-related incidents of which it becomes aware. The Medical Device (Duties and Obligations of Establishments) Regulations 2019 supply the operational detail on records and reporting, and the Third Schedule to the MDR 2012 places PMS among the elements of conformity assessment, so reporting performance is reviewed again at registration and renewal. The MDA’s vigilance guidance sets out the reportability criteria and the timelines that apply to each tier.

The structure is deliberate: the statute creates an open duty, the guidance converts it into decision rules, and the conformity assessment schedule makes the quality of the decision-making visible to assessors. The table below collects the criteria, the timelines and the channels that a reporting procedure has to encode.

3. Expert insights

Insight 1: the three criteria are cumulative, and the third one is where classifications go wrong.

The first two criteria are usually easy. An event happened, and a device is associated with it. The difficulty sits in the third, because the listed consequences are not limited to injury. A device that failed without harming anyone is still reportable where recurrence could cause harm, and a labelling defect that has caused no harm at all can fall into the same category. Companies that screen on harm rather than consequence systematically under-report, invisibly until an inspector reconstructs the file from complaint records. The lean-towards-reporting rule exists precisely to remove the incentive to resolve these borderline cases silently.

Insight 2: the tier is chosen by consequence, so the same event type can produce different deadlines.

A single failure mode may sit in tier one in one instance and tier two in another, depending on what followed. This is why an internal matrix organised by event type produces confident but wrong answers: it encodes the wrong question. The workable sequence is to establish the consequence first, then read the deadline, then start the clock. It also follows that the person making the initial assessment needs authority to escalate immediately, because the difference between a 30-day and a 48-hour route is decided in the first hours of a case.

Insight 3: the 30-day investigation report is where most programmes fail.

Filing the initial report is a well-understood administrative act. Producing an investigation report within 30 days that identifies root cause, defines corrective and preventive action and reports the results of implementation is a different capability, because it depends on engineering, quality and regulatory functions working to one timetable. Where the investigation cannot be completed, the extension mechanism exists, but it has to be requested rather than assumed. A company that files the initial report and then waits for the laboratory will miss the second deadline without noticing.

Insight 4: channel discipline is part of the obligation.

Reports for conventional devices go through MeDCReSt. Combination products do not use online submission at all: the MPR form PART 1 and PART 2 must be sent by email to mpr@mda.gov.my. A procedure that offers a single route will silently mis-route the combination product category, and a mis-routed report is indistinguishable from a late one when the file is reviewed.

Insight 5: submission is not closure.

The MDA’s acceptance of a report is confirmed by written feedback, not by the act of submission. Treating the submission receipt as the end of the case leaves open items unmanaged, and those open items are exactly what a CAB assessor or an inspector will ask about. The register should therefore carry a status field that distinguishes submitted, accepted and closed.

Insight 6: foreign signals are the slowest link for most companies.

A foreign recall or field safety corrective action signal reaches the section 40 duty and the risk management update faster than any domestic complaint, and it is the point at which most organisations react too slowly. Writing a 48-hour internal circulation rule for foreign recall and FCA signals into the SOP converts an informal hope into a testable control.

4. Practical recommendations

• Build the decision tree around consequence, not event type. Ask what happened to the patient or user first, then read the deadline from the tier that fits.
• Give the first assessor escalation authority. The 48-hour and 10-day routes cannot survive a three-level approval chain.
• Set an internal investigation clock shorter than 30 days. Reserve the remaining days for review and submission, and document any extension request.
• Split the submission routes in the SOP. One route for MeDCReSt, one for the MPR form sent to mpr@mda.gov.my, with the combination product category named explicitly.
• Track three dates per case. Awareness, initial report and investigation report, so that the timeline can be reconstructed rather than remembered.
• Add a 48-hour circulation rule for foreign signals. Name the person who receives the alert and the forum in which it is assessed.
• Close the loop on written feedback. No case is closed in the register until the MDA’s written response has been received and filed.

5. Verification checklist

• □ Act 737 section 40 confirmed against the current text
• □ Medical Device (Duties and Obligations of Establishments) Regulations 2019 reviewed
• □ MDR 2012 Third Schedule PMS element mapped to the reporting SOP
• □ Three tiers and their deadlines written into the decision tree (30 days, 10 days, 48 hours)
• □ 30-day investigation report deadline and the extension route documented
• □ MeDCReSt account active and tested before the first case
• □ Combination product route to mpr@mda.gov.my documented with the MPR form PART 1 and PART 2
• □ MDA website PMSV column checked for current guidance
• □ Current MDA guidance on foreign event submission reviewed

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support across Southeast Asia, including Malaysia. Our team prepares dossiers to ASEAN CSDT structure, manages submissions and deficiency responses with the MDA, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com