ISO 13485 Certification in Malaysia – Medical Devices, MDA & CE Marking | Get Certified with SCS

SCS Certification – Malaysia Office

SCS Certification
Jalan Pinang
50450 Kuala Lumpur
Malaysia

Phone: +60 11 6263 6611
Enquiry: Contact SCS Certification

https://scscertification.com/contactus.php

Malaysia has a well-defined regulatory framework for medical devices, and organizations entering or expanding in this market need to understand where quality management certification fits into that framework.

ISO 13485:2016 is the internationally recognized quality management standard developed specifically for organizations involved with medical devices. It can be relevant to manufacturers, contract manufacturers, organizations responsible for design and development, and other businesses whose activities fall within the scope of the standard.

For Malaysian medical-device businesses, however, ISO 13485 is only one part of the picture. The Medical Device Authority (MDA) regulates medical-device registration, establishment licensing, conformity assessment and post-market obligations. Depending on the organization's role, it may also need to consider GDPMD, Malaysian authorized-representative requirements, CE-related evidence or MDSAP.

That distinction matters.

A company can hold an ISO 13485 certificate and still have additional regulatory work to complete before a device can be legally placed on the Malaysian market.

This guide explains how ISO 13485 certification fits into the Malaysian medical-device environment, including MDA requirements, conformity assessment bodies, MDSAP, CE marking, GDPMD and the major Malaysian locations where medical-device organizations operate.

What Is ISO 13485 Certification in Malaysia?

ISO 13485:2016 sets out requirements for a quality management system used by organizations involved in the medical-device lifecycle.

The standard is concerned with how an organization controls its processes rather than simply whether a finished product passes inspection.

Depending on the organization's activities, the QMS may cover areas such as design and development, purchasing, supplier controls, production, process validation, traceability, product release, complaints, corrective action and continual improvement.

Consider a Malaysian company manufacturing sterile medical consumables. Its quality system may need to control incoming materials, production conditions, equipment, validation, packaging, traceability and product release. If a customer later reports a problem, the organization needs a controlled process for investigating the complaint and deciding whether corrective action is necessary.

ISO 13485 gives the organization a structured framework for managing these activities.

The certification scope should reflect the work the company actually performs. A manufacturer, distributor and contract manufacturer should not automatically have identical scopes.

Malaysia's Medical Device Regulatory Framework

Malaysia's medical-device regulatory system is administered by the Medical Device Authority under the Ministry of Health.

The principal legislation includes the Medical Device Act 2012 (Act 737), the Medical Device Authority Act 2012 (Act 738) and the Medical Device Regulations 2012.

The regulatory framework also includes requirements relating to matters such as advertising, establishment duties, conformity assessment and post-market activities.

MDA's current legislation and guidance should always be checked before a regulatory application is prepared because the framework continues to develop. Its published materials include amendments and newer guidance covering classification, conformity assessment, establishment licensing, labelling, technical documentation and other medical-device matters.

For a company preparing an ISO 13485 project, this means the QMS should be considered alongside the organization's Malaysian regulatory responsibilities rather than treated as an isolated certification exercise.

Medical Device Registration in Malaysia

Medical-device registration and ISO 13485 certification are two different processes.

Medical devices generally need to be registered before they are imported, exported or placed on the Malaysian market, subject to the applicable regulatory provisions and exemptions.

The registration process can involve conformity assessment and supporting evidence relating to the device, its manufacturer and the applicable quality-management system.

The product's classification is an important starting point. Malaysia uses a risk-based classification system for general medical devices, with Classes A, B, C and D representing different levels of regulatory risk. IVD medical devices are subject to their own classification framework.

Before preparing a registration strategy, the manufacturer should establish the intended purpose of the device and determine its applicable classification.

A mistake at this stage can affect the rest of the regulatory pathway.

How ISO 13485 Supports MDA Requirements

ISO 13485 provides the quality-management foundation, while MDA regulates the medical device and the establishment's activities in Malaysia.

MDA states that an ISO 13485 certificate issued by a registered Conformity Assessment Body can be submitted as part of medical-device registration requirements.

This is why selecting an appropriate certification arrangement matters.

A manufacturer preparing for Malaysian registration should look at the complete picture:

• the device and its classification;

• the organization's regulatory role;

• QMS scope;

• technical documentation;

• declaration of conformity;

• conformity-assessment route;

• establishment requirements;

• post-market responsibilities.

The ISO 13485 certificate should accurately describe the organization's activities. A certificate with an unsuitable scope may create questions when it is later used as supporting evidence for regulatory purposes.

MDA-Registered Conformity Assessment Bodies for ISO 13485

A Conformity Assessment Body, commonly called a CAB, is an organization registered by MDA to conduct specified conformity-assessment activities.

For medical-device organizations, CAB selection deserves attention before the certification audit is scheduled.

MDA maintains a register of CABs and their approved scopes. The registry includes organizations with scopes covering areas such as ISO 13485, post-market surveillance, GDPMD and medical-device technical areas.

A company should check the current MDA register and confirm that the CAB's scope is appropriate for the intended certification and regulatory application.

The relevant questions are practical:

Does the CAB hold current MDA registration?

Does its registered scope include ISO 13485?

Does the scope cover the organization's relevant medical-device activities?

Will the resulting certification evidence be appropriate for the intended Malaysian regulatory route?

These checks are more useful than choosing a certification provider simply because its quotation is the lowest.

Choosing an MDA-Registered CAB in Malaysia

The certification body becomes particularly important when ISO 13485 certification is intended to support a medical-device regulatory submission.

Before appointing a CAB, a manufacturer should verify its current status with MDA rather than relying solely on information contained in a sales proposal or older website page.

The organization should also explain its intended certification scope at the quotation stage.

For example, a company that designs, manufactures and services diagnostic equipment should describe those activities accurately. A contract manufacturer producing devices under another company's specifications should explain its contractual and manufacturing responsibilities.

A clear scope at the beginning can prevent unnecessary changes later.

MDA's published CAB information should be treated as the reference point for checking current registration and scope.

Establishment Licence Requirements in Malaysia

Medical-device regulation in Malaysia applies to establishments as well as products.

Depending on the organization's role, an establishment licence may be relevant to manufacturers, authorized representatives, importers and distributors.

The licensing requirements should not be confused with product registration.

For example, a foreign medical-device manufacturer may have a product that needs to be registered in Malaysia while its local authorized representative has separate establishment responsibilities.

Likewise, an importer or distributor may have obligations that differ from those of the legal manufacturer.

The correct regulatory route therefore starts with identifying who is responsible for the device and what activities each establishment performs.

Malaysian Authorized Representative for Foreign Manufacturers

A foreign manufacturer entering Malaysia needs to consider the applicable authorized-representative requirements.

The Malaysian authorized representative provides the local regulatory connection for the overseas manufacturer and may have responsibilities relating to registration, communication with MDA, regulatory information and post-market activities.

This arrangement should be documented carefully.

It is particularly important when several parties are involved—for example, a European legal manufacturer, a Malaysian authorized representative, an importer and a separate distributor.

Each party should understand which responsibilities it owns rather than assuming that another organization is handling them.

ISO 13485 for Medical-Device Manufacturers

Manufacturers are among the organizations most likely to use ISO 13485 as the basis for their medical-device QMS.

The standard can bring together controls that are sometimes managed separately in smaller businesses.

A manufacturer may need documented processes for supplier qualification, incoming materials, production, equipment, validation, inspection, product release and traceability.

It also needs a way to respond when something goes wrong.

Suppose a batch of components fails an inspection requirement. The organization needs to determine what happened, identify affected products, control the nonconforming material and decide whether corrective action is required.

That chain of control is much more meaningful than simply having a quality manual on a shelf.

ISO 13485 for Contract Manufacturers in Malaysia

Contract manufacturers occupy a slightly different position.

A Malaysian company may manufacture a device for an overseas legal manufacturer while having no responsibility for the product's commercial branding or certain regulatory decisions.

Its QMS still needs to control the processes it performs.

Depending on the contract, this can include production, process validation, inspection, traceability, equipment, purchasing, environmental controls, records and product release.

The relationship with the legal manufacturer should be clearly documented.

The certification scope should describe the contract manufacturer's actual activities rather than implying ownership of processes controlled by another company.

ISO 13485 and GDPMD in Malaysia

ISO 13485 and GDPMD are often mentioned together because both appear in medical-device compliance discussions, but they address different needs.

ISO 13485 is a quality management system standard for organizations involved in medical devices.

GDPMD—Good Distribution Practice for Medical Devices—focuses on applicable distribution and supply-chain activities.

A manufacturer producing a medical device may require an ISO 13485 QMS. An importer or distributor may have GDPMD responsibilities. An organization performing several different activities needs to examine the requirements applicable to each role.

This distinction is important for Malaysian companies because selecting the wrong certification or compliance route can result in unnecessary work without addressing the organization's actual regulatory responsibilities.

ISO 13485 for Importers and Distributors

Importers and distributors should first identify their role under the Malaysian medical-device framework.

Their operational controls may include storage, transportation, product identification, traceability, supplier information, complaints, returns and records.

Where the organization also performs manufacturing, servicing or other activities that fall within ISO 13485, the QMS requirements may be broader.

A distributor should therefore avoid assuming that ISO 13485 is automatically the appropriate certification simply because it sells medical devices.

The organization's activities determine the appropriate quality and regulatory framework.

Medical Device Classification in Malaysia

Medical-device classification is based on risk.

For general medical devices, Malaysia uses Classes A, B, C and D.

The applicable classification depends on the device's intended purpose and the relevant classification rules. Higher-risk devices generally require a more involved conformity-assessment approach.

IVD products are treated under a separate classification framework.

Classification should be addressed early in a regulatory project because it can influence the conformity-assessment route and the evidence required.

A manufacturer should not classify a product simply by comparing it with a similar device. The intended purpose and applicable rules need to be examined.

Technical Documentation and Declaration of Conformity

An ISO 13485 certificate does not replace product documentation.

Depending on the applicable registration route, a medical-device manufacturer may need evidence covering the product's intended purpose, classification, safety and performance, risk management, technical information, labelling and other applicable requirements.

The Declaration of Conformity is also an important part of the manufacturer's regulatory documentation.

The documents should tell a consistent story.

For example, the device described in the technical documentation should correspond with the registered product, intended purpose, labelling and relevant QMS activities.

Inconsistencies between these documents can create avoidable regulatory questions.

CE Marking for Medical Devices in Malaysia

CE marking is especially relevant to Malaysian manufacturers supplying the European market and to international manufacturers that already hold European conformity evidence.

However, CE marking should not be confused with Malaysian medical-device registration.

CE marking demonstrates conformity with applicable European Union requirements. Malaysia operates under its own medical-device legislation and MDA regulatory procedures.

For this reason, a manufacturer should not assume that a CE-marked product can simply be sold in Malaysia without completing the applicable Malaysian process.

The useful question is whether the existing European evidence can support an applicable Malaysian conformity-assessment route.

CE Marking, EU MDR and Malaysian Registration

A manufacturer supplying both Europe and Malaysia may have a substantial amount of common technical information, but the regulatory obligations are not identical.

European requirements may involve the applicable EU medical-device legislation, conformity assessment and CE marking.

Malaysia has its own requirements for registration, conformity assessment, establishment licensing and post-market responsibilities.

MDA's current circular-letter register identifies Circular Letter No. 2/2025, covering conformity-assessment procedures for medical devices approved by recognized countries. It became effective on 30 September 2025 and replaced Circular Letter No. 1/2025.

MDA's verification guidance indicates that eligible devices can be assessed through a verification route using specified evidence, including relevant QMS certification and, where applicable, CE-mark or foreign regulatory approval evidence.

That does not mean every CE-marked product automatically qualifies.

Eligibility depends on the applicable Malaysian route and the evidence available for the particular device.

ISO 13485 or MDSAP for Medical Devices in Malaysia?

MDSAP has become an important consideration for medical-device manufacturers with international operations.

MDA became an Affiliate Member of the Medical Device Single Audit Program in September 2025. MDA subsequently announced that qualifying MDSAP reports and certificates could be used as QMS evidence for specified regulatory submissions.

This changes an important point that is sometimes missed in older Malaysian ISO 13485 content.

ISO 13485 should not be presented as the only possible QMS evidence in every Malaysian regulatory situation.

MDA's current arrangement allows qualifying MDSAP evidence to support specified establishment-licensing and medical-device-registration applications, subject to the conditions stated by MDA.

For local manufacturers, MDA has specified conditions involving an MDA-registered CAB and appropriately qualified MDA-registered auditors.

For foreign manufacturers, MDA states that qualifying MDSAP reports and certificates issued by an MDSAP-recognized Auditing Organization can be used as QMS evidence for medical-device registration.

MDSAP may therefore be particularly relevant to a manufacturer already supplying multiple international markets.

The decision between an ISO 13485 certification route and an MDSAP-based regulatory strategy should be based on the organization's markets, certificates, device portfolio and regulatory objectives.

Post-Market Surveillance and Vigilance

Medical-device compliance does not end when registration is obtained.

Organizations need processes for monitoring what happens after products reach users.

Customer complaints, incidents, returns and recurring defects can provide information about product performance.

For an ISO 13485 organization, this information should feed back into the QMS.

Imagine that several customers report the same issue with a device component. A controlled complaint process can identify the pattern, trigger an investigation and determine whether corrective action, supplier action, risk review or regulatory reporting is necessary.

This connection between post-market information and the QMS is one of the practical reasons why medical-device quality management needs to be integrated into daily operations.

Medical-Device Advertising in Malaysia

Medical-device marketing also needs regulatory attention.

Malaysia's regulatory framework includes the Medical Device (Advertising) Regulations 2019.

Claims used in brochures, websites, advertisements and other promotional material should be consistent with the product's intended purpose and approved information.

A claim made for a device in another market should not automatically be copied into Malaysian advertising.

Marketing, technical documentation and regulatory information should remain aligned.

Medical-Device Sectors Using ISO 13485 in Malaysia

Malaysia's medical-device industry covers a wide range of products and supporting activities.

Medical consumables are one example. Manufacturers of items such as dressings, catheters and other disposable products can use ISO 13485 to structure controls over materials, production, inspection and traceability.

Diagnostic and laboratory-device manufacturers face additional considerations around performance and product classification.

Orthopedic and surgical-device companies may need strong controls over materials, manufacturing processes, traceability and product documentation.

Medical imaging businesses can have QMS activities covering equipment production, installation, servicing and technical support.

Dental-device manufacturers, hospital-equipment suppliers and biomedical service organizations may also use ISO 13485 where their activities fall within its intended scope.

The certification requirement should always follow the organization's actual role rather than the name of its industry.

ISO 13485 Certification in Kuala Lumpur

Kuala Lumpur is an important location for healthcare businesses, medical suppliers, corporate offices and organizations supporting Malaysia's medical-device sector.

A company headquartered in Kuala Lumpur may have manufacturing elsewhere, so the certification scope needs to distinguish between office functions and operational sites.

For multi-site organizations, responsibilities for manufacturing, quality management, regulatory affairs and distribution should be clearly established.

ISO 13485 Certification in Selangor

Selangor has a substantial industrial and manufacturing base, with medical-device businesses and supporting supply-chain operations located across areas including Shah Alam, Petaling Jaya, Subang Jaya and Klang.

For organizations operating multiple facilities, the QMS should clearly identify which site performs each activity.

A headquarters address alone does not determine the certification scope.

ISO 13485 Certification in Penang

Penang has a strong manufacturing and engineering ecosystem and is an important location for precision manufacturing and medical-device-related operations.

Organizations in Penang can assess ISO 13485 based on their specific manufacturing, design, supplier and quality-control responsibilities.

Companies serving international customers may also want to review whether their QMS supports requirements across multiple export markets.

ISO 13485 Certification in Johor

Johor's manufacturing and logistics environment makes it an important location for organizations involved in regional supply chains.

Medical-device manufacturers, contract manufacturers and related suppliers can assess ISO 13485 according to the activities performed at their Johor facilities.

Organizations operating across Malaysia and neighboring markets should make responsibilities between sites clear.

ISO 13485 Certification in Melaka

Melaka has an established manufacturing base and businesses supporting industrial and healthcare-related supply chains.

Organizations involved in medical-device production or other applicable activities can assess ISO 13485 based on their products, processes and certification scope.

ISO 13485 Certification in Negeri Sembilan

Medical-device and manufacturing organizations in Negeri Sembilan can consider ISO 13485 where their activities fall within the scope of the standard.

The certification assessment should be based on the organization's actual processes rather than simply its registered business category.

ISO 13485 Certification in Perak

Companies involved in medical supplies, manufacturing or related activities in Perak can assess ISO 13485 according to their operations.

Particular attention should be given to the processes that directly affect product quality and regulatory compliance.

ISO 13485 Certification in Kedah

Kedah's industrial sector includes manufacturing businesses that may form part of medical-device supply chains.

Organizations involved in applicable medical-device activities can evaluate ISO 13485 according to their products, processes and customer requirements.

ISO 13485 Certification in Sabah

Medical suppliers, distributors and applicable manufacturers in Sabah can assess ISO 13485 based on their regulatory role and operational activities.

Organizations importing medical devices should separately consider establishment, distribution and applicable GDPMD requirements.

ISO 13485 Certification in Sarawak

Medical-device organizations in Sarawak can evaluate ISO 13485 according to their products, manufacturing or service activities.

Where operations span different locations, document control, traceability, servicing and communication between sites should be addressed carefully.

How to Prepare for ISO 13485 Certification in Malaysia

Preparation works better when the organization starts with its actual operations instead of beginning with a collection of generic procedures.

First, establish the certification scope.

Identify the products, sites, processes and responsibilities that will fall under the QMS.

Next, assess the existing system against ISO 13485.

The gap assessment should look at what employees actually do. Supplier controls, production, validation, traceability, complaints and corrective actions are more important than simply having documents with the right titles.

The organization can then develop or improve its processes and begin generating evidence that the system is operating.

Internal audits provide an opportunity to identify weaknesses before the certification audit.

Management review allows senior management to examine QMS performance, problems, resources and improvement priorities.

For organizations intending to use the certificate for MDA purposes, CAB selection should be checked as part of the planning stage rather than after the QMS has already been implemented.

How to Get ISO 13485 Certification in Malaysia

A typical certification project begins with a review of the organization and its intended scope.

The initial assessment should establish:

• what medical devices are involved;

• who owns the product;

• whether design and development is performed;

• where manufacturing occurs;

• how many sites are involved;

• what regulatory role the organization performs;

• whether an existing QMS is available;

• whether MDA registration is planned;

• whether CE or MDSAP evidence already exists.

A gap assessment follows.

The organization then implements the required QMS processes, trains relevant employees and creates appropriate records.

Internal audit and management review should take place before the certification audit.

The certification body then performs the applicable assessment. Any identified nonconformities need to be addressed in accordance with the certification process.

Medical-device registration, establishment licensing and other MDA activities should be managed as separate regulatory workstreams.

How Long Does ISO 13485 Certification Take in Malaysia?

There is no single timetable that applies to every organization.

A small company with an established and functioning QMS may require a different preparation period from a new medical-device manufacturer developing its system from the ground up.

The timeline can be affected by the number of employees, sites, processes, product complexity, design responsibilities, existing documentation and audit requirements.

Regulatory registration should also be planned separately. An ISO 13485 certification timeline should not be presented as a guaranteed MDA registration timeline.

A meaningful estimate can be provided after reviewing the organization's scope and current level of QMS implementation.

How Much Does ISO 13485 Certification Cost in Malaysia?

ISO 13485 certification cost depends on the organization.

Factors can include employee numbers, number of sites, certification scope, product complexity, design responsibilities, existing QMS arrangements and audit duration.

There can also be separate expenses associated with medical-device registration, establishment licensing, testing, regulatory submissions and consultancy.

For that reason, a generic “ISO 13485 Malaysia price” can be misleading.

A quotation should be based on the actual certification scope.

Benefits of ISO 13485 Certification for Malaysian Organizations

A well-implemented ISO 13485 system can give a medical-device organization better control over processes that directly affect product quality.

It can help structure supplier evaluation, production controls, traceability, complaints, nonconforming products, corrective action and internal auditing.

It can also make responsibilities easier to understand when several departments are involved in a product's lifecycle.

For companies working with overseas customers, ISO 13485 certification can provide recognized evidence of a medical-device quality management system.

The value, however, comes from how the system is operated.

A company that treats ISO 13485 as a documentation project may obtain procedures without gaining much operational improvement. A company that builds the requirements into purchasing, production, engineering, regulatory affairs and customer-feedback processes gets considerably more practical value from the system.

ISO 13485 Certification in Malaysia With SCS

SCS can discuss ISO 13485 certification requirements with medical-device organizations operating in Malaysia.

The discussion can begin with the organization's products, activities and intended certification scope.

For a useful assessment, information such as the following can be considered:

• product type;

• manufacturing activities;

• design responsibility;

• number of employees;

• number of sites;

• existing QMS;

• regulatory role;

• MDA registration plans;

• existing ISO 13485 certification;

• MDSAP status;

• CE or other international regulatory evidence.

This allows the certification approach to be considered in the context of the organization's actual business rather than through a generic package.

Get ISO 13485 Certified in Malaysia With SCS

If your organization manufactures, designs, assembles, services or otherwise supports medical devices in Malaysia, the first step is to establish the right certification scope.

The regulatory requirements should then be considered alongside the QMS.

Whether you are developing an ISO 13485 system for the first time, updating an existing certification, preparing for MDA registration or reviewing an international medical-device certification strategy, SCS can discuss the applicable requirements with you.

Get certified with SCS for ISO 13485 certification in Malaysia.

Contact SCS:

https://scscertification.com/contactus.php