Medical device recall in Malaysia.

Recall classes and notification deadlines.

The establishment assesses the risk and sets the class itself, under Regulation 7 of the Medical Device (Duties and Obligations of Establishments) Regulations 2019. Notify MDA (Annex B form) and every affected person (Annex C letter) on or before starting the recall, within the class time frame. Give MDA the anticipated closure date, with a rationale if completion will take longer. If you need more time to reach everyone affected, say so in the preliminary report.

Voluntary and mandatory recall

• Voluntary (Act 737 s.42(1)). An establishment may recall a defective device at any time. MDA/GD/0015 treats a recall as due once you become aware that the device may be hazardous to health, may not meet the manufacturer’s or AR’s claims on effectiveness, performance or safety, or may not meet the law.
• Mandatory (s.42(4)). MDA may order a recall at any time for patient safety and public health. It instructs you in writing, sets the timelines to start, follow up and complete, and agrees the class and level with you. You still run the recall; MDA monitors it and may communicate with stakeholders itself.

In deciding on a mandatory recall, MDA weighs whether harm has already occurred, how likely it is to recur, risk to vulnerable groups such as children, the elderly or immunocompromised patients, whether the establishment knows of the risk but has not acted, and whether alternative treatments exist.

Recall or field corrective action?

Section 41 of Act 737 requires corrective or preventive action on devices already on the market. MDA/GD/0013 (Field Corrective Action, First Edition, June 2020) lists the forms it takes. Only a return is a recall.

• The manufacturer decides whether an FCA is needed, based on a risk assessment to ISO 14971. MDA can require more if it finds the assessment deficient.
• The manufacturer or AR notifies MDA before starting the FCA (Annex B form).
• A field safety notice (FSN) goes to everyone in the supply chain, from importers and distributors to healthcare facilities and users. A copy goes to MDA, and MDA recommends copying the CAB that assessed the device. The FSN must not play down the risk or advertise products.
• The FCA report is due within 30 days after the FCA is completed, or a longer period MDA allows.

Running a recall, step by step

1. Identify the problem from complaints, incident reports or trend analysis.
2. Assess the risk and set the class, which fixes the notification deadline.
3. Document a recall strategy: the depth (user, retail or distributor level), the people responsible, the affected stock from your distribution records, the communication channels and quarantine arrangements.
4. Notify MDA and every affected person. Tell them to identify and isolate the devices and to stop using, selling and distributing them.
5. Execute and check effectiveness: confirm that every affected person received the notice and acted on it, by site visits, calls, emails or letters.
6. Collect and quarantine the recalled devices so they cannot return to the market unless rectified. Then remove, return or dispose of them, or issue a public warning when the hazard is serious and other means look inadequate.
7. Submit the final report within 30 days of completion: the circumstances, the action taken, the extent of distribution in Malaysia and overseas, the quantity returned or corrected, confirmation that everyone was notified, the disposal method and the steps to prevent a recurrence. MDA may confirm closure in writing.

MDA’s Vigilance Unit pages direct recall and FSCA reports for devices affecting Malaysia to MeDCReSt, MDA’s Medical Device Centralized Reporting System. The 2020 guidance documents give email addresses for recall reports and FSN copies, so confirm the channel with the Vigilance Unit if you are unsure. For devices you also export, follow the importing country’s rules and notify its regulator.

Your recall will be published

MDA publishes a monthly Medical Device Recall Listing. Each entry shows the date received, MDA’s reference number, voluntary or mandatory recall, product name, registration number, recall class, reason code, and the recalling establishment with its licence number. The listing is released under Regulations 7(8) and 8(5) of the 2019 Regulations. The latest, for August 2026, was published on 7 September 2026. It is also the place to check whether a device has been recalled in Malaysia.

Records MDA can ask for

Distribution records must allow a complete and rapid withdrawal of the device. Implants are tracked to patient level. Where that is not possible, track them to the healthcare facility or record the date each device was implanted. A recall is only as fast as these records.

Recalls, incident reports and design changes

A recall does not replace the incident report. Section 40 of Act 737 sets separate deadlines for reporting incidents to MDA (48 hours, 10 days or 30 days depending on severity): see mandatory problem reporting. For an imported device, the authorised representative is the party MDA expects to hear from.

Where the fix is a change to the device or its labelling or IFU, MDA/GD/0072 lets changes resulting from an FCA be implemented immediately without prior MDA approval. That guidance applies only once MeDC@St 3.0 launches; until then the change notification rules in MDA/GD/0020 apply. Our post-market surveillance service keeps recall procedures and distribution records ready before a recall is ever needed.