DMEC / MoH
Vietnam - DMEC / MoH
Decree 98/2021/ND-CP + Decree 07/2023 + cybersecurity overlay
Authority
Department of Medical Equipment and Construction, Ministry of Health
Enforced
Jan 2022
Legal framework
Decree 98/2021 + Decree 07/2023 + Cybersecurity Law 2018 + PDPD 2023
Scope
All medical devices in Vietnam; risk-class A/B/C/D registration regime.
Pre-market
Risk-class registration dossier; ASEAN CSDT template; FDA / CE accepted as supporting evidence.
Post-market
Adverse-event reporting to MoH; cyber-incident reporting under Cybersecurity Law.
SBOM
RecommendedEncouraged for SaMD; mirrors IMDRF N60.
Vulnerability disclosure
VNCERT/CC coordinated disclosure recommended.
Penalty
Registration cancellation; PDPD fines; criminal liability under Cybersecurity Law.
Unique requirements
- 01Vietnamese Registration Holder
- 02Vietnamese-language IFU and labelling
- 03Data localisation for personal data
Highlights
- PDPD 2023 introduced GDPR-style data rules
- Data localisation for connected devices
- ASEAN CSDT template alignment
Aligns with
Timeline
Jan 2022
Decree 98/2021 effective
Mar 2023
Decree 07/2023 amends transition rules
Jul 2023
PDPD 2023 effective
Key documents
How to submit in Vietnam
Playbook reviewed · 2026-07-16
Submission route
Ministry of Health circular 8/2023 registration
Vietnam requires local registration with a Vietnamese entity. Cybersecurity documentation, when submitted, aids review for Class C/D connected devices.
Authority portalStep-by-step
Step 01
Appoint local representation
Most jurisdictions require a locally-established entity to hold the registration or act as authorised representative before submission.
Step 02
Reuse FDA or CE package as baseline
Adapt the cybersecurity subsection you already prepared for FDA or CE; regulators here typically accept the structure and ask for local labeling additions.
Step 03
Translate and localise
Local-language technical summary and labeling are usually mandatory; certified translation is safest.
Step 04
Submit + track queries
Respond to clarification rounds promptly; each unanswered question can add 30-90 days to the clock.
Evidence checklist
| Item | Level |
|---|---|
| Cybersecurity documentation (baseline FDA or CE) | Required |
| Local authorised representative agreement | Required |
| Local-language labeling and IFU | Required |
| SBOM | Recommended |
Common DMEC rejections
Local classification disputed
CommonFix · Provide the manufacturer's classification rationale with references to ASEAN/IMDRF rules.
Typical timeline
End-to-end window: 6-12 months
Phase 01
Local rep + dossier prep
2-4 months
Phase 02
Regulatory review
6-12 months
Phase 03
Approval + market entry
1-3 months
Related markets
Frequently asked about Vietnam
Is SBOM required for medical devices in Vietnam?
Recommended. Encouraged for SaMD; mirrors IMDRF N60.
What does DMEC / MoH require for pre-market cybersecurity?
Risk-class registration dossier; ASEAN CSDT template; FDA / CE accepted as supporting evidence.
What are the post-market cybersecurity obligations under DMEC / MoH?
Adverse-event reporting to MoH; cyber-incident reporting under Cybersecurity Law.
What is the penalty for non-compliance with DMEC / MoH cybersecurity rules?
Registration cancellation; PDPD fines; criminal liability under Cybersecurity Law.
How much of my FDA cybersecurity package is reusable in Vietnam?
Roughly 70% - an editorial estimate based on overlapping evidence requirements (threat model, SBOM, security risk assessment, pen-test report).