Medical Device Act 737: the law behind every Malaysian device approval.

Short answer. The Medical Device Act 2012 (Act 737) is the primary law for medical devices in Malaysia. Section 5 says the device must be registered; Section 15 says the business must be licensed. Both must be true at once. The Medical Device Authority, created by the Medical Device Authority Act 2012 (Act 738), enforces them.

Two Acts, one authority

Malaysia did something slightly unusual in 2012: it passed two medical device statutes on the same day, and they do different jobs.

You comply with Act 737 and its regulations. You deal with the authority that Act 738 created — MDA, based in Cyberjaya, which licenses establishments, registers devices, designates Conformity Assessment Bodies and enforces the post-market regime.

Section 5 and Section 15

Almost every compliance conversation in Malaysia reduces to these two. They are cumulative, not alternative — satisfying one does not excuse the other.

Section 5 — the device must be registered

Section 5(1) provides that no medical device shall be imported, exported or placed in the market unless it is registered under the Act. This is a product-level duty. Registration attaches to a specific device from a specific manufacturer, which is why a catalogue of forty products is forty registrations, not one.

What the registration costs and how deeply it is assessed depends entirely on risk class:

Classification is the first thing to settle, not the last — a submission that starts in the wrong class restarts. Since 1 August 2026 all classification applications go through MDA’s online system. See full pricing.

Section 15 — the establishment must be licensed

Section 15(1) provides that no establishment shall import, export or place in the market any registered medical device unless it holds an establishment licence granted under the Act. This is the company-level duty, and note the wording: it bites even on registered devices. A properly registered device moved by an unlicensed business is still an offence.

The licence is also no longer only a compliance matter. Since Circular Letter No. 1/2026, in force from 28 January 2026, a valid establishment licence is compulsory before participating in any new medical device tender — which turned Section 15 from a regulatory duty into a commercial gate overnight.

What counts as an “establishment”

The Act defines an establishment as:

• a manufacturer, importer or distributor responsible for placing a medical device on the Malaysian market; and
• an authorised representative appointed by a manufacturer whose principal place of business is outside Malaysia.

Retailers are expressly excluded. That exclusion is narrower than most people assume. The moment you import your own stock, or you are the party responsible for placing a device on the market rather than reselling licensed stock, you have stopped being a pure retailer. The devices on your shelves must be registered under Section 5 either way.

Which category you fall into decides your certification route and your cost — we work through all four roles here.

The duties that start the day you are licensed

The Medical Device (Duties and Obligations of Establishments) Regulations 2019 — P.U.(A) 318, made under Section 79 of Act 737 — are the reason a licence is a continuing obligation rather than a certificate you frame. They were gazetted on 3 September 2019 and came into operation on 1 July 2020, and they cover the post-market half of the regime:

• Complaint handling — a documented process, with records that survive an inspection
• Adverse event reporting — mandatory problem reporting to MDA within the prescribed timelines
• Field corrective actions and recalls — the procedure has to exist before you need it
• Distribution records and traceability — you must be able to say where a given unit went
• Change notification — currently under MDA/GD/0020, moving to the GD/0072 change-management regime when MeDC@St 3.0 goes live

These duties are what a licence renewal audit actually tests. A quality system that was built for the certificate and abandoned afterwards fails here, three years later, in front of a longer memory than anyone expects.

Guidance documents are not the Act

MDA publishes numbered guidance documents — MDA/GD/0020 on change notification, MDA/GD/0072 on change management, and dozens more. These are not statute. The Act and its regulations create the duties; the guidance documents tell you the format, the evidence and the process MDA expects when you discharge them.

That distinction matters in two directions. A guidance document that has been published but is not yet operative does not change your obligations yet — MDA/GD/0072 was published in May 2026 but GD/0020 continues to apply until MeDC@St 3.0 launches. And a submission that satisfies the Act while ignoring the relevant guidance document is the submission that comes back with queries.

The order is fixed, and it is the whole game

Act 737 creates a chain, and it cannot be entered in the middle:

• 1. Certified quality system — ISO 13485 or GDPMD, assessed by a CAB designated by MDA
• 2. Establishment licence — Section 15, filed through MeDC@St
• 3. Device registration — Section 5, device by device, by risk class
• 4. Post-market duties, forever — P.U.(A) 318, plus three renewal clocks that do not line up

People arrive at us most often having tried to start at step 3, because that is the step a customer is waiting on. It cannot be done. The home page walks the full chain with the published fee for every gate.