DMEC / MoH

Vietnam - DMEC / MoH

MandatoryLast updated · 2024Verified · 2026-07-16

Decree 98/2021/ND-CP + Decree 07/2023 + cybersecurity overlay

Authority

Department of Medical Equipment and Construction, Ministry of Health

Enforced

Jan 2022

Legal framework

Decree 98/2021 + Decree 07/2023 + Cybersecurity Law 2018 + PDPD 2023

FDA package reuse

~70%

Editorial estimate · how →

Scope

All medical devices in Vietnam; risk-class A/B/C/D registration regime.

Pre-market

Risk-class registration dossier; ASEAN CSDT template; FDA / CE accepted as supporting evidence.

Post-market

Adverse-event reporting to MoH; cyber-incident reporting under Cybersecurity Law.

SBOM

Recommended

Encouraged for SaMD; mirrors IMDRF N60.

Vulnerability disclosure

VNCERT/CC coordinated disclosure recommended.

Penalty

Registration cancellation; PDPD fines; criminal liability under Cybersecurity Law.

Unique requirements

01Vietnamese Registration Holder
02Vietnamese-language IFU and labelling
03Data localisation for personal data

Highlights

PDPD 2023 introduced GDPR-style data rules
Data localisation for connected devices
ASEAN CSDT template alignment

Aligns with

ASEAN MDD IMDRF N60 ISO 13485

Timeline

Jan 2022

Decree 98/2021 effective
Mar 2023

Decree 07/2023 amends transition rules
Jul 2023

PDPD 2023 effective

Key documents

Decree 98/2021/ND-CP

https://moh.gov.vn/

PDPD 2023, Personal Data Protection Decree

https://www.mic.gov.vn/

How to submit in Vietnam

Playbook reviewed · 2026-07-16

Submission route

Ministry of Health circular 8/2023 registration

Vietnam requires local registration with a Vietnamese entity. Cybersecurity documentation, when submitted, aids review for Class C/D connected devices.

Authority portal

Step-by-step

Step 01

Appoint local representation

Most jurisdictions require a locally-established entity to hold the registration or act as authorised representative before submission.
Step 02

Reuse FDA or CE package as baseline

Adapt the cybersecurity subsection you already prepared for FDA or CE; regulators here typically accept the structure and ask for local labeling additions.
Step 03

Translate and localise

Local-language technical summary and labeling are usually mandatory; certified translation is safest.
Step 04

Submit + track queries

Respond to clarification rounds promptly; each unanswered question can add 30-90 days to the clock.

Evidence checklist

Item	Level	FDA equivalent	Notes
Cybersecurity documentation (baseline FDA or CE)	Required	SPDF
Local authorised representative agreement	Required	—
Local-language labeling and IFU	Required	—
SBOM	Recommended	—	Not mandatory but reduces clarification rounds.

Common DMEC rejections

Local classification disputed

Common

Fix · Provide the manufacturer's classification rationale with references to ASEAN/IMDRF rules.

Typical timeline

End-to-end window: 6-12 months

Phase 01

Local rep + dossier prep

2-4 months

Phase 02

Regulatory review

6-12 months

Phase 03

Approval + market entry

1-3 months

Related markets

Japan

~70% FDA reuse

Ukraine

~70% FDA reuse

South Korea

~65% FDA reuse

European Union

~60% FDA reuse

Frequently asked about Vietnam

Is SBOM required for medical devices in Vietnam?

Recommended. Encouraged for SaMD; mirrors IMDRF N60.

What does DMEC / MoH require for pre-market cybersecurity?

Risk-class registration dossier; ASEAN CSDT template; FDA / CE accepted as supporting evidence.

What are the post-market cybersecurity obligations under DMEC / MoH?

Adverse-event reporting to MoH; cyber-incident reporting under Cybersecurity Law.

What is the penalty for non-compliance with DMEC / MoH cybersecurity rules?

Registration cancellation; PDPD fines; criminal liability under Cybersecurity Law.

How much of my FDA cybersecurity package is reusable in Vietnam?

Roughly 70% - an editorial estimate based on overlapping evidence requirements (threat model, SBOM, security risk assessment, pen-test report).