MDA full conformity assessment, element by element.

What full conformity assessment is.

Full conformity assessment is the route where a conformity assessment body (CAB) registered with MDA examines the manufacturer’s own evidence from scratch, instead of verifying an approval another regulator has already granted. The CAB assesses four elements set by the Third Schedule of the Medical Device Regulations 2012: the quality management system, the post-market surveillance system, the technical documentation and the Declaration of Conformity. How deep it goes depends on the class. MDA explains the procedure in MDA/GD/0031, Conformity Assessment for Medical Device (First Edition, October 2017, the edition MDA’s portal carries). When the CAB is satisfied, it issues a report and certificate, and the establishment applies to MDA through MeDC@St.

When full conformity assessment applies

What the CAB assesses, by class

For every element the Regulations let the CAB ask for additional documents or information as it thinks fit. Paragraphs refer to Part III of the Third Schedule.

Quality management system: what the CAB accepts

• ISO 13485 is expected. MDA/GD/0031 clause 5.1.1 says manufacturers shall be certified with ISO 13485. Our ISO 13485 page covers getting there.
• Existing certificates the CAB considers (clause 5.1.5): a QMS certificate issued by an MDA-registered CAB, by a notified body listed in the EU’s NANDO database, or by a certification body from the US, Canada, Australia, Japan or the EU. A certificate from another country is the CAB’s call, with a valid justification.
• Scope must cover the device. The CAB’s checklist (Annex A) checks the certificate’s validity and authenticity, whether its scope is sufficient for the device, and the ISO 13485 audit report.
• No certificate yet? Annex A notes that the CAB may conduct the ISO 13485 certification process for an establishment that does not have one, using a separate ISO 13485 checklist.
• Contract manufacturers. QMS activities carried out by third parties on the manufacturer’s behalf remain the manufacturer’s responsibility and must be controlled under its QMS (clause 5.1.4).

The manufacturer’s QMS is one requirement; the local establishment has its own. Paragraph 11 of the Third Schedule requires the manufacturer, the authorised representative, the importer and the distributor each to keep a QMS that fits its role, and MDA’s 2024 conformity assessment explainer names GDPMD for the AR, importer and distributor.

Post-market surveillance: five processes

Clause 5.2.3 of MDA/GD/0031 lists the processes the establishment must document, maintain and implement, and the CAB checks for each of them:

1. Complaint handling
2. Distribution records
3. Mandatory problem (adverse event) reporting
4. Field corrective action
5. Recall

The Annex A checklist also asks for a list of ongoing incidents reported globally and of incidents resolved over 5 years, where applicable, and the date of the last audit.

Technical documentation: the CSDT review

The CAB “determines the adequacy of the documented evidence in support of the manufacturer’s declaration of conformity” by reviewing the CSDT and the technical documentation behind it (clause 5.3.3). The Annex A checklist walks through each CSDT element for a general device:

• Executive summary, including marketing history and approvals in other countries
• Relevant essential principles and the method used to demonstrate conformity, with the essential principles checklist
• Device description, including risk class, classification rule, accessories and configurations
• Design verification and validation summaries
• Pre-clinical studies, where the device is invasive or contacts the patient
• Software validation studies
• Biological materials, where the device contains them
• Clinical evidence and existing bibliography
• Labelling, checked against MDA/GD/0026 (see labelling requirements)
• Risk management file, showing conformance with ISO 14971
• Manufacturing information appropriate to the complexity and class of the device

Standards are weighed in a fixed order (clause 5.3.4): Malaysian Standards and international standards first, then standards of the US, EU, Canada, Australia and Japan, then industry or company standards. A manufacturer that departs from that order must justify it. Where a standard is cited in the Declaration of Conformity, the checklist asks whether every applicable part of it has been met.

Declaration of Conformity

The CAB checks that every element MDA/GD/0025 requires is stated and that the DoC is signed by a person from the manufacturer’s top management or someone authorised to sign on their behalf (clause 5.4.3). The field-by-field contents are on our Declaration of Conformity page.

Who does what

Only a CAB registered under Act 737 may carry out conformity assessment (s.11). MDA’s list changes, so check it before you sign; our CAB page has the current register.

What the CAB issues

• Conformity assessment report (MDA/GD/0031 Annex B): the CAB’s name, registration number and medical device technical area code; the manufacturer or AR and its establishment licence number; the device name, class and rule, manufacturer and grouping (single, family, system, set or IVD cluster); signed by the CAB’s technical personnel, with the Annex A checklist attached.
• Certificate of Conformity (Annex C): the client, certificate number, the list of devices with class, rule and manufacturer, effective and expiry dates, and the CAB’s registration number. MDA/GD/0070 says the certificate remains valid for 5 years.

MDA publishes no fee schedule for CAB work; CAB fees are commercial. Ask for a quote that names the route, because a full assessment covers all four elements in depth.

After the CAB: MeDC@St and MDA

The report and certificate are submitted as one of the requirements for registration (Third Schedule para 12(2)). In MeDC@St the Class B, C and D form has nine sections, and Section 7, Conformity assessment, carries the CAB report and certificate. MDA/GD/0070 asks for the same technical dossier and supporting documents the CAB reviewed, in English or Bahasa Malaysia. Information MDA requests must arrive within 90 working days or the application is rejected.

MDA/GD/0070 gives MDA a review time of 30 working days for Classes B to D on the verification route. MDA has not published a separate figure for applications backed by a full assessment; its re-registration FAQ quotes 60 days for Classes B, C and D without naming a route. Our registration timeline sets out every published figure. The establishment also needs an establishment licence to import, export or place the device on the market (Act 737 s.15); see the MDA establishment licence guide.

At re-registration

Registration lasts 5 years. MDA’s re-registration FAQ says the CAB uses the verification route to re-register a registered device, and MDA/GD/0070 makes devices first assessed by full conformity assessment eligible for that recertification if:

• the registration certificate is still valid when the CAB assesses it;
• nothing in the design, specifications, features or registration information has changed unless it was notified to MDA (see change notification); and
• MDA has not rejected or cancelled the registration.

You may use the same CAB or a different one, and the re-registration form asks for an updated CAB report and certificate. Timing and fees are on our renewal page.

IVDs

For in vitro diagnostics, MDA/GD/0003 (Principles of Conformity Assessment for IVD Medical Devices, First Edition, July 2013) sets out the elements for each IVD class, and Annex A of MDA/GD/0031 has a separate CSDT checklist covering analytical and clinical performance, cut-off, reference intervals and method comparison. GD/0003 calls for an in-depth premarket review of the CSDT for Class D, and lets MDA or the CAB adjust the depth of assessment for well-established technology or, the other way, for innovative technology or a new intended use. See IVD registration.

Points the guidance is specific about

• MDA/GD/0031 still refers to the Medical Device (Exemption) Order 2016 for the Class A exemption. That Order was replaced by the Exemption Order 2024 (P.U. (A) 78), which keeps the exemption in paragraph 5.
• The CAB assesses the manufacturer’s evidence; it does not generate it. Under Third Schedule paragraph 2 the manufacturer collects and compiles it.
• A classification dispute with the CAB can go to MDA in writing within 30 days, and MDA must decide within 30 days (regulation 3).
• MDA can audit a CAB and cancel its registration; while a cancellation is pending, all assessments by that CAB are suspended (Act 737 ss.10(5) and 14).