Malaysia Post-Market Surveillance: The Establishment’s PMS Duty Checklist

1. Key takeaways

Post-market surveillance in Malaysia is a statutory duty, not a voluntary quality activity. Section 40 of Act 737 requires an establishment to report to the Medical Device Authority (MDA) any device-related incident of which it becomes aware, whether the incident occurred inside Malaysia or outside it. The Medical Device (Duties and Obligations of Establishments) Regulations 2019 add the record-keeping and reporting detail, and the PMS system is itself one of the four elements of CAB conformity assessment set out in the Third Schedule.

Because the obligation sits in two places at once, surveillance is examined twice in the life of a registration: as a conformity assessment element at registration, and again at renewal, where PMS is a fixed assessment item. A company that treats surveillance as an archive rather than an operating system usually discovers the gap during a renewal review or an MDA inquiry.

• Reporting duty: any device-related incident of which the establishment becomes aware, whether in Malaysia or abroad.
• Seven core duties: distribution and supply records; complaint handling records; defect and adverse event reporting (MPR); FCA and recall execution; conversion of risk management outputs into monitoring metrics; annual system self-check; cooperation with MDA inquiries and inspections.
• Territorial reach: section 40 is indifferent to where the incident happened, so signals from other markets enter the same assessment.
• Renewal exposure: weak PMS affects CAB re-assessment and may trigger a change of registration conditions; serious cases reach suspension or revocation.
• Linked provisions: failure in one area raises exposure under section 43 on user duties and section 44 on advertising.
• Minimum viable system: one SOP, three ledgers, one responsible person and an annual review report.

2. Legal basis

The framework places the reporting duty in the primary statute and the operating detail in subsidiary legislation, then folds the arrangement back into registration through the conformity assessment schedule. Section 40 creates the duty to report device-related incidents to the MDA. The 2019 Regulations prescribe the records that must be kept and the manner in which obligations are discharged. The Third Schedule to the MDR 2012 lists the PMS system as an element a conformity assessment body must assess, which is why the same obligations reappear at renewal.

Two features shape how a compliance programme should be built. The duty is triggered by awareness rather than internal confirmation, and it is satisfied by operating a system whose outputs can be shown to an assessor, not by holding documents.

3. Expert insights

Insight 1: the operative sentence in section 40 is the territorial one.

Companies habitually read the reporting duty as a local obligation and design vigilance around events occurring inside Malaysia. The wording does not support that reading: it covers incidents whether they occur inside or outside Malaysia. A safety signal raised in another market for the same device is therefore not merely commercially interesting; it belongs in the Malaysian assessment. The MDA’s position on foreign events follows the guidance in force at the time, which is why the reference set has to be refreshed rather than fixed. The design consequence is straightforward: foreign signals and domestic complaints should converge in the same register, or the foreign signal will be judged by someone who never sees the local file.

Insight 2: PMS is assessed as a system, and the assessment looks for evidence of operation.

PMS appears in the Third Schedule because the regulator wants assurance that a device remains safe after it leaves the factory gate. An assessor therefore looks for evidence that the system produced decisions: a complaint that led to an investigation, an investigation that led to a corrective action, a corrective action that was verified. A folder of procedures with no records of use does not demonstrate that. This is also why renewal carries the highest exposure, since a system dormant for the registration period becomes visible precisely when a delay is least affordable.

Insight 3: the seven duties are one loop, not seven tasks.

Read as a list, the seven duties look like separate workstreams owned by different departments. Read as a loop, they describe one cycle. Distribution records identify who received which batch; complaint and incident records show what went wrong; risk management outputs set the threshold at which a signal matters; the reporting duty determines what leaves the company and when; FCA and recall execution is the action taken at that threshold; the annual self-check examines the loop rather than merely operating it; cooperation with MDA inquiries is where it is tested from outside. Assigning each duty to a different owner without a shared register yields seven partial records and no reconstructable history.

Insight 4: build the minimum closed loop first, then refine it.

The minimum configuration is modest: one SOP, three ledgers, one responsible person and an annual review report. The responsible person is the AR’s responsible person, reflecting that the authorised representative is the local party the regulator can reach. Waiting for a fully instrumented quality system before starting any record-keeping is the commonest error, since the records that matter most are created in the months when nothing appears to happen.

Insight 5: the cheapest firewall is a dual sign-off on external material.

Section 44 exposure rises whenever the underlying registration position is uncertain, which is why surveillance and advertising should share one control. Marketing and regulatory can operate an advertising compliance dual sign-off: no external material is released until it passes the three COA checks, namely claim and registration consistency, the presence of statutory information, and whether approval is required. The control costs little and catches failures that are expensive to unwind after publication.

4. Practical recommendations

• Write the section 40 trigger into the SOP in the regulator’s own terms. Define awareness, name the receiving role and set an internal escalation time that leaves room to assess the case before the external deadline.
• Consolidate the three ledgers before adding anything else. Complaints and incidents, FCA and recalls, and distribution records should share a common identifier so a batch can be traced from shipment to complaint to action.
• Merge foreign and domestic signals in one intake process. A single register with a field for where the event occurred stops the territorial wording being applied only half-way.
• Convert risk management outputs into named monitoring metrics. Each metric needs a threshold, an owner and a defined action, otherwise the risk file remains a document rather than a control.
• Run the annual self-check as a rehearsal. Reconstruct one incident end to end and see whether the records support the story before an assessor runs the same exercise.
• Operate the dual sign-off on every external asset. Website pages, congress material and social content should pass the same three checks before release.

5. Verification checklist

• □ Act 737 sections 44(1) and 44(2) confirmed against the current text
• □ Medical Device (Advertising) Regulations 2019 reviewed
• □ MDA/GD/0032 Code of Advertisement (December 2020) on file, including Annex A on diseases and conditions and Annex B on superlative claims
• □ MDA guideline Application for Medical Device Advertisement Approval – Requirements reviewed
• □ MDA website Advertisement column checked for the update of 5 February 2026
• □ Section 40, the 2019 Regulations and the Third Schedule PMS element mapped to one SOP
• □ Three ledgers and the AR responsible person named in the procedure

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support across Southeast Asia, including Malaysia. Our team prepares dossiers to ASEAN CSDT structure, manages submissions and deficiency responses with the MDA, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com