Malaysia Medical Device Change Management 2026: MDA/GD/0072, Risk-Based Change Control & MedCAST 3.0

Regulatory change management is becoming one of the most important challenges for the global medical device industry.

Medical devices are no longer static products. They are continuously evolving through software updates, new materials, manufacturing improvements, sterilization changes, cybersecurity enhancements, artificial intelligence, Software as a Medical Device (SaMD), labelling updates and Unique Device Identification (UDI) requirements.

As a result, the regulatory question is no longer simple:

“Has the medical device changed?”

The more important question is:

“Does the change affect the device's safety, performance, intended purpose or regulatory compliance and what regulatory action is required?”

Malaysia is moving toward a more structured and risk-based approach to answering that question.

The Medical Device Authority (MDA) has published the first edition of MDA/GD/0072: Change Management for Registered Medical Devices, designed to replace the existing MDA/GD/0020: Change Notification for Registered Medical Device framework. The new guidance introduces principles for categorizing, assessing and managing changes to registered medical devices.

However, manufacturers should note an important transition point: MDA/GD/0072 has been published but has not yet been implemented. According to MDA, it will take effect following the official launch of MedCAST 3.0. Until implementation occurs, MDA/GD/0020 remains applicable and in force.

For manufacturers operating in Malaysia, this creates an important preparation window.

What Is MDA/GD/0072?

MDA/GD/0072 is the first edition guidance document titled “Change Management for Registered Medical Devices.”

It represents a shift from a traditional change-notification approach toward a broader change-management framework.

The guidance is intended to help establishments evaluate changes made to registered medical devices and determine the appropriate regulatory pathway.

MDA has identified the new document as the replacement for MDA/GD/0020. The Authority's guidance framework is intended to be read together with the applicable Malaysian medical device legislation, including the Medical Device Act 2012 (Act 737) and Medical Device Regulations 2012.

This is particularly relevant for manufacturers with products already registered in Malaysia and for companies managing multiple product changes across global markets.

Why Is Medical Device Change Management Becoming More Important?

Medical device development is increasingly lifecycle driven.

A device may undergo numerous modifications after initial registration, including:

• Design improvements
• Component or material changes
• Manufacturing process changes
• Supplier changes
• Sterilization changes
• Software updates
• Cybersecurity modifications
• Labeling changes
• UDI-related changes
• Manufacturing-site changes
• Changes to registration information

Not every modification has the same regulatory impact.

A minor administrative update may require limited documentation, while a change affecting intended purpose, safety or performance may require a much more significant regulatory assessment.

Therefore, manufacturers need a structured method to answer four fundamental questions:

1. What exactly has changed?
2. Why is the change being made?
3. Does the change affect safety, performance or regulatory compliance?
4. What regulatory action is required before implementation?

This risk-based thinking is at the heart of modern medical device lifecycle management.

Key Areas Covered by the New Change Management Approach

The new guidance addresses changes across multiple aspects of registered medical devices.

1. Manufacturing Changes

Manufacturers may need to assess changes involving:

• Manufacturing facilities
• Manufacturing processes
• Production controls
• Quality management systems
• Suppliers or manufacturing arrangements

A manufacturing modification may appear operational rather than regulatory, but it can become significant if it affects device specifications, quality, safety or performance.

2. Device Design and Specifications

Design changes may include modifications to:

• Device components 
• Specifications
• Functional characteristics
• Performance parameters
• Intended purpose
• Design outputs

Manufacturers should evaluate whether the modification creates a new risk or changes an existing risk profile.

A robust change assessment should therefore connect engineering change control with regulatory impact assessment.

3. Sterilization Changes

Sterilization changes are particularly important for sterile medical devices.

Potential changes may involve:

• Sterilization method
• Sterilization facility
• Sterilization process parameters
• Sterility assurance considerations
• Packaging or validation-related changes

Manufacturers should ensure that the regulatory assessment remains aligned with validation, risk management and product quality requirements.

4. Software and SaMD Changes

Software-driven medical devices create a particularly complex change-management environment.

Updates may involve:

• Software functionality
• Algorithms
• User interfaces
• Performance improvements
• Cybersecurity updates
• Operating-system compatibility
• Artificial intelligence or machine-learning functionality

The critical question is whether the software modification changes the device's intended purpose, clinical functionality, safety or performance.

This is increasingly important as manufacturers adopt continuous software development and release cycles.

5. Materials and Components

Material changes can affect:

• Biocompatibility
• Mechanical performance
• Chemical characteristics
• Durability
• Sterility
• Shelf life
• Patient safety

Even when a material change appears technically equivalent, manufacturers should document the scientific and regulatory rationale supporting the equivalence assessment.

6. Labelling and UDI-DI Changes

Changes to labels, identifiers and product information can also have regulatory consequences.

Manufacturers should evaluate changes involving:

• Product labels
• Instructions for use
• Packaging information
• Device identifiers
• UDI-DI information
• Registration details

UDI requirements make accurate device identification increasingly important for traceability throughout the medical device lifecycle.

Risk-Based Change Assessment

One of the most important concepts behind modern change management is risk-based decision-making.

Not every change should automatically result in the same regulatory pathway.

Instead, manufacturers should evaluate the potential impact of the change.

A practical assessment can be considered:

Change → Technical Impact → Safety/Performance Impact → Regulatory Impact → Required Action

For example:

The objective is not simply to classify the change.

The objective is to demonstrate why a particular regulatory pathway is appropriate.

What Regulatory Actions May Be Required?

Depending on the nature and impact of the change, manufacturers may need to determine whether the change requires:

1. Prior MDA Approval

Certain significant changes may require regulatory review before implementation.

Manufacturers should not assume that an internally approved engineering change can automatically be introduced into the Malaysian market.

2. Notification

Changes falling within an applicable notification pathway may require submission to MDA with appropriate supporting documentation.

The existing MDA change-notification framework categorizes changes and specifies documentation requirements for different types of modifications.

3. Internal Documentation

Some changes may be made through the manufacturer's internal quality and regulatory systems without requiring external submission.

However, this does not mean the change can be undocumented.

The manufacturer should maintain evidence of:

• Change description
• Reason for change
• Risk assessment
• Technical evaluation
• Verification and validation
• Regulatory assessment
• Approval decision
• Implementation records

New Registration or Further Regulatory Assessment

If a modification fundamentally changes the device, its intended purpose or its regulatory characteristics, manufacturers may need to determine whether the existing registration remains appropriate.

This is why change management should be integrated with regulatory strategy rather than treated as a simple administrative activity.

MDA/GD/0072 vs MDA/GD/0020

The transition from Change Notification to Change Management is an important development.

MDA/GD/0020 currently provides the applicable change-notification framework and includes categories of change and associated documentation requirements.

MDA/GD/0072 provides the upcoming change-management framework.

However, manufacturers should carefully manage the transition.

MDA has specifically stated that MDA/GD/0020 remains applicable until MDA/GD/0072 takes effect following the launch of MedCAST 3.0.

What Should Medical Device Manufacturers Do Now?

The publication of MDA/GD/0072 provides manufacturers with an opportunity to prepare before implementation.

2026 Change Management Readiness Checklist

Regulatory Review

• Review MDA/GD/0072 and identify relevant requirements
• Compare the new guidance with current MDA/GD/0020 processes
• Identify products potentially affected by the transition

Product Portfolio Assessment

• Map existing Malaysian registrations
• Review planned design and manufacturing changes
• Identify upcoming software releases
• Review material and supplier changes
• Assess sterilization modifications
• Review of labelling and UDI-related changes

Quality & Regulatory Systems

• Integrate regulatory assessment into engineering change control
• Establish documented change-impact assessments
• Define responsibilities between RA, QA, engineering and product teams
• Maintain traceable change records

MedCAST Preparation

• Monitor MDA announcements regarding MedCAST 3.0
• Prepare internal regulatory teams for the transition
• Review of submission information and supporting documentation requirements

Why This Matters for Global MedTech Companies

Malaysia’s move toward structured change management reflects a broader global trend.

Medical device regulators increasingly expect manufacturers to demonstrate effective lifecycle control.

The challenge is no longer simply obtaining registration.

Manufacturers must also demonstrate that registered devices remain compliant throughout their lifecycle.

This has direct implications for:

1. Time to Market:
Poorly assessed changes can create regulatory delays.

2. Market Continuity:
Uncontrolled changes may create compliance risks for products already commercialized.

3. Software Lifecycle Management:
Frequent software updates require clear regulatory decision-making.

4. UDI Compliance:
Changes to device identification and product information must remain controlled.

5. Global Regulatory Strategy:
Manufacturers increasingly need harmonized change assessments across multiple jurisdictions.

Common Challenges for Manufacturers

1. Regulatory and Engineering Teams Working Separately

Engineering teams may evaluate whether a change is technically acceptable, while regulatory teams need to determine whether it is legally and regulatorily acceptable.

These assessments must be connected.

2. Insufficient Change Documentation

A regulatory conclusion without adequate supporting evidence can create problems during inspections or audits.

3. Software Changes Occurring Too Frequently

Traditional regulatory processes may not align with agile software development.

Manufacturers need defined criteria for evaluating software modifications.

4. Global Changes Not Mapped to Malaysia

A change approved or implemented in another market does not automatically mean the same regulatory pathway applies in Malaysia.

5. Waiting Until Implementation

Manufacturers that wait until MedCAST 3.0 launches may face unnecessary pressure.

Early assessment allows companies to identify gaps before the transition becomes operational.

Frequently Asked Questions

1. What is MDA/GD/0072?

MDA/GD/0072 is the first edition of Malaysia's guidance document on Change Management for Registered Medical Devices. It is intended to replace MDA/GD/0020.

2. Is MDA/GD/0072 currently mandatory?

No. MDA has published the guidance, but it has not yet been implemented. It will take effect following the official launch of MedCAST 3.0.

3. Which guidance currently applies?

Until MDA/GD/0072 is implemented, MDA/GD/0020 remains applicable and in force.

4. Does the new framework cover software changes?

The change-management approach is relevant to changes across registered medical devices, including modern device configurations where software and digital functionality form an important part of the product lifecycle.

5. Should manufacturers prepare now?

Yes. MDA has advised stakeholders to take note of the upcoming implementation and make the necessary preparations.

Conclusion

Medical device change management is becoming a strategic regulatory discipline.

As products become more software-driven, connected and complex, manufacturers cannot treat changes as isolated engineering activities.

Every change should be evaluated through a structured question:

What changed, what is the impact, what evidence supports the assessment, and what regulatory action is required?

Malaysia's publication of MDA/GD/0072 represents an important step toward a more structured approach to lifecycle change management.

Although the guidance is not yet implemented, manufacturers have an important preparation window before the launch of MedCAST 3.0.

Until then, MDA/GD/0020 remains the applicable framework.

For MedTech companies, the message is clear:

Change management is no longer simply a quality-system activity.

It is becoming an essential part of regulatory strategy, market access and product lifecycle management.

How Maven Regulatory Solutions Can Help

Maven Regulatory Solutions supports medical device manufacturers with regulatory strategy, compliance assessment and lifecycle regulatory activities across global markets.

Our support can include:

• Medical device regulatory gap assessments
• Change-impact and regulatory pathway assessments
• Malaysia MDA regulatory support
• Change notification strategy
• Technical documentation review
• Software and SaMD regulatory assessments
• UDI and labelling compliance support
• Regulatory submission support
• Global management strategy
• Regulatory lifecycle management

As regulatory expectations continue to evolve, proactive change management can help manufacturers reduce regulatory uncertainty, maintain market continuity and support efficient product development.

Prepare for the transition. Assess your changes early. Build regulatory readiness before implementation.