The CAB (Conformity Assessment Body) and MDA (Medical Device Authority) play separate but sequential roles. The CAB is an independent, MDA-registered organisation that assesses your technical documentation and quality management system before registration. The MDA is the government authority that receives your submission after CAB assessment, conducts its own review, and issues the official registration certificate. Neither can replace the other — for Class B, C, and D devices, both are required in sequence.
Manufacturers new to the Malaysian market often ask the same question in different ways: who do I actually submit to — the CAB or the MDA? Do I deal with them separately? Does one replace the other? Can I go directly to the MDA and skip the CAB?
The confusion is understandable. Both bodies sit within Malaysia's medical device registration framework under Act 737, both review technical documentation, and both have authority to accept or reject your submission. But they have entirely distinct roles — and understanding the workflow between them is the foundation for planning your registration timeline accurately.
This guide explains exactly what each body does, where they sit in the registration sequence, how they interact with each other and with your Local Authorised Representative, and what the 2026 updates mean for how this workflow operates in practice.
Key Takeaways
- The CAB is a private, independent body registered by the MDA — it assesses technical documentation and QMS before MDA submission.
- The MDA is the government regulatory authority — it receives the submission after CAB assessment and issues the registration certificate.
- For Class B, C, and D devices, the CAB comes first — the MDA will not accept a submission without a valid CAB certificate and assessment report.
- Class A devices bypass the CAB and submit directly to the MDA.
- Because the CAB conducts a comprehensive pre-review, MDA assessment is typically faster than the headline timelines suggest — products arrive at the MDA effectively pre-cleared.
- In 2026, mandatory import permits (via ePermit, effective 2 January 2026) have added a third post-approval step before physical shipment.
- The permanently confirmed HSA reliance arrangement (1 March 2026) changes the CAB's role for Singapore-registered devices — faster verification rather than full assessment.
CAB vs MDA: Who Does What
The WorkflowHow CAB and MDA Work Together: The Full Sequence
The registration workflow for Class B, C, and D devices follows a fixed sequence. Understanding this sequence — and where each party fits — is the foundation for accurate timeline planning.
Before any submission, confirm your device classification and whether you qualify for the full assessment route or the expedited verification route. Since 1 May 2025, MDA operates a mandatory online-only classification system — classification requests are submitted digitally and classification letters issued electronically.
Your Local Authorised Representative manages both the CAB and MDA stages on your behalf. The CAB must be registered with the MDA and have the correct Medical Device Technical Area (MDTA) scope for your device type. Not all CABs assess all device categories.
The complete CSDT, Declaration of Conformity, ISO 13485 certificate, labelling, and supporting documents are submitted to the CAB. Every referenced document must be in full, legible, signed, and within its validity period. See the full MDA document checklist for what's required.
The CAB reviews the dossier systematically. For the full assessment route, the CAB target is approximately 1.5 months. For the verification route (devices with prior FDA, CE, HSA, TGA, or Health Canada approval), the target is 30 working days. Since 1 March 2026, the HSA verification route has been permanently confirmed, covering Singapore SMDR-registered devices at the 30-day target.
If the CAB raises non-conformities or queries, these must be addressed before the certificate can be issued. A successful CAB assessment results in a signed certificate and full conformity assessment report — both are mandatory inclusions in the MDA submission. MDA has a separate enhanced process for managing classification risk disputes between establishments and CABs.
The LAR submits the full dossier plus the CAB certificate and assessment report to the MDA via MeDC@St. Because the CAB has already comprehensively pre-reviewed the file, the MDA review typically moves faster in practice than the 60-working-day headline target suggests. Products arrive at the MDA effectively pre-cleared.
On approval, the MDA issues a registration certificate valid for 5 years and lists the device on the Malaysia Medical Device Register (MMDR). The device can now be legally imported and sold in Malaysia.
Effective 2 January 2026, a mandatory import permit must be obtained via the ePermit/DagangNet system before any physical shipment of registered devices into Malaysia. MDA and Malaysian Customs have integrated import controls. The importer must activate an ePermit account, nominate system users, and submit permits several days before shipment — typically processed in approximately 3 working days.
CAB vs MDA: Detailed Comparison
| Factor | CAB | MDA |
|---|---|---|
| Type of body | Private, independent organisation | Government authority (Ministry of Health) |
| Registered by | Registered and overseen by MDA | Statutory body established under Act 737 |
| Stage in process | Before MDA submission | After CAB assessment is complete |
| Primary function | Technical pre-review of device dossier and QMS | Official regulatory review and registration decision |
| Output | CAB certificate + conformity assessment report | Registration certificate + MMDR listing |
| Who they deal with | LAR (or manufacturer directly) | LAR via MeDC@St only |
| Required for Class A | No — Class A is CAB-exempt | Yes — Class A submits directly to MDA |
| Required for Class B, C, D | Yes — mandatory before MDA submission | Yes — mandatory, receives submission after CAB |
| Target review time | Full: ~1.5 months · Verification: 30 working days | Class A: 30 working days · Class B–D: 60 working days |
| Can reject the application | Yes — before it reaches MDA | Yes — after CAB has approved |
| Certificate validity | 5 years | 5 years (registration certificate) |
Why It Matters
Why the CAB Effectively Pre-Clears Your MDA Application
One of the most practically useful things to understand about the CAB–MDA relationship is that the CAB's review is so thorough that by the time your file reaches the MDA, it has already been subject to comprehensive scrutiny. This has a direct implication for how you should think about the CAB stage.
The CAB reviews every element of the CSDT in detail — EPSP checklist cross-references, clinical evidence depth, QMS certification, DoC format, labelling consistency, and device classification. The MDA review builds on this rather than starting from scratch, which is why MDA assessment in practice is often faster than the 60-working-day target suggests.
Manufacturers who submit a complete, well-structured dossier to the CAB on the first attempt consistently achieve faster overall registration timelines. Conversely, a CAB that raises multiple non-conformities — or rejects the application — resets the clock before the file ever reaches the MDA.
The CAB and MDA are independent decision-makers. A CAB rejection means the file never reaches the MDA. An MDA rejection means the file passed the CAB but failed at the final regulatory stage — usually due to classification issues, outstanding queries, or post-market surveillance concerns not fully addressed. Both scenarios require correction and resubmission.
For devices eligible for the verification route (prior FDA, CE, HSA, TGA, or Health Canada approval), the CAB relies on the international authority's prior assessment rather than conducting a fully independent technical review. This reduces timeline and cost — but the CAB still plays a meaningful role. Since 1 March 2026, Singapore HSA-registered devices are permanently eligible for this faster route.
Misconceptions About the CAB–MDA Relationship
They are entirely separate. The MDA is the government authority. The CAB is a private, independent organisation that has been approved by the MDA to conduct assessments. You interact with both — but at different stages of the process, through your LAR.
Wrong — you submit to the CAB first. The MDA will not accept a Class B, C, or D registration application without a valid CAB certificate and assessment report. There is no pathway to bypass the CAB for these device classes.
No. The verification route changes what the CAB does — it conducts a targeted verification of the prior international approval rather than a full independent assessment. The CAB step is still mandatory, and the CAB still issues a certificate before MDA submission.
Not necessarily. The MDA conducts its own independent review. While CAB pre-clearance significantly improves the likelihood of smooth MDA approval, the MDA can still raise queries or reject an application — particularly if classification concerns emerge that the CAB did not flag, or if post-market surveillance documentation is insufficient.
Managing Both the CAB and MDA on Your Behalf
TT Medical coordinates the entire workflow — CAB selection, dossier preparation, CAB query management, MDA submission, and post-approval import permit applications — as your Local Authorised Representative. Manufacturers working with us deal with a single point of contact for the entire registration process, rather than managing separate relationships with the CAB and MDA independently.
Final Thoughts
The CAB and MDA are not interchangeable — they are sequential. The CAB comes first, conducts the most technically demanding review in the process, and pre-clears your dossier before it reaches the MDA. The MDA then conducts its own review and issues the legal registration certificate.
Understanding this sequence — and preparing your documentation to the standard required for a clean first CAB submission — is the most effective way to protect your overall registration timeline. If you need support with understanding what the CAB assesses or preparing your technical file, speak to our consultancy team before you begin.
FAQ