Post-Market Surveillance (PMS) is a mandatory ongoing obligation for all registered medical devices in Malaysia, governed by the Medical Device Act 2012 (Act 737) and the Medical Device (Duties and Obligations of Establishments) Regulations 2019. Every manufacturer whose device is registered in Malaysia must maintain a documented PMS system that actively monitors the device's safety and performance in the Malaysian market, manages adverse event reporting, coordinates field safety corrective actions, and feeds data back into the clinical evaluation process. The Local Authorised Representative (LAR) is the legally responsible entity for executing these obligations on behalf of foreign manufacturers.
Securing the registration certificate is a milestone, but not the finish line. For manufacturers selling medical devices in Malaysia, the registration approval marks the beginning of an ongoing set of regulatory obligations that run for the full life of the device's market presence.
Post-Market Surveillance is the structured system through which those obligations are fulfilled. Under Act 737, every registered device must be actively monitored after it enters the market, not passively assumed to be safe and effective because it was approved. The MDA expects manufacturers and their LARs to collect real-world data, investigate problems, report incidents, and act on what they find.
This guide covers the complete Malaysian PMS framework: what it requires, how it connects to adverse event reporting and field safety corrective actions, what changed in 2026, and what a compliant PMS system looks like in practice. It is written for manufacturers who already have a device registered in Malaysia and want to understand their ongoing obligations in full.
Key Takeaways
- PMS is mandatory for all registered medical devices in Malaysia, covering all device classes and registration types.
- The legal basis is Act 737 (Sections 37–42) and the Medical Device (Duties and Obligations of Establishments) Regulations 2019.
- MDA/GD/0070 Second Edition (September 2025) standardised the PMS data requirement to the past 3 years, previously stated as 3 to 5 years.
- The LAR is the legally responsible entity for PMS in Malaysia; the manufacturer's PMS data flows through the LAR to the MDA.
- Mandatory problem reporting timeframes are strict: 48 hours for public health threats, 10 days for death or serious injury, 30 days for likely serious injury on recurrence.
- PMS data must be used to actively update the clinical evaluation, not just collected and filed.
- The Medical Device (Designated Medical Device) Order 2026 (effective 1 June 2026) has expanded PMS obligations to aesthetic devices including medical lasers, HIFU systems, and liposuction equipment.
What Is Post-Market Surveillance (PMS)?
Post-Market Surveillance is the systematic, proactive process by which manufacturers and their Malaysian LARs collect, record, analyse, and act on information about the performance and safety of their registered medical devices in the Malaysian market after they have been placed on sale.
PMS is not a single document or a once-a-year review. It is an ongoing system built into the manufacturer's quality management system and operationalised in Malaysia through the LAR. The MDA expects the PMS system to be active: collecting data continuously, investigating complaints promptly, and feeding findings back into the clinical evaluation process on a defined schedule.
What a Malaysian PMS System Must Cover
The MDA does not prescribe a single template for PMS systems, but it sets clear expectations for what any compliant system must do. The following elements are the minimum requirement for a PMS system that satisfies Malaysian regulatory expectations.
The PMS system must actively gather post-market data, not just respond to complaints when they arrive. This includes systematic review of literature, device registries, post-market clinical follow-up (PMCF) data where applicable, and feedback from distributors, healthcare professionals, and end users in Malaysia.
A documented complaint handling procedure must be in place for the Malaysian market. The LAR must maintain a standard complaint form for users to report device-related issues. Every complaint must be documented, investigated, categorised by severity, and closed with a clear record. The MDA may request complaint records during inspections or adverse event investigations.
Beyond individual complaint handling, the PMS system must include ongoing trend analysis: identifying patterns in complaint data or field performance that may indicate a developing safety signal before it becomes a reportable incident. Reactive complaint handling alone does not constitute a compliant PMS system.
Under MDA/GD/0070 Second Edition, PMS data must be used to actively update the clinical evaluation report. The update frequency depends on device risk: at least annually for high-risk or not-yet-well-established devices, and every 2 to 5 years for low-risk, well-established devices where no new safety signals have emerged. PMS data that triggers a material change to the clinical evaluation must prompt an immediate update.
The manufacturer must maintain a Post-Market Surveillance Report summarising PMS activities, findings, and conclusions over the monitoring period. Under MDA/GD/0070 Second Edition, this report must cover the past 3 years of post-market data, revised from the previous 3 to 5 year requirement. For re-registration, an updated PMS report must be submitted.
The PMS system must be integrated with distribution records: knowing which devices went where, in what quantities, and when. This enables effective traceability for adverse event investigations and field safety corrective actions. Without accurate distribution records, PMS loses its operational value when a safety issue requires action.
Mandatory Problem Reporting: Timeframes and Requirements
When a device-related incident occurs in Malaysia, mandatory problem reporting is the formal mechanism through which the LAR notifies the MDA. It is governed by Regulation 5 of the Medical Device (Duties and Obligations of Establishments) Regulations 2019 and MDA guidance document MDA/GD/0014.
Three reporting timeframes apply, determined by the severity of the incident.
| Incident Type | Reporting Deadline | Typical Examples |
|---|---|---|
| Public health threat | 48 hours from awareness | Widespread device contamination, large-scale failure affecting multiple patients simultaneously |
| Death or serious deterioration of health | 10 days from awareness | Device malfunction causing patient death, serious injury, or life-threatening deterioration |
| Likely to cause serious injury on recurrence | 30 days from awareness | Device defect that has not yet caused serious injury but poses a recurrence risk |
Following the initial mandatory report, the LAR must coordinate with the manufacturer to investigate the root cause and implement corrective and preventive actions (CAPA). The MDA evaluates the investigation report and, if satisfied with the findings and actions, will formally close the case in writing.
Field Safety Corrective ActionsField Safety Corrective Actions (FSCAs)
A Field Safety Corrective Action is any action taken by a manufacturer to reduce a risk of death or serious injury associated with a device already on the market. FSCAs include product recalls, device modifications, software updates, and labelling corrections. In Malaysia, the LAR coordinates all FSCA activity on behalf of the manufacturer.
A voluntary FSCA is initiated by the manufacturer or LAR upon identification of a safety issue, before the MDA directs action. The LAR notifies the MDA, issues a Field Safety Notice (FSN) to affected parties, and coordinates retrieval or correction of affected devices. The FSN must be reviewed and approved by the MDA before distribution.
Under Section 42(4) of Act 737, the MDA has authority to order a mandatory recall if a device presents a significant public health risk. The MDA considers factors including the likelihood of serious illness or injury, impact on vulnerable populations, and availability of alternative treatments when assessing whether a mandatory recall is warranted.
For re-registration, the submission must include a summary of all reportable adverse events and field corrective actions including recalls for the past 3 years. For FSCAs that remain open at the time of re-registration, a description of the ongoing analysis and CAPA must be provided. If there have been no adverse events or FSCAs since commercial introduction, an attestation letter from the manufacturer on company letterhead is required.
What PMS Evidence Is Required for Re-Registration
The connection between ongoing PMS and the five-year re-registration cycle is one of the most practically important aspects of Malaysian PMS compliance that manufacturers often underestimate. PMS is not just an ongoing obligation; it directly feeds the re-registration submission.
| Updated PMS report | A PMS report covering the past 3 years of post-market data, including complaint summaries, trend analysis findings, and any safety signals identified. Under MDA/GD/0070 Second Edition, the 3-year window is standardised, previously stated as 3 to 5 years. |
| Adverse event summary | A summary of all reportable adverse events associated with the device for the past 3 years, including those reported in other markets where the device is sold. |
| FSCA summary | A summary of all field corrective actions including recalls for the past 3 years. For open FSCAs, a description of ongoing analysis and CAPA must be included. |
| Updated clinical evaluation | The clinical evaluation report must be updated to reflect PMS findings. If PMS data has triggered changes to the clinical assessment, those changes must be incorporated before re-registration submission. |
| No adverse events attestation | If there have been no adverse events or FSCAs since commercial introduction, the manufacturer must provide an attestation letter on company letterhead confirming this. It cannot be omitted from the submission. |
| Updated Declaration of Conformity | An updated DoC must be submitted for re-registration; the original from the initial registration cycle is not sufficient. The DoC must reflect the current state of the device and its conformity with all applicable EPSPs. |
What Changed in 2026 That Affects PMS
MDA/GD/0070 Second Edition, effective September 2025, standardised the post-market surveillance data requirement to the past 3 years, replacing the previous "3 to 5 years" range. This provides clearer expectations for both re-registration submissions and ongoing PMS report preparation. Manufacturers should ensure their PMS systems are capturing and retaining data in a format that can be efficiently extracted and summarised for the 3-year window.
The Medical Device (Designated Medical Device) Order 2026, effective 1 June 2026, designates aesthetic devices (including medical lasers, HIFU systems, and liposuction equipment) as medical devices under Act 737. Manufacturers of these devices now carry full PMS obligations under Malaysian law for the first time, including mandatory problem reporting, complaint handling, and FSCA coordination. Clinics and importers of these devices must also comply with MDA registration and post-market requirements.
With Malaysia joining MDSAP in September 2025, manufacturers holding MDSAP certification now have their quality management system, including PMS processes, recognised by the MDA. MDSAP-certified manufacturers should verify that their PMS procedures align with Malaysian-specific requirements, including the 3-year data window and the mandatory reporting timeframes under the 2019 Regulations.
MDA/GD/0070 Second Edition clarified that the clinical evaluation report must be updated at least annually for devices carrying significant risks or not yet well established, and every 2 to 5 years for devices not expected to carry significant risks and that are well established, with a justification provided. PMS data drives these updates, making an active, well-documented PMS system directly important to clinical evaluation compliance.
PMS Compliance Failures That Trigger MDA Action
Submitting a PMS report as part of the initial registration and then taking no further action is a fundamental compliance failure. PMS must be an active, ongoing system, not a document created at registration and filed indefinitely.
The 48-hour, 10-day, and 30-day reporting deadlines are strict. Missing them, even by a short period, is a violation of the 2019 Regulations. Many manufacturers miss deadlines because their complaint handling system does not have a clear escalation trigger that flags potential adverse events for LAR notification in real time.
PMS data that identifies new safety signals, complaint trends, or performance issues must be used to update the clinical evaluation. Filing PMS reports without acting on those findings, particularly when new data suggests the clinical evaluation needs revision, leaves the manufacturer exposed at re-registration.
When a field safety corrective action is needed, incomplete or out-of-date distribution records make it impossible to identify all affected devices and their locations in Malaysia. An FSCA that cannot be executed effectively because of poor distribution record management is itself a compliance failure under the 2019 Regulations.
Re-registration requires an updated PMS report, adverse event summary, FSCA summary, and updated clinical evaluation. Manufacturers who have not maintained an active PMS system throughout the registration cycle often find themselves unable to compile this evidence at re-registration time, because the data was never systematically collected.
PMS Support from TT Medical
TT Medical manages the full scope of post-market surveillance obligations as your Local Authorised Representative, maintaining the complaint handling system, managing mandatory problem reports within the required timeframes, coordinating field safety corrective actions, and preparing the PMS documentation required for re-registration. We ensure your PMS system is an active, compliant function rather than a filing exercise.
Final Thoughts
Post-Market Surveillance in Malaysia is not a regulatory afterthought. It is a structured, legally mandated system that runs in parallel with your device's commercial presence. The MDA expects an active PMS system, strict adherence to adverse event reporting deadlines, prompt FSCA coordination, and PMS data that meaningfully informs the clinical evaluation.
The manufacturers who manage this well are the ones who build PMS into their quality systems as a genuine function, not a document. The manufacturers who struggle are the ones who treat it as a registration formality and find themselves unable to produce the required evidence at re-registration time.
If you would like to review your current PMS compliance status or discuss how TT Medical manages these obligations on behalf of registered manufacturers, speak to our consultancy team.
FAQ