Software as a medical device (SaMD) in Malaysia.
Diagnostic apps, image-analysis algorithms and AI triage tools can all be medical devices under Act 737, and need MDA registration before they are supplied in Malaysia. Here is when software qualifies, how it is classified, what the dossier needs, and how updates are handled.
When is software a medical device?
Section 2 of Act 737 names software in the definition of a medical device. The First Schedule of the Medical Device Regulations 2012 (Part II, paragraph 3(4)) adds two rules:
- Software that drives or influences a medical device takes that device’s class (software in a medical device, SiMD).
- Depending on its intended purpose, software may be a medical device in its own right (SaMD).
MDA/GD/0072 (May 2026) uses the IMDRF definition: software intended for one or more medical purposes that performs them without being part of a hardware medical device. It includes IVD software, and mobile apps that meet the definition are SaMD.
Not a medical device
The ASEAN borderline list MDA has adopted (MDA/GD/0063, 3rd Edition, June 2025) treats these as non-devices:
- Software that only displays, receives or stores health data (for example blood pressure or glucose) for wellness, without processing or analysis.
- Software that collects data from a medical device and sends it to a doctor without processing or analysis.
- Software that sends data the user types in to a doctor without processing or analysis.
- Communication apps between patients and caregivers; information systems that only store data.
The line is processing or analysis for a medical purpose. A system that monitors patient data is a device; one that only stores it is not. A smartphone is not a device, but the medical app on it can be.
Classification
There is no software-specific rule. Standalone software is classified with the general rules in the First Schedule, mostly the active-device rules:
| Software function | Class | Rule |
|---|---|---|
| Controls or monitors a Class C active therapeutic device | C | Rule 9(ii) |
| Diagnosis | B | Rule 10(i) |
| Monitors vital parameters where variation could mean immediate danger, or diagnoses when the patient is in immediate danger | C | Rule 10(i) |
| Other active software | A | Rule 12 |
The ASEAN harmonised classification list (MDA/GD/0062, June 2025) puts “software for diagnosis or treatment” at Class B or C, and microplate assay management software at Class A. Software that drives a device takes the device’s class. Worked examples for hardware are in our classification guide.
What the dossier needs
- Software validation in the CSDT dossier: objective evidence that validates the design and development process, with in-house and user-environment testing for every hardware configuration in the labelling (Third Schedule; MDA/GD/0008).
- Essential principles: programmable systems designed for repeatability, reliability and performance, with risks reduced under single-fault conditions.
- Our recommendation: build the evidence on IEC 62304 (software life cycle), ISO 14971 (risk management) and IEC 82304-1 for health software, plus a cybersecurity risk assessment. MDA does not name these standards, but CABs and reference regulators expect them, and they are what the verification route relies on.
- Clinical evaluation for diagnostic or therapeutic algorithms, showing the output is clinically valid for the stated intended use.
If the software already has FDA, EU, TGA, Health Canada, Japan, UK, HSA or Thai FDA approval, the CAB can use the verification route.
Labelling and e-IFU for software
MDA/GD/0026 (7th Edition, May 2026) lets medical device software supply its instructions electronically. A QR code, barcode or URL must lead to the e-IFU. For apps that rely on a network connection, the IFU must sit in a clearly labelled “User Guide”, “Instructions” or “Help” section that stays available during use, and every e-IFU must show its version or revision history. More: labelling requirements.
Software updates and AI changes
Changes are notified under MDA/GD/0020 until MeDC@St 3.0 launches, then under MDA/GD/0072, which has a dedicated software flowchart:
| Change | Under MDA/GD/0072 |
|---|---|
| Changes affecting device control or adding indications | Significant: approval needed |
| Algorithm changes affecting diagnostic or therapeutic function | Significant: approval needed |
| New diagnostic or therapeutic features, or changes in how data is interpreted | Significant: approval needed |
| Adding or removing alarms; safety or performance changes; new OS platform | Significant: approval needed |
| Version change needing a new identifier, no safety effect | Notification |
| Bug fixes, interface changes, new OS version on the same platform, cybersecurity improvements, ML dataset adjustments within the labelled specification | No notification |
| Changes within an approved PCCP | No notification |
A Predetermined Change Control Plan (PCCP) approved at registration describes planned modifications, the method, the data and the verification and validation. It becomes part of the regulatory decision, so later changes made within it need no further notification. MDA says full PCCP requirements will come in a separate SaMD guidance document. Process details: MDA change notification.
Adakah perisian atau aplikasi mudah alih dianggap peranti perubatan di Malaysia?
Boleh jadi. Akta 737 menyenaraikan perisian dalam takrif peranti perubatan, dan perisian boleh menjadi peranti perubatan dengan sendirinya bergantung pada tujuan penggunaannya. Perisian yang hanya memaparkan atau menyimpan data kesihatan tanpa analisis bukan peranti perubatan (MDA/GD/0063). Perisian diagnosis lazimnya Kelas B atau C dan perlu didaftarkan dengan MDA. WhatsApp 010-206 2070.
Frequently asked questions
Is software a medical device in Malaysia?
What does MDA mean by SaMD?
Which health apps are not medical devices?
How is SaMD classified?
What evidence does a software registration need?
Do software updates need MDA approval?
What is a PCCP?
Building or importing medical software?
Send the intended use, the features and any foreign approvals. We will tell you whether it is a medical device, its class, and the evidence MDA and the CAB will expect.