Malaysia MDA Medical Device Registration: 24 Questions on AR, CAB and MeDC@St, Plus the Singapore-Malaysia-Thailand Regulatory Reliance Mechanism

Malaysia is the second largest medical device market in ASEAN, and a market that Chinese companies cannot bypass when expanding into Southeast Asia. On first contact with MDA registration, three terms cause the most difficulty: AR, CAB and MeDC@St. This article sets out the core rules of Malaysian MDA registration through 24 questions and answers, and separately examines the Singapore-Malaysia-Thailand trilateral regulatory reliance mechanism that came into effect in 2026.

1. Regulatory Framework and Basic Concepts

Q1. Which authority regulates medical devices in Malaysia, and under what law?

Medical devices in Malaysia are regulated by the Medical Device Authority (MDA) under the Ministry of Health (MOH).

All registration applications, licence applications and change notifications are submitted through the MDA electronic system MeDC@St (Medical Device Centralised Online System).

Q2. How are medical devices classified in Malaysia?

Malaysia adopts the ASEAN Medical Device Directive (AMDD) framework, dividing devices into Class A, B, C and D by ascending risk. Indonesia, Thailand, Vietnam and other ASEAN countries use the same four-tier logic.

Classification is based on: duration of use, degree of invasiveness, whether the device contains energy or is active, intended use, and the vulnerability of the human body. The detailed rules are in the First Schedule of the Medical Device Regulations 2012 and the MDA classification guidelines (MDA/GD/0009 for general devices, MDA/GD/0001 for IVD).

Q3. What process does each of the four classes go through?

In one line: Class A is exempt from CAB, while Classes B, C and D must go through CAB. This is the most distinctive feature of Malaysia compared with some other ASEAN countries.

Under MDA/GD/0070, Class A devices are exempted from the CAB conformity assessment procedure (see the Medical Devices (Exemption) Order 2024). Classes B, C and D must be assessed by a CAB registered with the MDA.

Q4. What is AR, and why must a foreign manufacturer have one?

AR (Authorized Representative) is the statutory representative of a foreign manufacturer in Malaysia.

An AR must hold both of the following qualifications, without exception:

• an Establishment Licence issued by the MDA; and

• a GDPMD certificate (Good Distribution Practice for Medical Devices), certified by a body recognised by the MDA.

Q5. What is the difference between an AR and a distributor?

The two have entirely different legal roles and must not be conflated.

Both require an Establishment Licence, but only the manufacturer or the AR may apply for product registration.

2. Registration Routes and Core Process

Q6. How many conformity assessment routes are available for Classes B/C/D?

There are two main routes. Whether the faster route is available depends on whether the product already holds approval from a recognised reference authority.

MDA-recognised Competent Authorities include:

Under Annex 1 of MDA/GD/0070, acceptable approval types include FDA 510(k) or PMA, EU MDR/IVDR certificates, TGA ARTG registration and Canadian Health Canada licence.

Q7. What conditions must be met to use the verification route?

Under Section 4.3 of MDA/GD/0070, the product must satisfy all of the following:

• holds approval from at least one MDA-recognised reference agency or notified body;

• the design and intended use of the device to be marketed in Malaysia are fully identical to the approved device;

• no global safety issues in the last 1 year, specifically:

– no death reports; and

– no reports of serious deterioration in health status; and

– no unclosed field safety corrective actions, including recalls, at the time of submission; and

– all incident reports and corrective and preventive actions have been closed; and

• the product has not been refused or had its approval withdrawn by any reference agency.

Note: where the approval of the reference agency has been revoked or has lapsed, the product must return to the full assessment route.

Q8. What are the two stages of registration?

Registration proceeds in two stages (Class A is exempt from Stage 1):

• Stage 1 — Conformity Assessment: the manufacturer collects and compiles conformity evidence and submits it to the CAB for assessment;

• Stage 2 — Application to MDA: the CAB assessment report, certificate and complete technical dossier are submitted through MeDC@St, and the MDA reviews the application and decides whether to issue a certificate.

The conformity assessment must cover four elements (Part II of the Third Schedule of the Regulations):

All evidence must be structured according to the CSDT (Common Submission Dossier Template), the template for which is set out in MDA/GD/0008.

Q9. How long is the registration certificate valid, and when can renewal begin?

Five years. After registration or re-registration, the device is valid for 5 years and is listed in the Malaysian Device Access Register (MDAR).

Re-registration:

• the system opens the renewal window 1 year before the certificate expires;

• renewal is not a fresh submission from scratch; the MDA reviews whether the existing registration record, production documentation and conformity assessment status remain valid;

• the MDA verifies that the AR or manufacturer licences and the device CAB certificates are still within their validity periods.

Q10. What are the official review timeframes at each stage?

Under Section 6.4 of MDA/GD/0070, MDA review timeframes, assuming complete documents and fees paid, are:

The CAB timeframe covers completion of assessment, preparation of the report and issuance of the certificate; it does not include the time required for the company to respond to queries.

Indicative end-to-end estimates:

• Class A: CAB review exempted;

• Class B/C/D full route: official target 2 to 10 months;

• Verification route: approximately 1 to 2 months.

Q11. What are the official fees?

Under Section 6.5 of MDA/GD/0070, fees are set out in the Fifth Schedule of the Medical Device Regulations 2012, charged per application and corresponding to a 5-year validity period:

Note: the above are government fees only. Third-party costs include CAB assessment fees (varying by class and body, typically RM 15,000 to 50,000 and above), AR annual fees, GDPMD certification fees and Establishment Licence annual fees.

3. Establishment Licensing and Compliance Operations

Q12. What is an Establishment Licence, and who needs one?

Under Section 15(1) of Act 737, no establishment may import, export or place a registered medical device on the market before obtaining an Establishment Licence.

Under MDA announcements, a “One Licence per Role” policy has applied since 1 July 2024. Licences are valid for 3 years, independent of the 5-year cycle of the product registration certificate.

On practical points: where documents are complete, the MDA commits to approving licence applications within 14 to 21 working days.

Q13. What is GDPMD, and why is it so critical?

GDPMD (Good Distribution Practice for Medical Devices) is Malaysia’s quality management requirement for the distribution of devices, audited and certified by an MDA-recognised certification body (CAB).

It is not optional but a prerequisite for licensing:

• importers, distributors and ARs must hold a GDPMD certificate in order to obtain an Establishment Licence;

• manufacturers require ISO 13485 and must also satisfy GDPMD requirements.

Compliance recommendation: manage the AR’s GDPMD expiry date, the Establishment Licence expiry date and the product registration expiry date together on a single monitoring table.

Q14. Do import permits need to be obtained now?

Not yet mandatory, but they should be prepared in advance. The MDA has established import control with Malaysian Customs through the ePermit / DagangNet system. Under this system, all medical device importations will require an import permit.

Recommendation: include the import permit in the 2026 to 2027 preparation list, complete system registration and process rehearsal ahead of time, so as to avoid being unprepared when it becomes mandatory.

Q15. What ongoing compliance obligations apply after registration?

Registration is only the beginning. The holder (AR or manufacturer) must continuously discharge post-market obligations under Act 737:

• Distribution records: must be traceable and retained for at least 5 years;

• Post-market surveillance (PMS) and vigilance: a PMS system must be established and maintained, available for official review;

• Complaint handling: all complaints must be recorded, investigated and closed out;

• Mandatory Problem Reporting: see Q16;

• Field Corrective Actions (FCA) and recalls: to be executed and reported where necessary;

• Periodic safety update reports: as part of registration maintenance;

• Change Notification: any change affecting safety, performance or labelling must be notified.

Legal anchors: Sections 37 to 42 of Act 737 respectively cover distribution records, post-market surveillance and vigilance, complaint handling, mandatory problem reporting, field corrective actions and recalls.

Q16. What are the statutory deadlines for adverse event reporting?

Under Section 40 of Act 737 and the MDA mandatory problem reporting requirements, deadlines vary by the nature of the event:

Supplementary rules:

• the investigation (final) report must be submitted within 30 days of the initial report;

• regardless of whether the incident occurred in or outside Malaysia, it must be reported to the MDA where the device is registered in Malaysia. An exemption applies where a report has already been made to the regulator of the country of occurrence and the necessary corrective actions have been taken for all affected devices in the Malaysian market.

Reporting channel: online through the MDA MeDCReSt system; combination products must be submitted by email to mpr@mda.gov.my.

4. Labelling, Changes and Systems

Q17. What language should the label and IFU use?

Mandatory label content (summary):

• the Malaysian medical device registration number (the MDA encourages use of the QR code on the registration certificate);

• device name, model, batch or serial number, date of manufacture and/or expiry;

• manufacturer name, address and contact details (contact details for foreign manufacturers are optional);

• the AR’s name, address and contact details;

• product description and intended use;

• adverse side effects, limitations, warnings and precautions;

• post-market service, retirement and disposal information.

On Halal certification: Act 737 does not require medical devices to obtain Halal certification, and the MDA does not treat Halal as a registration requirement. Halal certification (MS 2636) is managed separately by JAKIM and is a voluntary commercial plus. Products using animal-derived materials, such as porcine or bovine components, should nevertheless monitor developments.

Q18. What should be done if the design or label is changed after registration?

A Change Notification (CN) process applies. Malaysia classifies changes into three categories according to their impact:

Review timeframe: approximately 30 working days for an individual Category 2 or 3 application; approximately 60 working days for combined or batch submissions.

Q19. What is MeDC@St, and why should it be familiarised with in advance?

MeDC@St (Medical Device Centralised Online System) is the MDA unified electronic submission system, covering classification applications, registration applications, licence applications and renewals, change notifications and payment of fees.

Why it matters:

• all submissions must go through it; there is no offline channel;

• the application fee must be paid within the window notified by the MDA, normally 30 days; overdue applications are voided;

• if an official input request is received after submission, each point must be answered in writing with the corresponding file names identified in the system;

• the platform itself is evolving: MeDC@St 3.0 and an automated re-registration route are in progress, involving the transition to a new change management framework.

Practical recommendation: the AR must hold a valid MeDC@St account and be capable of operating it. Completing an account and file format rehearsal before filing significantly reduces delays caused by systemic issues.

5. Singapore-Malaysia-Thailand Trilateral Regulatory Reliance

Q20. What exactly is the “New Malaysia-Thailand-Singapore mutual recognition”?

Its accurate name is regulatory reliance, not “one certificate for all markets” or an automatic mutual recognition certificate.

The actual position across the three countries is two-way reliance on one pair, and none on the other:

In other words, the hub of the trilateral arrangement is the Malaysian MDA. Singapore and Thailand have each established bidirectional reliance with Malaysia, but there is no direct arrangement between Singapore and Thailand. For Chinese companies this means that using Malaysia as a springboard to reach all three countries with a single registration is genuinely feasible (see Q23).

Q21. How does the Malaysia–Singapore reliance work in practice?

This is a bidirectional arrangement. On 22 August 2025 the two countries signed a Memorandum of Understanding at the 14th ASEAN Medical Device Committee (AMDC) meeting in Siem Reap. The pilot ran from 1 September 2025 to 28 February 2026, and from 1 March 2026 it became a long-term mechanism.

Direction 1: Singapore to Malaysia

• Class B/C/D devices already registered on the Singapore Medical Device Register (SMDR) may use the MDA verification route;

• CAB verification takes approximately 30 working days (compared with 60 for a full assessment), followed by MDA registration review of approximately 30 working days;

• the product must be fully identical to the Singapore registered version, with no change in design, specification, intended use, indications or raw materials.

Direction 2: Malaysia to Singapore

• Class B/C/D devices registered with the Malaysian MDA through full CAB conformity assessment and MDA review may use the HSA abridged evaluation route;

• review time is reduced by up to approximately 30 per cent compared with the HSA standard full route;

• when filing in Singapore, select “Regulatory reliance Program: Malaysia Medical Device Authority (MDA)” under Evaluation Route in the SHARE system;

• submit: a copy of the MDA registration certificate, the CAB conformity certificate, and the abridged route documents specified by GN-15.

Note: according to the official MDA announcement, HSA approval has been included in the list of approvals acceptable under the verification procedure with effect from 1 March 2026; the official press release was issued during the 29th IMDRF meeting in Singapore.

Q22. How does the Malaysia–Thailand reliance work in practice?

Also bidirectional. The two regulators signed a confidentiality agreement at the 29th Global Harmonization Task Force (GHWP) annual meeting in Bangkok in December 2025. The pilot ran from 1 February 2026 to 30 April 2026, and it has been fully implemented since 1 May 2026 with no end date.

Direction 1: Thailand to Malaysia

• Class B/C/D devices already approved by the Thai FDA may use the MDA verification route in the same way as Singapore;

• CAB verification takes approximately 30 working days and MDA registration review approximately 30 working days.

Direction 2: Malaysia to Thailand

This direction is of considerable value to companies already registered in Malaysia:

• devices approved by the MDA are exempted from the external expert review that Thailand otherwise mandates when submitting a complete CSDT;

• the review period is shortened from approximately 150 calendar days to approximately 120 calendar days, and the expert review fee is waived;

• external expert review has historically been the most time-consuming and least predictable stage of the Thai registration process, so exempting it represents a substantive acceleration.

The hard conditions applying on the Thai side must each be satisfied:

• the device must hold a formal MDA registration approval, excluding products approved through special notification routes or exempted from quality, safety and effectiveness assessment;

• the version submitted to Thailand must be fully identical to the MDA-approved version: trade name, model designation, product code, intended use, indications, labelling, accompanying documents and packaging must be identical;

• a complete CSDT dossier identical to the version submitted to the MDA must still be submitted. The documentation is not reduced; what is removed is the review stage.

Q23. How can a Chinese company use this mechanism to reach three countries at once?

Because the hub of the reliance mechanism is Malaysia, using Malaysia as the regional pivot is currently the most efficient three-country strategy. Two recommended routes:

Three practical reminders:

1. Product consistency is a hard threshold. The precondition for the three-country linkage is that the product is the same version. Any design, labelling or indication change made for one country may break the applicability of the entire chain, so regional versions must be planned consistently.
2. Class A devices are not covered. The reliance mechanisms cover only Class B/C/D devices (corresponding to Thai Class 2/3/4). Class A procedures are already simple, so the conventional simplified route in each country is sufficient.
3. Reliance does not remove the local holder requirement. Under any route, Malaysia still requires a local AR, Singapore still requires a local Registrant, and Thailand still requires a local licence holder. Institutional licensing and compliance obligations in each jurisdiction are not relieved by reliance.

Strategic implication: for Chinese companies expanding into ASEAN, “one core registration plus two reliance levers” can significantly compress the overall time and compliance cost for the three countries, avoiding three independent full assessment processes. This is a direction explicitly supported by the Director-General of the MDA at the 29th GHWP annual meeting: regulatory reliance is becoming the mainstream model of ASEAN cooperation, and early movers capture the benefit of the mechanism.

6. Five Common Pitfalls