Installation, testing, commissioning and maintenance of medical devices.
Malaysia regulates what happens to a device after it is sold: who installs and tests it, who maintains it, what has to be recorded, and who must be competent to do it. Here is what Act 737, GDPMD and MDA’s guidance actually require, and what MDA has not yet published.
Where the duty comes from.
Section 43(1) of the Medical Device Act 2012 (Act 737) requires anyone using or operating a medical device on a third party to ensure it is safe and efficacious, used for its intended purpose and in line with the manufacturer’s instructions, and properly installed, tested, commissioned and maintained. Section 43(2) requires anyone installing, testing, commissioning, maintaining or disposing of a device to have the qualification and competency prescribed by the Minister. For the establishments that supply devices, the detailed rules are in MDA’s Good Distribution Practice for Medical Devices (GDPMD), MDA/RR No. 1, whose paragraph 28 sets out installation, testing, commissioning and maintenance requirements for active devices and points to Malaysian Standard MS 2058. Breaching section 43 carries a fine of up to RM100,000, up to one year in prison, or both.
Who must do what
| Party | Duty | Source |
|---|---|---|
| User (hospital, clinic or practitioner using the device on patients) | Ensure the device is properly installed, tested, commissioned and maintained; take it out of operation when it is no longer safe and effective; dispose of it safely | Act 737 s.43(1), (3), (4) |
| Person doing the work (installer, biomedical technician, service engineer) | Hold the qualification and competency prescribed by the Minister | Act 737 s.43(2) |
| Establishment (authorised representative, importer, distributor) | Documented installation, testing, commissioning and maintenance procedures for active devices following MS 2058; acceptance criteria; calibrated test equipment; records; technical and maintenance support | GDPMD paras 6(2), 13, 14, 19(v), 23(vi), 25, 28, 29 |
| Manufacturer | Labelling that explains how to verify proper installation and safe operation, the nature and frequency of preventive maintenance, consumables and calibration; installation and maintenance instructions in the dossier | MDR 2012 Sixth Schedule paras 6(g)–(h), 7(1)(c); Third Schedule App. 2 (CSDT labelling element) |
GDPMD applies to authorised representatives, importers and distributors and does not cover manufacturers or retailers (paragraph 2(1)). Appendix 4 of the Third Schedule, MDR 2012, names it as the quality management system for those three roles; manufacturers use ISO 13485. Both sit alongside the establishment licence.
What GDPMD requires for active devices
Paragraph 28 of GDPMD requires the establishment to:
- keep documented procedures and work instructions for installation, testing and commissioning, and maintenance, in accordance with MS 2058 (the Malaysian code of practice for good engineering maintenance of active medical devices) and any other requirements MDA specifies;
- keep procedures, work instructions, reference materials, tools, test equipment and reference measurement procedures for servicing, including calibration, repair and maintenance;
- set documented acceptance criteria for installation, testing and commissioning;
- establish installation qualification and keep installation and inspection instructions, with test procedures where appropriate, for devices with specified installation requirements;
- ensure proper installation, testing and commissioning;
- have the equipment used for testing and maintenance calibrated or verified at specified intervals, to the applicable standards;
- keep records of testing and commissioning, installation, calibration and maintenance; and
- as appropriate, provide technical support (maintenance service, training, calibration, spare parts, workshop set-up) and a maintenance management mechanism for customers.
The rest of GDPMD feeds into this. For each device type, the establishment’s file must define the product specifications and installation qualifications, and the installation and servicing process where applicable (paragraph 6(2)). On delivery, the establishment must obtain from the manufacturer the installation, testing and commissioning requirements, the user and service manuals, the spare-parts list and the relevant certificates, and give them to the customer (paragraph 23(vi)). It must tell users how to get maintenance, calibration and spare parts (paragraph 19(v)). Installation, testing and commissioning, and maintenance and calibration, are activities that appear in the scope of a GDPMD certificate (Annex 1).
Installation qualification
GDPMD defines installation qualification (IQ) as documented evidence that facilities and operations are installed as designed and specified and correctly interfaced with systems. Its protocols should include engineering drawings and documents, building finishes, process and utilities flow diagrams, piping and instrumentation diagrams, equipment and instrument specifications, the manufacturer’s drawings and maintenance and operating manuals, spare lists, and maintenance and calibration schedules.
Outsourced service providers
If installation or maintenance is outsourced, the establishment stays responsible. Under paragraph 29 it must control the outsourced work, audit the supplier as part of its own system unless the supplier already holds GDPMD certification covering that activity, and put written agreements in place covering documentation and records.
Electrical safety
Electrical safety begins as a design requirement. Paragraph 14 of Appendix 1, Third Schedule, Medical Device Regulations 2012 requires a device to be designed and manufactured to avoid, as far as possible, the risk of accidental electric shock in normal use and in a single fault condition, provided the device is installed and maintained as the manufacturer indicates. That proviso is why testing at installation and during maintenance matters: the design protection assumes it. MDA’s published guidance does not prescribe a test method. The test procedure comes from the manufacturer’s instructions and the establishment’s MS 2058-based procedures, and GDPMD requires the test equipment to be calibrated. The device’s conformity to this principle is part of its essential principles checklist.
Maintenance
- Scheduled and unscheduled. MDA/GD/0060 defines scheduled maintenance as a planned programme for optimum performance, safe operation, minimum downtime and maximum useful life, and unscheduled maintenance as the work needed to restore normal function, safety, performance and reliability to a malfunctioning device.
- What the manufacturer must tell you. Where relevant, the labelling must state the nature and frequency of preventive and regular maintenance, replacement of consumable components and calibration (MDR 2012, Sixth Schedule para 7(1)(c)), as well as post-market servicing needs and decommissioning or disposal information (para 6(g)–(h)).
- Active devices follow MS 2058 under GDPMD paragraph 28.
- Refurbished devices. MDA/GD/0029 requires testing and commissioning to follow the original manufacturer’s instructions, maintenance of active devices to follow MS 2058, and maintenance of non-active devices to follow the original maintenance instructions. See our refurbished devices guide.
MDA/GD/0028: not yet published
MDA/GD/0029 (Good Refurbishment Practice, January 2016) refers to a Guidance Document on Requirements for Installation, Testing & Commissioning and Acceptance of Medical Device (MDA/GD/0028) and notes that it is still in development. MDA’s guidance document list, checked on 8 October 2026, does not include it. Anyone looking for “MDA GD 0028” will not find it on MDA’s site; the working requirements are those above.
Competent persons
Section 43(2) of Act 737 makes the qualification and competency of anyone installing, testing, commissioning, maintaining or disposing of a medical device a matter for the Minister to prescribe. MDA’s list of legislation, last updated 13 January 2026, contains no regulations prescribing them.
In practice, MDA runs a Compulsory Competency Module for biomedical technical personnel (BTP). MDA says the module is designed in line with section 43 for people responsible for maintenance, testing and commissioning, and disposal of devices in healthcare institutions and related facilities. Its 31 October 2023 session covered Act 737 and the 2012 Regulations, MS 2058:2018, the Atomic Energy Licensing Act 1984 (Act 304) and medical device disposal under MS 2650:2015, followed by an online examination. A further module (CCM 2, Module 1) took registrations until 19 April 2024. MDA’s 2026 training calendar (updated 18 August 2026) lists no BTP session.
For establishments, GDPMD paragraph 13 requires competent key personnel, including technical support, and says the skills of staff providing post-market technical support for active devices must conform to the requirements or standards MDA recognises. Paragraph 14 requires the establishment to define the competence needed, train staff, evaluate the training and keep records of education, training, skills and experience.
When a device is no longer safe
Under section 43(3) and (4), the user must take a device out of operation when it is no longer safe and effective, and dispose of it in a way that eliminates or reduces the risk of injury, contamination with biological material, environmental damage and reuse. Establishments need a documented disposal procedure, segregated storage until disposal and disposal records (GDPMD paragraph 25).
For orphaned, obsolete and discontinued devices still in use, MDA’s Circular Letter No. 2/2022 places the risk of use on the establishment, users and healthcare facilities, keeps the establishment responsible for post-market issues for at least the projected useful life, and states that users remain bound by section 43.
If testing or maintenance finds a problem
A fault found during commissioning or servicing can be an incident. The establishment’s post-market duties then apply:
- mandatory problem reporting under section 40 of Act 737 and regulation 5 of the 2019 Regulations, with an investigation report within 30 days of the report;
- field corrective or preventive action, notified to MDA before it starts (regulation 6), or a recall (regulations 7 and 8);
- complaint records kept for five years plus the device’s projected useful life (regulation 4(3)).
The wider system is on our post-market surveillance page.
What the 2019 Duties and Obligations Regulations cover
The Medical Device (Duties and Obligations of Establishments) Regulations 2019 (P.U. (A) 318, gazetted 15 November 2019, in force 1 July 2020) are often assumed to cover servicing. They do not. They cover:
| Regulation | Subject |
|---|---|
| 3 | Distribution records, with extra fields for implantables; kept 2 years after placing on the market or export, or for the projected useful life |
| 4 | Complaint handling records, kept 5 years plus the projected useful life |
| 5 | Mandatory problem reporting and the 30-day investigation report |
| 6 | Field corrective or preventive action |
| 7 | Voluntary recall: Class I, II and III and their notice periods |
| 8 | Mandatory recall ordered by MDA |
Breaches of regulations 3, 4, 5(3), 7(2) and 8(2) carry a fine of up to RM200,000, up to two years in prison, or both.
Siapakah yang bertanggungjawab ke atas pemasangan, pengujian dan pentauliahan peranti perubatan di Malaysia?
Seksyen 43(1) Akta Peranti Perubatan 2012 (Akta 737) mewajibkan pengguna yang menggunakan peranti perubatan ke atas pihak ketiga memastikan peranti itu dipasang, diuji, ditauliah dan diselenggara dengan betul. Seksyen 43(2) menghendaki orang yang memasang, menguji, mentauliah, menyelenggara atau melupuskan peranti mempunyai kelayakan dan kecekapan yang ditetapkan oleh Menteri. Establismen yang membekalkan peranti aktif perlu mematuhi perenggan 28 GDPMD, termasuk prosedur mengikut MS 2058, kriteria penerimaan, peralatan ujian yang ditentukur dan rekod. Hukuman bagi kesalahan di bawah seksyen 43 ialah denda sehingga RM100,000, penjara sehingga satu tahun, atau kedua-duanya. WhatsApp 010-206 2070.
Frequently asked questions
What is testing and commissioning of medical equipment?
Who is responsible for testing and commissioning: the hospital or the supplier?
What is electrical safety testing of medical equipment?
Is there an MDA guidance document on installation, testing and commissioning (MDA/GD/0028)?
Do biomedical technicians need an MDA competency qualification?
Do the Duties and Obligations of Establishments Regulations 2019 cover maintenance?
What is the penalty for breaching section 43?
Supplying active devices to hospitals?
Send us your device list and the manufacturers’ installation and service manuals. We will write the installation, testing, commissioning and maintenance procedures GDPMD paragraph 28 expects, with acceptance criteria and record templates, and line them up with your GDPMD scope.