Two-Track QMS Compliance: What ISO 13485 and GDPMD Each Govern

1. Key takeaways

Malaysia runs two quality tracks, and a registration file is only as strong as the weaker one. On the manufacturer side, section 4(b) of Act 737 requires devices to be manufactured in accordance with good manufacturing practice and with written directions issued by the MDA; local manufacturers must hold ISO 13485. On the establishment side, the authorised representative, importer and distributor must obtain a GDPMD certificate — Good Distribution Practice for Medical Devices — issued by a registered CAB.

The two tracks are often treated as separate projects owned by separate teams. They are not independent in effect. The manufacturer track supports the product; the establishment track supports the entity that places it on the Malaysian market, and a lapse in the second stops the first from being usable. For an overseas manufacturer, the practical consequence is that the factory certificate is necessary but never sufficient.

• Manufacturer track: section 4(b) of Act 737 — GMP and MDA written directions; ISO 13485 for local manufacturers.
• Establishment track: GDPMD certificate from a registered CAB, held by the AR, importer and distributor.
• GDPMD scope: establishment, implementation and maintenance of a quality management system across the supply chain — warehousing, transport, traceability, complaints, records.
• Gate: GDPMD is a precondition for the establishment licence application.
• Linkage: a lapsed GDPMD freezes registration progress for products held under that establishment.
• Assessment status: QMS and PMS are fixed elements of CAB conformity assessment under the Third Schedule.

2. Legal basis

The two obligations come from different places in the framework, which explains why they are administered separately. The manufacturer obligation is statutory and general, sitting in section 4(b) of Act 737, and is elaborated through good manufacturing practice and the MDA’s written directions. The establishment obligation is licensing-based, set out in the MDA guidance on licensing for establishments, which requires the quality management system to be certified by a registered CAB. Both are then reflected in the Third Schedule to MDR 2012, where QMS and PMS appear as elements of the conformity assessment itself. The references were verified on 19 October 2026.

On cost, industry quotations for a single-warehouse audit commonly fall in the RM4,000 to RM5,000 range. This is a market reference and not official data, and should be treated as a practical estimate for budgeting rather than as a published fee. The same caution applies to scheduling, since audit dates depend on the CAB’s availability as much as on the applicant’s readiness.

3. Expert insights

Insight 1: ISO 13485 travels, GDPMD does not. A Chinese factory’s ISO 13485 certificate is accepted as manufacturer-side evidence, and it does not need to be re-obtained in Malaysia. What cannot travel is the distribution-side certification, because GDPMD certifies an entity operating in Malaysia against local warehousing, transport, traceability and record-keeping expectations. A manufacturer with an impeccable quality system and no GDPMD-certified local partner has a compliant product and no compliant route to market.

Insight 2: the certificate is not a one-off purchase. QMS and PMS are elements of the conformity assessment under the Third Schedule, which means the quality system is examined as part of the assessment rather than accepted on production of a certificate. The distinction matters at renewal and at the point of a change: a body that has let its system drift still holds a certificate, but the assessment looks at whether the system is operating, not at whether it was once certified.

Insight 3: the linkage runs in one direction and hurts immediately. When the GDPMD certificate of an establishment lapses, registration progress for the products held under that establishment freezes. There is no partial operation in which existing registrations continue while the licence is renewed, because the establishment is the holder of the market-facing obligations. This is the single most common cause of an unexpected stop in an otherwise healthy portfolio.

Insight 4: verifying the AR means verifying a certificate number. For a manufacturer selecting a local partner, the marketing presentation is a poor guide and the GDPMD certificate number and validity date are a good one. The registration number can be checked, the scope can be compared with the activities actually performed, and the expiry date can be diarised. That single check is worth more than any number of assurances about local capability.

4. Practical recommendations

• Keep one compliance ledger. Record the validity dates of four certificates — ISO 13485, GDPMD, the establishment licence and the device registration — in the same place.
• Start renewals six months ahead. The four certificates run on different cycles, and any one of them lapsing stops sales.
• Check the AR’s GDPMD number and expiry before appointment, and re-check at each renewal.
• Confirm the audit scope covers the actual sites. Fees are charged per warehouse or site, so scope and cost have to be established together.
• Budget on a practical estimate. Treat the RM4,000 to RM5,000 range as a market reference and obtain a written quotation per site.
• Treat the quality system as assessed, not certified. Keep the system operating between audits, since the conformity assessment looks at current operation.

The point of the single ledger is not administrative tidiness. It makes visible the one dependency that manufacturers most often miss: the product certificate and the entity certificate expire independently, and the market access depends on both being valid on the same day.

5. Verification checklist

• □ Manufacturer ISO 13485 certificate current, with scope covering the registered device
• □ GDPMD certificate held by the AR, importer or distributor, with number and expiry recorded
• □ GDPMD scope consistent with the warehousing and distribution activities performed
• □ Establishment licence application supported by a valid GDPMD certificate
• □ All four certificate expiry dates tracked in one ledger
• □ Renewals initiated six months before expiry
• □ Audit fee budgeted on a practical estimate and confirmed by written quotation

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support across Southeast Asia, including Malaysia. Our team prepares dossiers to ASEAN CSDT structure, manages submissions and deficiency responses with the MDA, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com