Fast-Track Your Medical Device Approvals & Compliance in Malaysia

It depends almost entirely on your device class and how complete your dossier is on day one. As a planning guide, low-risk Class A registrations are the quickest, while Class B, C and D submissions take progressively longer because they require deeper conformity assessment by a registered Conformity Assessment Body (CAB) before the MDA evaluation even begins.

Realistically, plan for the conformity assessment stage plus the MDA evaluation stage, and add buffer for query rounds. The single biggest cause of delay we see is not the authority — it is an incomplete CSDT dossier that triggers repeated requests for information. A dossier that is right the first time can save you months.

Read the detailed breakdown in our guide: How long does MDA device registration take?

Yes. If you are an importer, distributor or authorised representative of medical devices in Malaysia, you need an Establishment Licence from the MDA, and demonstrating a conforming quality system is central to obtaining it. For distribution-side establishments that system is GDPMD — Good Distribution Practice for Medical Devices.

It is not simply a certificate you buy. A registered CAB assesses your actual operation: how you receive and store devices, how you maintain traceability, how you handle complaints, returns and recalls, and how you control storage conditions including cold chain where applicable.

Manufacturers typically demonstrate conformity through ISO 13485 instead. If you both manufacture and distribute, we will scope the right combination for your licence application.

ISO 9001 gives you a genuine head start — management commitment, document control, internal audit, corrective action and management review all carry across. But ISO 13485 is not ISO 9001 with a medical label on it.

The additions that matter most are regulatory-requirement traceability throughout the QMS, formal risk management integrated with ISO 14971, controlled design and development files, stricter traceability and record-retention rules, sterile and cleanroom controls where applicable, and mandatory post-market surveillance, complaint handling and vigilance reporting.

ISO 13485 also weights maintaining effectiveness over the continual-improvement emphasis of ISO 9001 — a real philosophical difference auditors will probe. In practice, most ISO 9001-certified organisations we work with need a focused gap-closure programme rather than a rebuild from zero.

The Medical Device Authority (MDA) is the regulator under the Ministry of Health. It sets the requirements, issues Establishment Licences and device registrations, and takes enforcement action. It is the decision-maker.

A Conformity Assessment Body (CAB) is an independent organisation registered with the MDA to carry out the technical assessment — auditing your quality system against GDPMD or ISO 13485, and reviewing your technical documentation. The CAB issues a conformity assessment certificate; the MDA then relies on it when deciding your application.

So you generally deal with both: the CAB assesses you, and the MDA licenses and registers you. We manage the relationship with both, including selecting a CAB whose scope and scheduling actually fit your device and your deadline.

An expired licence or registration means you lose the legal basis to import, distribute or place those devices on the Malaysian market. The practical consequences arrive fast: consignments held at customs, supply interruptions to hospitals and clinics, contractual exposure to your customers, and potential enforcement action.

Recovering from a lapse is also significantly more expensive and slower than renewing on time — you may face a fresh application rather than a straightforward renewal.

This is precisely why our renewal desk tracks expiry dates across your entire portfolio and begins the renewal process well ahead of the deadline. If you are already close to an expiry date, contact us immediately rather than after it passes.

Yes — remediation is a significant part of our practice, and it is often more urgent than a fresh implementation.

We start by reading the findings exactly as written, because auditors phrase non-conformities against specific clauses for a reason. We then run proper root cause analysis rather than surface-level fixes, build a corrective action plan with realistic completion dates, implement the changes with your team, and assemble the objective evidence your assessor needs to verify effectiveness.

Where the relationship with the CAB has become strained, we can also handle the correspondence directly. The goal is not just to close findings — it is to close them in a way that survives the next surveillance audit.