A Malaysian establishment licence expires before the device

A private conformity assessment body decides before MDA does

The Medical Device Act 2012 (Act 737) built Malaysia's system around a Conformity Assessment Body, or CAB — a private body the Medical Device Authority itself licenses to review a manufacturer's technical file and audit its quality management system. It's the CAB, not MDA, that runs the substantive review and issues the certificate of conformity the device's own registration is built on; MDA's guidance for CABs sets out the minimum evidence a CAB has to verify and document before that certificate can issue. Section 5(1) of Act 737 then makes registration itself a precondition: no medical device may be imported, exported, or placed on the market unless it's registered under the Act. A registration record that lists MDA as the reviewer has usually skipped a step — the CAB made the underlying technical call, and MDA's own registration formalizes a decision that was already made once.

Registration and licensing are two separate duties, under two separate sections

Act 737 doesn't stop at the device. Section 15(1) sets a second, independent condition: no establishment shall import, export, or place a registered device on the market unless that establishment itself holds a valid Establishment Licence. “Establishment” covers several distinct roles — manufacturer, authorised representative, importer, distributor — and each one licenses separately rather than inheriting a single company-wide status. A foreign manufacturer with no presence in Malaysia can't hold that licence directly; it has to appoint a Local Authorised Representative, and the LAR is the party MDA actually licenses and holds accountable, the same structural gap this blog has already traced for Taiwan's domestic agent and Saudi Arabia's authorized representative. A distribution agreement that names a Malaysian partner as a sales channel, without confirming that partner holds its own current Establishment Licence, has left the actual regulatory relationship unverified.

Two clocks, three years apart

This is where Malaysia's structure stops rhyming with the others. The CAB's certificate of conformity, and the device registration MDA issues on the strength of it, runs on a five-year validity period, with its own formal re-registration process once that period runs out. The Establishment Licence behind it runs on a separate three-year cycle: MDA's own guidance opens the renewal window a full year before expiry and sets the deadline for a renewal application at least ninety days before the licence actually lapses. Nothing ties these two clocks together. A device registered in year one of an LAR's freshly issued licence will still have two years left on its own five-year term when that LAR's licence comes up for its first renewal — and if the renewal is missed, Section 15(1) makes the device unsellable in Malaysia regardless of how much time remains on its own registration. A single “Malaysia: registered” status field, tracking only the device's own five-year term, has no way to surface that the establishment behind it can go dark first.

Where this meets the file

A Malaysia record needs three things tracked as separate fields, not folded into one status: the CAB's own certificate of conformity and its expiry, the device registration built on it running its own five-year term, and each establishment's Establishment Licence — manufacturer, LAR, importer, distributor, wherever more than one role applies — tracked individually on its own three-year cycle. A cross-border registration tracker built to carry that split, alongside the launch catalog's other device-registration templates, is previewed there now. If your program has tracked MDA's two clocks differently, the shelf takes that correction directly.