MDA Medical Device Registration Overview (Medical Device Act 2012 / Act 737)

In Malaysia, almost every medical device is regulated under the Medical Device Act 2012 (Act 737) and the Medical Device Regulations 2012, with the Medical Device Authority (MDA) under the Ministry of Health as the competent authority. The core rule comes down to a single sentence: before any device can be imported, sold, or placed on the market in Malaysia, the device must first complete MDA registration, and the company handling it must hold the corresponding Establishment Licence. You cannot skip either one—an unregistered device cannot be marketed, and an unlicensed company cannot operate. This overview walks you through the system, the roles, the four-step process, costs, and timelines all at once.

Two core systems: device registration + establishment licence

Act 737 splits compliance into two tracks—“product” and “company”—and both must be cleared:

• Medical Device Registration: This targets the “product.” Each device is registered with MDA according to its risk class (A/B/C/D), and a registration number is issued. Per the MDA FAQ, only the Manufacturer and the Authorised Representative (AR) need—and are allowed—to apply for device registration.
• Establishment Licence: This targets the “company.” Under MDA rules, all establishments—manufacturer, authorised representative, importer, and distributor—must apply for an establishment licence in order to operate.

In other words: importers and distributors need only an establishment licence and cannot register devices themselves; they can only distribute devices “already registered by an AR or manufacturer.” Manufacturers and ARs, by contrast, must obtain both.

Four roles, and who is responsible for what

Two points here are often overlooked:

1. Different quality management systems: Manufacturers follow ISO 13485; ARs, importers, and distributors follow GDPMD (Good Distribution Practice for Medical Devices), audited and certified by a CAB, and the GDPMD scope must cover the device category you intend to distribute (for example, to handle implantable devices, the scope must include implantables).
2. Chain-of-distribution liability: If an AR appoints an unlicensed distributor, the AR itself is held responsible. Confirm your channel partner holds an establishment licence before signing them on.

Import vs. local: the key difference for overseas manufacturers

This is where brands from Taiwan, China, and Korea most often get stuck. An overseas manufacturer cannot apply to MDA for registration directly; it must appoint a licensed Local Authorised Representative (AR) in Malaysia, and the AR holds the device registration, liaises with MDA on the manufacturer's behalf, and takes on the post-market obligations.

A local manufacturer, by contrast, can hold both the establishment licence and the device registration itself, with no separate AR needed. So the very first step for an imported brand is always “find and sign on an AR first,” not prepare documents first. For the AR's role and obligations, see Authorised Representative (AR) for Medical Devices: a must for foreign manufacturers.

Step 1: First determine which class your device falls into

Malaysia uses a four-tier risk classification (Class A/B/C/D), consistent with the ASEAN Medical Device Directive (AMDD) and the GHTF/IMDRF model:

• Class A — low risk (e.g. non-sterile bandages, wheelchairs, surgical retractors)
• Class B — low to moderate risk (e.g. hypodermic needles, suction equipment)
• Class C — moderate to high risk (e.g. ventilators, orthopaedic implants)
• Class D — high risk (e.g. heart valves, implantable pacemakers)

The class determines which path you take, whether you need a CAB, and how much you pay. Under the MDA system, Class B, C, and D must first go through a CAB (Conformity Assessment Body) assessment, while Class A generally does not require a CAB technical assessment. For the classification rules and more examples, see Medical Device Risk Classification A / B / C / D.

Steps 2 to 4: How the registration process works

The full process runs roughly as follows (using an overseas brand as the example):

1. Appoint a Local Authorised Representative (AR): The AR must hold an MDA establishment licence and a valid GDPMD, and have a MeDC@St account.
2. Self-classification: Determine A/B/C/D per the MDA classification guidance, and prepare the CSDT (Common Submission Dossier Template) technical documentation.
3. Submit to a CAB for conformity assessment (Class B/C/D): The CAB reviews the technical dossier and quality system and issues an assessment certificate and audit report. Class A does not need to pass through the CAB gate.
4. Submit the registration to MDA via the MeDC@St online system: After review, MDA issues the registration number; only then is the device legal to market.

Don't let up once on the market: the AR/manufacturer must continuously carry out post-market surveillance / vigilance and renew the registration before it expires.

MeDC@St and the conformity assessment routes

Medical device registration in Malaysia runs end-to-end through MDA's online system, MeDC@St—from creating the file to submission and later renewal, everything is done within the system. This is exactly why an overseas brand must first have an AR that already holds a MeDC@St account. On the technical documentation side, the CSDT (Common Submission Dossier Template) is widely used, organising the device description, intended purpose, risk management, verification and clinical evidence, labelling, and so on into a single structured dossier.

Conformity assessment follows different routes depending on the device's risk and existing approval status: high-risk devices typically go through a full conformity assessment, with the CAB reviewing the technical dossier and quality system item by item; if a device has already been approved in a recognised reference country, in some cases it can take a more streamlined verification route, shortening the review time. For the routes actually available and the documents required, always rely on MDA's current guidance—don't assume based on experience from other countries.

Quality systems: ISO 13485 vs GDPMD

The quality management system is an often-overlooked link that can hold you up. Manufacturers must comply with ISO 13485 (medical device quality management system); while ARs, importers, and distributors must obtain GDPMD (Good Distribution Practice for Medical Devices) certification, audited and issued by a CAB. Pay special attention to the GDPMD scope: the certificate must cover the device categories you actually handle (e.g. implantable, in-vitro diagnostic, etc.); if the scope doesn't match, even a valid certificate won't get you through. When choosing an AR, an overseas brand must confirm that the AR's GDPMD scope covers your products.

Maintenance obligations: changes and renewals

Registration is not “done once you get it.” If a device undergoes a significant change (e.g. to specifications, intended purpose, or place of manufacture), it must be notified or re-assessed as required; the registration certificate generally has a 5-year validity, and renewal must be handled before expiry (MeDC@St typically opens the renewal function one year before expiry). Lapsing affects legal marketing. Post-market vigilance reporting, complaint handling, and recall management are also ongoing obligations of the AR/manufacturer—factor these maintenance costs into your market-entry plan so you don't discover after launch that you're short on manpower and budget.

Costs and validity (subject to the official current fee schedule)

Costs fall into two blocks: “government fees” and “third-party costs.” Government fees vary by class; the Class A fee was substantially raised effective 1 January 2026 (the application fee was increased from RM100, with a registration fee newly added), so before submitting be sure to confirm the current amount against MDA's latest official fee schedule.

On top of that come third-party costs: CAB assessment, GDPMD certification, AR annual fees, establishment licence annual fees, and so on, which vary widely with device complexity. The device registration certificate is generally valid for 5 years, and must be renewed before expiry (MeDC@St typically opens renewal one year before expiry). The amounts above are for planning only; actual figures are subject to MDA's official fee schedule and quotations. For detailed cross-category costs, see How much do the various certifications cost? A cost overview.

How to gauge the timeline

Processing time varies greatly by route: Class A is faster (a matter of weeks), while Class C/D requiring a full conformity assessment can take months (the CAB assessment itself is measured in working days). Overseas brands should not forget to factor in the lead time for “finding an AR and preparing the CSDT documents.” For cross-category timeline planning, see How long do the various certifications take? A timeline overview.

Common mistakes

• Assuming an importer can register a device itself: It cannot; registration can only be held by an AR or a manufacturer.
• Preparing documents before finding an AR: The order is backwards—without an AR you can't even submit through MeDC@St.
• GDPMD scope not covering the device category: You have the certificate but it doesn't match the category, and you're still blocked.
• Selling an aesthetic laser as an ordinary consumer product: From 2026, some aesthetic devices have been designated as medical devices (see the FAQ below), and use claims must align with the approved scope.
• Ignoring post-market obligations: Registration is not the finish line—vigilance reporting and renewal both need attention.

Frequently asked questions (FAQ)

Q: Can an overseas manufacturer register with MDA on its own? No. An overseas manufacturer must first appoint a licensed Local Authorised Representative (AR) in Malaysia, and the AR holds the registration and liaises with MDA on the manufacturer's behalf.

Q: Must every medical device be registered? In principle, yes. Any medical device to be imported, sold, or placed on the Malaysian market must complete MDA registration under Act 737; the company handling it must also hold the corresponding establishment licence.

Q: Which classes require CAB conformity assessment? Class B, C, and D must first go through a CAB (Conformity Assessment Body) assessment; Class A generally does not require a CAB technical assessment, but must still complete registration.

Q: How long is the registration certificate valid? The device registration certificate is generally valid for 5 years and must be renewed before expiry; MeDC@St typically opens the renewal function one year before expiry.

Q: Do aesthetic lasers and HIFU also count as medical devices? Under the Medical Device (Designated Medical Device) Order 2026, several medical lasers, HIFU, and liposuction devices have been designated as medical devices effective 1 June 2026 and must be registered under Act 737. For details, see Do aesthetic / laser devices count as medical devices?.

Q: What's the difference between an establishment licence and device registration? The establishment licence governs the “company”—all manufacturers, ARs, importers, and distributors need it; device registration governs the “product”—only manufacturers and ARs can apply. Both must be in place to be compliant.

Self-check checklist

• [ ] Confirmed the device's risk class (A/B/C/D)
• [ ] (Overseas brands) Appointed a licensed Local Authorised Representative (AR)
• [ ] The company has obtained the corresponding establishment licence (manufacturer / AR / importer / distributor)
• [ ] Quality system in place (manufacturer ISO 13485; AR / importer / distributor GDPMD with scope covering the category)
• [ ] Class B/C/D CAB conformity assessment completed
• [ ] CSDT technical dossier prepared and submitted via MeDC@St
• [ ] Post-market surveillance, vigilance reporting, and 5-year renewal planned

Summary: The backbone of medical device compliance in Malaysia is the dual track of “device registration + establishment licence,” with MDA as the competent authority and Act 737 as the legal basis. The first step for an overseas brand is always to appoint a local authorised representative; next, follow the CAB and MeDC@St registration process according to risk class; costs and timelines vary by class and are subject to the latest official rates. Plan the roles, sequence, quality systems, and post-market obligations all in one go, so you don't fall at the last hurdle before clearance.

Run a free label check now

This article is compiled from official sources and is for reference only; actual compliance is subject to the latest official text and review by the competent authority.