Best Practices for Working With an OEM Medical Device Manufacturer in Malaysia

By Zahid Osman · Manufacturing Partnerships Editor · Published 13 Sep 2026

How Malaysian brand owners keep an OEM medical device relationship compliant, stable and portable after the first batch ships — quality agreements, change control, post-market duties, audits and exit planning.

Quick answer: The best practice for working with an OEM medical device manufacturer in Malaysia is to run the relationship as a controlled quality system, not a supply contract: a written quality agreement that assigns every regulatory duty, a change-control rule that stops the factory altering materials, suppliers, processes or sites without your prior approval, and a defined loop for complaints, problem reports and recalls. Under the Medical Device Act 2012, registration and post-market duties sit with a named establishment, and an unannounced change can quietly undermine the validation behind the device. This applies to Class A to D devices made for your brand; medicines, supplements and cosmetics follow NPRA instead. Start by listing which party holds each licence and certificate.

Key takeaways

• The quality agreement, not the purchase order, decides who answers to the regulator. Sign it before the first commercial batch.
• Change control is the most valuable practice after launch. The dangerous change is the one you never hear about.
• Know which party is the legal manufacturer and which holds the MDA registration and establishment licence — that decides who reports problems and runs recalls.
• Audit on risk, not on a calendar. A factory tour is not an audit; a batch traced backwards is.
• Keep one compliance calendar for every licence and certificate both parties rely on, and plan the exit while the relationship is still good.

Who this guide is for

Brand owners, product managers and regulatory leads in Malaysia who already have — or are about to sign with — a contract manufacturer for a medical device or device-type healthcare product, such as dressings, supports, test kits, lubricants or reusable instruments. If you are still choosing a factory, start with our guide on how to choose an OEM medical and healthcare products manufacturer and the vetting checklist for medical device OEMs. This article picks up after the contract is signed. More guides are collected in our medical and healthcare products section.

Why does the relationship need more discipline after launch than before it?

After launch, the risk shifts from choosing the wrong partner to drifting quietly away from what was approved. Before launch both sides are focused: the design is frozen, validation is fresh and the registration dossier has just been assembled. Twelve months later the resin supplier has changed, the operator who ran the validation has left, the sterilisation contractor has a new chamber and your artwork is on its fourth revision. None of these is a failure on its own. Together, they are how a registered device drifts away from the technical file that supports it.

A medical device is sold on the strength of evidence — design verification, process validation, biocompatibility, sterilisation validation and shelf-life data — and that evidence describes a specific product made in a specific way. Every practice below exists to keep what the factory makes today matching what the evidence describes. Our step-by-step guide to working with a medical device OEM covers the stage gates up to first release; this is what comes after.

Who is the legal manufacturer, and who only makes the device?

The legal manufacturer is the party that takes regulatory responsibility for the device under its own name, and it is not automatically the factory. Medical device regulation — in Malaysia and in the international model its framework draws on — generally attaches manufacturer responsibilities to whoever places the device on the market under its name, whether or not it owns the production line. In an OEM arrangement for your brand, that can mean you.

Settle this in writing before anything else, because every other practice depends on it. The party that holds the registration and the relevant establishment licence carries the post-market duties: handling complaints, reporting problems to the regulator, and running field corrective actions and recalls. If your contract assumes the factory does this while the registration says you do, the gap will surface only during an incident. Confirm with the Medical Device Authority (MDA) how your arrangement is classified and which licence each party needs. Our explainer on what an OEM medical and healthcare products manufacturer is sets out the roles in more detail.

What should a quality agreement with a medical device OEM cover?

A quality agreement should assign every quality and regulatory activity to one named party, with nothing left “shared” and nothing left unmentioned. It is separate from the commercial supply agreement, and for medical devices it is not optional in practice: ISO 13485:2016 expects an organisation to keep control of outsourced processes, including through written quality agreements. A factory certified to ISO 13485 will usually have a template. Treat it as a starting point, not a finished document — templates are written to protect the party that drafted them.

The table below is our recommended default split for a brand owner who is the legal manufacturer and uses an OEM for production. Where your arrangement differs, the rule stays the same: one owner per row.

Which changes should need your approval before the factory makes them?

Any change that could affect the device’s safety, performance or the evidence behind its registration should need your written approval before it is implemented — not a notification afterwards. Factories change things for sound reasons: a cheaper resin, a faster line, an earlier sterilisation slot. Most changes are harmless. The problem is that the factory is not always in a position to judge which ones touch your biocompatibility data, your validation or your registration.

Some changes also carry regulatory consequences. MDA has requirements for changes to registered devices, and whether a change must be notified or approved depends on its nature and the device class. That judgement belongs to the registration holder — another reason the factory must tell you first. Use this default tiering and write it into the quality agreement.

How should complaints, problem reports and recalls flow?

Complaints should reach the registration holder first, and the factory’s role is to investigate the manufacturing side within an agreed time. Many brand owners set this up the wrong way round: distributors and clinics call the factory because its name appears on a document, and the factory quietly fixes a batch issue without anyone deciding whether the event was reportable.

Under Act 737 and its regulations, post-market obligations — problem reporting, field corrective actions and recalls — attach to the establishment responsible for the device on the market. Map the loop explicitly: who receives the complaint, who logs it, who decides reportability, who contacts MDA, how quickly the factory must pull the batch record, and who pays for returned-stock analysis. Then test it once with a mock complaint. A traceability drill — pick a finished lot and ask the factory to show every component lot and sterilisation load that went into it — tells you more about recall readiness than any procedure document.

How often should you audit the factory, and what should you look at?

Audit frequency should follow risk: sterile or measuring devices, and any factory with open corrective actions, deserve closer attention than a low-risk non-sterile product with a clean record. A sensible pattern is a full audit before the first commercial batch, periodic audits set by risk and performance, and unscheduled visits after a serious complaint or a major change.

What you examine matters more than how often. A factory tour shows you clean floors; an audit follows evidence. Take one of your own batches and walk it backwards: the batch record, in-process inspection results, calibration status of the equipment used, training records of the operators, the sterilisation certificate and any non-conformances raised during that run. Then read the CAPA log — not the number of CAPAs, but how many are overdue and whether effectiveness checks were actually done. Finally, re-read the ISO 13485 certificate’s scope wording to confirm it still covers what the factory does for you.

What should you check before accepting each batch?

Before releasing a batch to the market, you should hold the evidence the quality agreement promised, not just a delivery note. The minimum is a certificate of conformance tied to the batch number, the batch record or an agreed summary of it, final inspection results against your specification and, for sterile products, the sterilisation records for the loads involved. Where you rely on the factory’s release, say so in the agreement and still review the full documents on a sample basis.

Keep batch acceptance boring and consistent. A one-page release checklist signed by the same role every time beats an experienced person’s judgement applied differently in a busy week. It also gives you a clean record when a regulator or a hospital customer asks how a batch was released.

How do you keep licences, registrations and certificates from lapsing?

Keep a single compliance calendar that tracks every date both parties depend on, and review it at every quarterly meeting. The list is longer than most brand owners expect: your product registration and its renewal, your establishment licence, the factory’s establishment licence, the factory’s ISO 13485 certificate and surveillance audits, the sterilisation contractor’s certificates, any conformity assessment certificates, and the stability or shelf-life studies behind your labelled shelf life.

A lapsed certificate on the factory’s side can become your problem overnight, because hospital and tender buyers often ask for the whole chain. Require the factory to tell you about any certificate suspension, scope reduction or major audit finding within a fixed number of days, and check registration status yourself against MDA’s public records rather than relying on a PDF from the supplier.

How do you control labels and instructions for use?

Treat labels and instructions for use as controlled documents with a version number, an approval record and one master held by the registration holder. Labelling errors are among the most avoidable causes of field actions: an outdated leaflet printed from an old file, a missing symbol, a lot-number format that changed without anyone noticing.

Agree who owns the artwork files, how approvals are signed, and what the factory must do with obsolete printed stock. Check label content against MDA’s current labelling requirements, including language requirements, before each revision — a label that was compliant at registration is not guaranteed to stay compliant.

How should forecasts and component supply be managed?

Share a rolling forecast and agree how firm each horizon is, because medical device components often have longer lead times and fewer qualified sources than consumer-goods parts. A validated component cannot simply be swapped for whatever is in stock; if a sole-source moulder or pouch supplier fails, requalification can take far longer than an ordinary supply disruption.

Three habits help. Ask the factory to flag single-source critical components, and decide together which ones justify a second qualified source. Agree a last-time-buy notice period for components that may be discontinued. And size finished-goods safety stock by how long a requalification would really take, not by a generic number of weeks. Our guide to the cost of working with a medical OEM explains how these choices show up in unit price.

Which numbers should you review every quarter?

Review a short, fixed set of quality and delivery measures every quarter, and read the trend rather than any single number. We recommend these six:

• Complaints per batch or per units shipped — and how many had a confirmed manufacturing cause.
• Non-conformances raised on your product — a sudden drop to zero deserves as many questions as a spike.
• Open and overdue CAPAs — age matters more than count.
• Change requests raised and approved — and any change you discovered only after it happened.
• On-time, in-full delivery — measured against the originally confirmed date, not the revised one.
• Batch documents complete first time — how often release paperwork arrives without chasing.

Run the review to a standing agenda: metrics, open issues, upcoming changes, compliance calendar, forecast. Minutes with owners and dates turn a friendly catch-up into a record you can rely on later.

How do you plan an exit without damaging the registration?

Plan the exit while the relationship is healthy, because the documents you need to move production are hardest to obtain once it has broken down. The agreement should state which documents you are entitled to receive — specifications, drawings, the device master record or equivalent, validation reports, test methods and the approved supplier list — in what form, and a transition period during which the factory keeps supplying.

Understand what a move costs in regulatory terms. A new manufacturing site generally means new process validation, possibly new sterilisation validation, and a registration change handled by the registration holder with MDA. This is why the legal-manufacturer question matters so much: a brand that holds its own registration and technical file can move; a brand whose registration sits entirely with the factory may find it is starting again. Our list of mistakes to avoid when choosing a medical OEM covers the contract terms that make a later move easier.

What are the warning signs that the relationship is drifting?

The clearest warning sign is learning about a change after it has already happened; the others tend to follow it. Watch for:

• Batch documents arriving later and less complete than they used to.
• The same non-conformance recurring after its CAPA was closed.
• Quality questions being answered by sales rather than the quality manager.
• A finished lot that cannot be traced back to its component lots within the agreed time.
• Certificates arriving expired, or with a narrower scope than before.

Any one of these is a conversation. Two or more at the same time is a reason to bring the next audit forward rather than wait for it.

Frequently asked questions

Do I need a separate quality agreement if my supply contract already covers quality?

Yes, in practice. A supply contract covers price, volume and delivery; a quality agreement assigns quality and regulatory responsibilities activity by activity, which is what an ISO 13485 auditor looks for when processes are outsourced. Keep them as separate documents that reference each other, so the quality agreement can be updated without reopening commercial terms. Compare the factory’s template against the responsibility table above.

Can the factory hold the MDA registration for my brand’s device?

It depends on how the arrangement is structured and classified, so confirm your specific case with the Medical Device Authority. Factory holdership is convenient but reduces portability: changing manufacturer may mean a new registration route. If you accept it, write a clause obliging the factory to cooperate with a transfer and to hand over the supporting documents.

How often should a brand owner audit a medical device OEM?

There is no single correct interval. Base it on device risk, the factory’s performance and any recent changes or complaints: a full audit before the first commercial batch, periodic audits set by risk, and extra visits after a serious complaint or major change. What you examine — a traced batch, the CAPA log, calibration and training records — matters more than the interval itself.

Does every change at the factory need my approval?

No. Changes that could affect materials, suppliers, the manufacturing site, validated process parameters, sterilisation, packaging or labelling should need prior written approval; like-for-like equipment replacement or document formatting can be notification and record only. Put the tiered list into the quality agreement so neither side has to guess where the line is.

Do these practices apply to healthcare products that are not medical devices?

The governance habits do, but the regulator changes. Products regulated as medicines, health supplements or cosmetics fall under the National Pharmaceutical Regulatory Agency (NPRA), not MDA, with different registration and GMP frameworks. Confirm your product’s classification first — a borderline product placed in the wrong route is a bigger problem than any supplier issue.

Sources and how to verify

• Medical Device Authority (MDA) — registration, establishment licensing and post-market guidance: mda.gov.my (checked 13 September 2026).
• Medical Device Act 2012 (Act 737), Medical Device Authority Act 2012 (Act 738) and the Medical Device Regulations 2012 — Laws of Malaysia portal: lom.agc.gov.my.
• ISO 13485:2016, Medical devices — Quality management systems: iso.org.
• ISO 14971:2019, Application of risk management to medical devices: iso.org.
• National Pharmaceutical Regulatory Agency (NPRA) — for products regulated as medicines, supplements or cosmetics: npra.gov.my.

Limitations and scope

This guide sets out good practice for managing a contract manufacturing relationship for medical devices in Malaysia. It is not legal or regulatory advice, and it deliberately does not quote MDA fees, processing timelines, audit frequencies or change-notification categories, because these depend on device class and are revised from time to time. We did not audit any factory for this article. The responsibility split and change tiers are our editorial recommendations; adapt them to your device, its risk class and the arrangement MDA confirms for your case.

Update history

Medical device requirements in Malaysia change periodically. Verify current requirements with the Medical Device Authority and a qualified regulatory professional before acting on this guide.

About the author
Zahid Osman is MalaysiaOEM’s Manufacturing Partnerships Editor, writing about how brand owners structure, manage and exit contract manufacturing relationships across Malaysian product categories.