GRZAN Malaysia Registration Services: From Assessment to Certificate Maintenance

1. Key takeaways

GRZAN works on global medical device regulatory registration and authorised representative services, and the Malaysian practice covers the full sequence from licensing to post-market hosting. The scope is deliberately end-to-end rather than transactional: AR licensing and EL maintenance, Class A to Class D product registration including IVD, CSDT preparation and CAB assessment management, verification pathway design using CE, FDA or other national approvals, GDPMD compliance, and post-market obligation hosting covering MPR, FCA, change notification and renewal.

The reason for that breadth is structural rather than commercial. In the Malaysian framework the registration, the licence and the post-market duties are held by the same local party, so a service that stops at the certificate leaves the client exposed at the point where the obligations actually begin.

• AR and EL: licensing and maintenance of the establishment licence.
• Registration: Class A to Class D, including IVD.
• Technical file: CSDT preparation and management of the CAB assessment.
• Verification pathway: design of the route that uses CE, FDA or other national approvals.
• Quality system: GDPMD compliance.
• Post-market: hosting of MPR, FCA, change notification and renewal obligations.
• Five-step process: free feasibility assessment; proposal and quotation; documentation and assessment; registration and certification; certificate maintenance.
• Ledger standard: the four certificates and one calendar, with a T-6 month alert.

2. Legal basis

The service scope follows the instruments that create the obligations. Act 737 sets the registration requirement and the duty to report device-related incidents. The establishment licence regime governs who may import and distribute. The Medical Device (Duties and Obligations of Establishments) Regulations 2019 set the record and reporting duties. The Fifth Schedule sets the fees, which is why a quotation can separate government charges from professional fees. MDA/GD/0020 governs change notification, and the vigilance guidance governs mandatory problem reporting and field safety corrective action.

Two further elements shape the technical work. The CSDT structure determines how the dossier is assembled for the conformity assessment body, and the verification pathway determines whether an existing approval from a recognised jurisdiction can shorten the route. Both are design decisions taken early, and both are difficult to retrofit once a submission is underway.

3. Expert insights

Insight 1: the five-step process is sequenced to remove uncertainty before cost is committed.

The first step is a free registration feasibility assessment covering an initial classification judgement, pathway design and fee estimation. Only then does the process move to a proposal and quotation, with official fees and service fees itemised. The ordering matters: a client learns what the classification is likely to be, which route applies and what the likely cost range is before deciding whether to proceed. That is a different commercial posture from quoting first and discovering the pathway afterwards.

Insight 2: itemised quotations exist because the fee structure is public and the service market is not.

Government charges are published in the Fifth Schedule, so they can be verified. Service fees vary widely between providers, and a single bundled figure hides which part is which. Separating the two lets a client check every component against the schedule, and it makes the comparison between providers meaningful rather than rhetorical. The practice also has a compliance benefit: a client who knows the official charge is less likely to be surprised at the payment stage of a submission.

Insight 3: the compliance ledger is a control, not a deliverable.

Every client project is tracked against four certificates and one calendar: the EL, the registration certificate, the GDPMD certificate and the CAB certificate, with an expiry calendar and a T-6 month alert. The design assumes that the failure mode is not ignorance of the requirement but loss of sight of the date. A certificate that expires while a renewal is in progress creates a gap that cannot be closed retrospectively, and the alert exists to make that gap structurally unlikely.

Insight 4: post-market hosting is where the local presence earns its place.

MPR, FCA, change notification and renewal all require a local party who can act, not merely advise. Hosting those obligations means the AR holds the calendar, receives the signals and performs the notifications within the applicable timelines. For a manufacturer without a Malaysian entity, that is the difference between having a registration and having a maintained registration. The service is therefore less an add-on than the continuation of the registration itself.

Insight 5: regulatory change is handled as a standing item.

Significant regulatory changes, such as the reforms taking effect in 2026, are communicated proactively to clients with an updated plan. The commitment matters because the Malaysian framework has been moving: fees, verification pathways, import licensing and renewal have all changed within a short period. A service relationship that only responds to client questions will always be one cycle behind; a standing review keeps the plan current.

Insight 6: a low-cost assessment before commitment is the cheapest decision available.

Before an overseas market decision is taken, an assessment that resolves four variables — classification, pathway, fee and timeline — costs little and prevents the most expensive kind of rework, which is the rework that happens after a contract has been signed and a dossier has been built on the wrong assumptions. The preliminary assessment also produces a risk list, which is often the most useful output because it tells the client where the schedule is most likely to slip.

4. Practical recommendations

• Start with the free feasibility assessment. Bring the product name, intended use, existing certifications and target class.
• Ask for the quotation in two parts. Government charges against the Fifth Schedule, and service fees separately, so the total can be checked.
• Resolve classification and pathway before drafting. Both decisions shape the dossier and are expensive to change later.
• Keep the four certificates and the calendar in one place. The T-6 month alert should have a named owner and a defined action.
• Host the post-market obligations with the AR. MPR, FCA, change notification and renewal should sit with the party who can act locally.
• Request proactive notification of regulatory change. Ask how the provider tracks MDA announcements and how the plan is updated.
• Ask for the risk list with the proposal. The list of likely delays is more useful than a single optimistic timeline.
• Decide after the assessment, not before it. The four variables are cheaper to establish than to correct.

5. Verification checklist

• □ Product information assembled: name, intended use, existing certifications, target class
• □ Classification judgement obtained and documented
• □ Pathway options compared, including the verification route where a recognised approval exists
• □ Quotation received with government charges and service fees itemised
• □ Four certificates identified and the expiry calendar established with a T-6 month alert
• □ Post-market hosting scope agreed for MPR, FCA, change notification and renewal
• □ Regulatory conclusions of this series traced to MDA official documents, government gazettes and guidelines as listed in each article

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support across Southeast Asia, including Malaysia. Our team prepares dossiers to ASEAN CSDT structure, manages submissions and deficiency responses with the MDA, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com