Malaysia CAB List and Selection Strategy for Conformity Assessment Bodies

1. Key takeaways

For Class B, C and D, the conformity assessment body is unavoidable. A Conformity Assessment Body is a third party registered by the MDA under section 10(1) of Act 737 and regulation 8 of MDR 2012, which carries out QMS, PMS, technical documentation and DoC assessment on the MDA’s behalf. Registration of Class B, C and D devices must be supported by a CAB report and certificate, so the choice of body is a structural decision rather than a procurement detail.

The registered list is published on the MDA website, and at the time of verification it ran to roughly 25 bodies. Each carries an MDA/CAB registration number and a registration validity period. Checking the validity before signing matters more than comparing brochures, because a body whose registration lapses mid-assessment leaves the file without a valid report, whatever the technical merits of the work performed.

• Legal basis: section 10(1) of Act 737 and regulation 8 of MDR 2012.
• Mandatory for: Class B, C and D registration, which requires a CAB report and certificate.
• Identity: MDA/CAB registration number plus a registration validity period, both to be checked before contracting.
• Scope limit: a CAB may only assess within its registered technical areas under the Fourth Schedule.
• Conflict rule: in the verification pathway, the Malaysian subsidiary of the same foreign notified body must be avoided.
• Switching: permitted mid-stream and at renewal under MDA/GL/08, but re-work is re-charged.

2. Legal basis

The registration of CABs is provided for in section 10(1) of Act 737 and regulation 8 of MDR 2012, and the Fourth Schedule governs their qualification and technical areas. The Fourth Schedule Appendix 1 sets out medical device technical area codes such as MD 0203, and a CAB may only conduct assessments within the areas for which it is registered. The published list below reflects the position in the version updated on 30 November 2023; the current list and validity dates on the MDA website take precedence.

Two further instruments shape the choice. Circular 1/2025 governs the verification pathway and requires that the Malaysian subsidiary of the same foreign notified body be avoided where that route is used, so that the second review is genuinely independent of the first. MDA/GL/08 confirms that the CAB may be changed at renewal. Neither instrument limits which body may be appointed in the ordinary pathway; both constrain how the appointment interacts with an existing foreign approval.

3. Expert insights

Insight 1: technical scope is a hard boundary, not a preference. The Fourth Schedule assigns technical area codes, and a body can only assess within the areas it is registered for. Appointing a capable CAB outside its registered scope does not produce a lesser report; it produces a report that cannot support the registration. The scope check should be done against the specific code that covers the device, not against the general description of the body’s practice.

Insight 2: the four-step screen is about fit rather than reputation. The sequence runs: technical area coverage under the Fourth Schedule; experience with comparable devices, particularly IVD and SaMD; scheduling and cost; and, where the verification pathway is used, the conflict rule in Circular 1/2025. The order matters. A body with excellent standing but no registered scope for the device fails at step one, and a body with scope but no comparable experience tends to convert its uncertainty into deficiency requests at step two.

Insight 3: the switching option is real but priced. A CAB can be changed mid-assessment, and at renewal another body may be appointed, which MDA/GL/08 expressly allows. What does not transfer is the work already completed: the re-done elements are charged again, and the file has to be re-presented to a reader with no history of it. The decision is therefore best taken on the basis of an honest estimate of re-work rather than on dissatisfaction with the current invoice.

Insight 4: the quotation is the first test of the relationship. A verbal estimate tells you what a body hopes the job will cost. A written quotation that specifies the assessment scope, the report template, the estimated person-days and the deficiency policy tells you how the body expects to work. The fourth item is the one that decides budgets, since deficiency rounds are where schedules slip, and a body unwilling to state its policy in writing has not yet committed to one.

4. Practical recommendations

• Verify the registration number and validity date on the MDA website before signing, and diarise the expiry against the assessment timeline.
• Confirm the technical area code that covers the device, rather than relying on a general statement of capability.
• Ask for comparable cases in the same device family, and specifically for software and IVD review experience where those categories apply.
• Apply the conflict rule where the verification pathway is used, and record the reasoning in the file.
• Require a written quotation covering assessment scope, report template, estimated person-days and deficiency policy. A verbal figure is not a basis for approval.
• Cost the switch before making it. Compare the re-work estimate against the expected gain, and keep the comparison on file.

The recurring failure is not a bad CAB but a mismatched one: adequate scope, wrong device experience, and a quotation that omitted the deficiency policy. All three are visible before signature, which is the point at which they are still cheap to correct.

5. Verification checklist

• □ CAB registration number and validity confirmed against the current MDA list
• □ Technical area code covering the device confirmed under the Fourth Schedule
• □ Comparable device experience evidenced, including IVD or SaMD where relevant
• □ Conflict rule under Circular 1/2025 applied and documented for the verification pathway
• □ Written quotation held, covering scope, template, person-days and deficiency policy
• □ Renewal route and CAB change option under MDA/GL/08 noted in the project plan
• □ Switching cost estimated before any change of body

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support across Southeast Asia, including Malaysia. Our team prepares dossiers to ASEAN CSDT structure, manages submissions and deficiency responses with the MDA, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com