The Malaysian Medical Device Authority (MDA) has released the second edition of its Guidance Document on Distribution Records (MDA/GD/0012) for public consultation.
This revision updates the first edition issued in 2020, focusing on the scope of distribution records, product identification, storage and delivery records, record retention periods, traceability of implantable medical devices, and the allocation of responsibilities among manufacturers, authorised representatives, importers and distributors.
Notable changes include further refinement of distribution record requirements, new installation, configuration and delivery record requirements for SaMD, and an extension of implantable medical device traceability down to the patient level.
Official source: https://portal.mda.gov.my/index.php/announcement/1874-announcement-public-comment-second-edition-guidance-document-distribution-records
1. Key facts about the document
| Item | Details |
|---|---|
| Issuing authority | Malaysian Medical Device Authority (MDA) |
| Document title | Distribution Records |
| Document number | MDA/GD/0012 |
| Edition | Second Edition |
| Document date | October 2026 |
| First edition date | June 2020 |
| Document status | Draft for public consultation |
| Consultation period | 3-18 November 2026 |
This guidance should be read together with the following Malaysian regulations currently in force:
| Regulation | Reference number |
|---|---|
| Medical Device Act 2012 | Act 737 |
| Medical Device Regulations 2012 | – |
| Medical Device (Duties and Obligations of Establishments) Regulations 2019 | – |
2. Main revisions in the second edition
According to the revision history, the second edition makes comprehensive adjustments to the original chapters, as summarised below:
| Revised section | Key changes in the second edition |
|---|---|
| 1. Introduction | Adds explanations of risks in the distribution phase, Good Distribution Practice for Medical Devices (GDPMD), and prevention of non-conforming and counterfeit medical devices from entering the supply chain |
| 2. Scope | Clarifies that distribution records must be established, maintained and retained for all medical devices placed on the market |
| 3. Terms and definitions | Adds definitions of distributor, establishment, field corrective action (FCA), implantable medical device, UDI and licence holder |
| 4. General requirements | Further clarifies requirements for distribution records, supply chain traceability and record control |
| 4.1 Content of distribution records | Details requirements for product identification, receipt, delivery, SaMD, product disposition and supporting documents |
| 4.2 Record maintenance | Clarifies requirements for record review, updating, identifiability and retrieval |
| 4.3 Record retention | Specifies retention periods for distribution records and aligns them with the 2019 establishment duties regulations |
| 4.4 Record control | Adds requirements for record security, integrity, retention and provision to the regulatory authority |
| 4.5 Implantable device traceability | Further clarifies requirements for traceability to healthcare facilities and to the patient level |
| 5. Establishment responsibilities | Adds responsibilities for establishing and implementing distribution record systems across all types of establishments in the supply chain |
| Appendix A | New minimum content checklist for distribution records |
The core of this revision is to further clarify record management requirements for medical devices as they move through the supply chain, and the responsibilities of each participant in that chain.
3. Scope: covering the entire medical device supply chain
The second edition makes clear that the guidance applies to all medical devices placed on the Malaysian market.
| Establishment | English name | Main activities involved |
|---|---|---|
| Manufacturer | Manufacturer | Product supply and distribution management |
| Authorised representative | Authorised Representative (AR) | Supply chain product information and related management |
| Importer | Importer | Import, storage and delivery of medical devices |
| Distributor | Distributor | Storage, sale and delivery of medical devices |
Establishments need to establish a record management mechanism covering the entire distribution process:
| Distribution stage | Main records |
|---|---|
| Product receipt | Quantity received, source and related documentation |
| Product storage | Warehouse information, storage conditions |
| Product delivery | Dispatch date, customer information, quantity delivered |
| Final supply | The location where the product is finally supplied for use by the patient or user |
| Product disposition | Disposition records for expired, damaged or recalled products |
The guidance requires distribution records to support tracing of products from the manufacturer or authorised representative to the end user, and to support field corrective actions (FCA) or product recalls where necessary.
4. Further detail on distribution record content
This is one of the most important revisions in the second edition.
Under Section 4.1 and Appendix A, the distribution records establishments need to maintain mainly cover the following:
4.1 Customer and warehouse information
| Record category | Specific requirements |
|---|---|
| Consignee information | Consignee name, address, contact telephone number and email address |
| Storage facility information | Warehouse name, address, contact telephone number and email address (where applicable) |
| Final place of use | The location where the medical device is finally supplied for use by the patient or user |
It is particularly important to note that warehouses used by importers and distributors before delivering products to customers must also be brought within the relevant record management.
4.2 Medical device product information
| Record item | Specific requirements |
|---|---|
| Medical device name | Product name |
| Brand name | Trade name or brand name |
| UDI | Record the UDI where applicable |
| Product quantity | Quantity received and quantity distributed |
| Product category | Medical device classification information |
| MDA registration information | Registration number and validity period of the registration |
| Model or version number | Required for products without a UDI |
| Lot number or batch number | Recorded for products without a UDI where applicable |
For medical devices without a UDI, product traceability must still be achieved through model, version number and lot or batch information.
In addition, the guidance clarifies the UDI: ‘unique’ in UDI does not mean that every individually produced unit must be serialised.
4.3 Software as a Medical Device (SaMD) records
The second edition further clarifies the distribution record requirements for Software as a Medical Device (SaMD).
| Record item | Specific requirements |
|---|---|
| Installation management | Installation information |
| Configuration management | Software configuration management information |
| Product identification | SaMD identification information |
| Delivery method | How the product is delivered |
| Target users | The intended user group for the product |
This means that SaMD distribution records need to cover not only product delivery but also information relating to installation, configuration and delivery.
4.4 Delivery and receipt records
| Record category | Specific requirements |
|---|---|
| Dispatch date | Date the product was dispatched or delivered |
| Purchase order | PO number |
| Delivery order | DO number |
| Customer information | Customer details such as healthcare facility, distributor or retailer |
| Customer contact details | Most up-to-date customer contact information |
| Quantity delivered | Quantity actually delivered |
| Receipt date | Date the consignee received the product |
| Quantity received | Quantity actually received |
| Remarks | Remarks relating to delivery or receipt (where applicable) |
These records should be capable of being matched against transport and delivery documentation.
4.5 Product disposition records
| Record item | Specific requirements |
|---|---|
| Whether disposed | Yes/No |
| Reason for disposition | For example, product expired, damaged, etc. |
| Date of disposition | Actual date of disposition |
| Method of disposition | How the product was disposed of |
For medical devices with a short shelf life, the guidance recommends that establishments consider the additional disposition situations that product expiry may cause.
4.6 Supporting documents
| Document type | Specific content |
|---|---|
| Invoices | Invoices relating to product receipt and supply |
| Purchase documents | Purchase orders |
| Sales documents | Sales orders |
| Supply chain list | List of establishments in the supply chain |
| Product supply information | The relevant medical devices supplied by each establishment |
| Authorisation documents | Letter of Authorisation (LoA) |
| Other documents | Other supporting materials required by the MDA |
5. Further clarity on record maintenance and retention periods
The second edition further details how establishments must maintain, update and retain distribution records.
5.1 Record maintenance requirements
| Management item | Specific requirements |
|---|---|
| Record verification | Verify the adequacy of records |
| Record updating | Update records promptly as circumstances change |
| Change management | Make it possible to identify what was changed after any modification |
| Record legibility | Keep records clear and identifiable |
| Record retrieval | Ensure records can be retrieved without delay |
| Obsolete records | Prevent obsolete records from being used in error and mark them appropriately when retained |
Establishments need documented procedures for distribution record management to ensure these requirements are implemented.
5.2 Retention periods for distribution records
Section 4.3 of the second edition specifies the retention periods for distribution records:
| Product situation | Retention period |
|---|---|
| Medical devices supplied on the Malaysian market | 2 years from the date of supply of the product |
| Exported medical devices | 2 years from the date the product is shipped out of Malaysia |
| Medical devices with an expected lifetime | Retain for the expected lifetime determined by the manufacturer |
For medical devices with an expected lifetime, records should be retained for the longer of the applicable periods.
For example, if a medical device has an expected lifetime of 5 years, its distribution records should be kept for 5 years, not just 2 years.
5.3 Regulatory access and record control
| Management requirement | Specific content |
|---|---|
| Regulatory access | Establishments must provide distribution records when requested by the MDA |
| Record security | Establish controls for record security and integrity |
| Record retention | Define retention periods for records |
| Record retrieval | Ensure records can be accessed without delay |
| Record disposition | Establish procedures for record disposition |
| CAB audits | CABs may inspect or audit the distribution records maintained by establishments |
6. Implantable medical devices: traceability extended to the patient level
This is a revision that deserves particular attention in the second edition.
Section 4.5 of the second edition makes clear that, in addition to meeting the general distribution record requirements, implantable medical devices require the following additional information:
| Record category | Specific requirements |
|---|---|
| Healthcare facility information | The healthcare facility where the implantation procedure was performed |
| Surgical department | The specific department where the implantation procedure was performed |
| Patient information | Information on the patient in whom the medical device was implanted or who uses the device |
| Date of implantation | The actual date the medical device was implanted |
| Explant information | Information relating to removal of the medical device |
| Date of permanent explant | The date the medical device was permanently removed from the patient (where applicable) |
At the same time, establishments must ensure that the distribution and traceability records for implantable medical devices are accurate and complete, and can be retrieved without delay.
Traceability requirements in different scenarios:
| Party or scenario | Traceability requirement |
|---|---|
| Routine record management by establishments | Ensure traceability down to the patient level |
| CAB assessment | Assess whether the establishment’s traceability system can trace to the healthcare facility level |
| MDA regulatory inspection | Provide the relevant traceability records as required |
| Post-market event investigation | Provide patient-level information |
| Field corrective action (FCA) | Support patient-level traceability |
| Product recall | Support patient-level traceability |
This means that, for implantable medical devices, merely recording which hospital a product was sold to may not be sufficient to meet the traceability requirements set out in the second edition.
7. Further clarity on the responsibilities of manufacturers, ARs, importers and distributors
Section 5 of the second edition sets out the responsibilities of the different parties in the supply chain in Table 1.
| Responsibility | Manufacturer | AR | Importer | Distributor |
|---|---|---|---|---|
| Product registration | Responsible for registering medical devices with the MDA | – | – | – |
| Product import | – | – | Import only registered or explicitly exempted medical devices | – |
| Product distribution | – | – | – | Distribute only registered or explicitly exempted medical devices |
| Storage and transport requirements | Establish the relevant requirements | Communicate the manufacturer’s requirements to importers and distributors | Comply with the manufacturer’s requirements | Comply with the manufacturer’s requirements |
| Product traceability | Participate in and support the establishment of traceability mechanisms | Participate in and support the establishment of traceability mechanisms | Participate in and support the establishment of traceability mechanisms | Participate in and support the establishment of traceability mechanisms |
| Complaint investigation | Obtain relevant information and support the investigation | Cooperate with the relevant investigation | Provide distribution records to the manufacturer or AR | Provide distribution records to the manufacturer or AR |
In addition, all establishments in the supply chain must implement the following:
| Shared responsibility | Specific requirements |
|---|---|
| Supply chain traceability | Establish traceability measures from the manufacturer or AR and importer through to customers and patients |
| Information cooperation | Cooperate with other establishments in the supply chain to maintain product traceability |
| Provision of records | Within the applicable retention period, be able to provide the MDA with information on product supply and consignees |
| Product identification | Record the date of activity, product name, supplier and customer information |
| Lot management | Record product serial numbers or lot numbers and expiry dates |
| Complaint investigation | Cooperate with the manufacturer or AR in complaint investigations and other post-market activities |
For complaint investigations, manufacturers should obtain the necessary information from importers, distributors, healthcare facilities or other relevant parties; importers and distributors in turn need to provide the corresponding distribution records to the manufacturer or AR to support post-market surveillance activities.
8. Regulatory consequences of failing to maintain distribution records
| Regulatory matter | Specific requirement |
|---|---|
| MDA regulatory powers | The MDA has the power to require establishments to provide distribution records |
| CAB audits | CABs may inspect or audit the distribution records maintained by establishments |
| Non-compliance | Failure to maintain distribution records as required under Section 37 of Act 737 may constitute an offence |
| Basis for enforcement | Medical Device (Compounding of Offences) Regulations 2024 |
Distribution records are not merely internal warehouse and sales management materials; they are also a key basis for regulatory inspections, complaint investigations, field corrective actions and product recalls.
9. Implications and recommendations for medical device companies
In light of this revision, companies that already hold Malaysian registrations or are doing business in the Malaysian market should focus on reviewing the following:
| Company concerned | Recommended focus areas |
|---|---|
| Medical device manufacturers in China | Establish records of product lot numbers, dispatch, customers and sales, and ensure they can provide the relevant distribution information to their Malaysian AR |
| Malaysian ARs | Clarify the information transfer mechanisms with manufacturers, importers and distributors |
| Malaysian importers | Strengthen records of import documentation, product receipt, warehousing and downstream delivery |
| Malaysian distributors | Establish customer files, sales records, product lot records and final delivery records |
| Implantable device companies | Establish a traceability mechanism covering healthcare facility, surgical department, patient and implantation date information |
| SaMD companies | Strengthen records of software version identification, installation and configuration, and product delivery |
For manufacturers in China working with third-party ARs, importers or distributors in Malaysia, it is advisable to clarify each party’s record retention and information provision responsibilities in advance, to avoid gaps in traceability information as products move through the supply chain.
10. Consultation arrangements
The second edition of the Distribution Records guidance is currently open for public consultation.
| Item | Details |
|---|---|
| Consultation start date | 3 November 2026 |
| Consultation deadline | 18 November 2026 |
| Submission email | guidancedocument@mda.gov.my |
| Submission method | Using the Public Comment Form provided by the MDA |
Industry stakeholders wishing to submit comments may do so within the specified period using the feedback form provided by the MDA.
Conclusion
The MDA’s revision of the Distribution Records guidance further clarifies the record management requirements for medical devices circulating in the Malaysian market.
From product identification, UDI and lot number management, through warehousing, delivery and record retention, to patient-level traceability for implantable medical devices, the second edition places greater emphasis on the completeness and traceability of information across the entire supply chain.
For medical device companies already in the Malaysian market, attention should go beyond product registration and certificate maintenance to post-market distribution record management, with mechanisms for information management with local ARs, importers and distributors put in place early.
Note: This article is based on the second edition of the ‘Distribution Records’ guidance document published for public consultation by the Malaysian Medical Device Authority (MDA) in October 2026. The document is currently a consultation draft, and the final requirements are subject to the official version subsequently published by the MDA.