MS IEC 62305 in Malaysia
The directive that made the standard legally binding, the phased deadlines that pulled existing buildings in, why the risk assessment genuinely decides the outcome, and the edition gap nobody mentions.
Malaysia is the one market on this list where lightning protection carries a criminal penalty. The obligation reached existing hospitals, commercial and industrial buildings on 1 January 2021, and the document that decides whether a system is needed at all is the risk assessment.
That combination is unusual. Most countries adopt IEC 62305 and leave enforcement to building control at the point of approval, which reaches new construction and nothing else. Malaysia enforces it through its electricity regulator, under an Act with a penalty provision, and phased it across the existing building stock over three years.
This page is written from Arahan/ST/No. 4/2019 as published by the Suruhanjaya Tenaga, from the published front matter of MS IEC 62305-2:2007, and from the Commission's own published guidance. Every claim below names the document it comes from. It does not reproduce the standard, and Lumex is independent of the Suruhanjaya Tenaga, the Department of Standards Malaysia and the IEC.
An identical adoption, with the differences listed
The cover of MS IEC 62305-2:2007 reads "Protection against lightning, Part 2: Risk management (First revision)", and beneath it, "IEC 62305-2:2006, IDT". IDT is the marker for an identical adoption, and the standard defines it on the same page: a standard whose technical content, structure and wording are exactly the same as the International Standard, subject only to the minimal editorial changes allowed by ISO/IEC Guide 21-1.
The national foreword then does something genuinely useful, which is to enumerate the differences rather than gesture at them. It states that the Malaysian Standard is identical with IEC 62305-2:2006 and that, for the purposes of the Malaysian Standard, four things apply. In the source text, "this International Standard" should read "this Malaysian Standard". The comma used as a decimal sign is to read as a point. The IEC basis is printed in English and French, and only the English version on odd pages is retained. And references to normative references are replaced by Malaysian Standards.
All four are editorial. There is no technical departure and no Malaysian national annex recorded in that foreword, which is worth stating positively rather than leaving as an absence: a Malaysian assessment runs the IEC method on IEC parameters, with no national tables to substitute and no national ground flash density annex of the kind the UK and Singapore added. The decimal marker point is the same practical trap it is everywhere, since a value copied out of the standard without converting the comma reads as a factor of a thousand.
One more line from the front matter carries into any conversation with a client, and it is the same caution the British and Singapore standards give: compliance with a Malaysian Standard does not of itself confer immunity from legal obligations. The standard is the method. What makes it compulsory is elsewhere.
How the Energy Commission made it binding
The front matter of every Malaysian Standard states its own status: the use of Malaysian Standards is voluntary except in so far as they are made mandatory by regulatory authorities by means of regulations, local by-laws or any other similar ways, under the Standards of Malaysia Act 1996, Act 549. So MS IEC 62305 on its own binds nobody.
The instrument that binds is Arahan Suruhanjaya Tenaga Bilangan 4 Tahun 2019, reference Arahan/ST/No. 4/2019, titled as a directive for the enforcement of the application of MS IEC 62305 for lightning protection systems in buildings. It is issued by the Suruhanjaya Tenaga, the Energy Commission, in exercise of the power conferred by section 50C(1) of the Electricity Supply Act 1990, Act 447.
The legal hook is older than the directive and is worth knowing, because it explains why the electricity regulator rather than the building authority holds this. Section 47 of the same Act, on precautions against atmospheric electricity, provides that any Federal or State Government department, or any other consumer taking or using electricity from an installation, shall, if the Commission so requires, provide such methods to avoid any risk of damage to that installation through atmospheric electricity as the Commission directs or as regulations prescribe. The directive invokes that section and then determines that the design, installation, supervision, testing, operation and maintenance of lightning protection equipment in buildings shall follow MS IEC 62305.
It also clears the ground behind it. On coming into force, the directive states that Circular Number 3 of 2011 on the determination of installation methods for lightning protection systems in buildings, dated 1 September 2011, is withdrawn and void. The two are sometimes described as if the circular survived and the directive merely added teeth. It did not survive; the directive is the operative instrument.
The dates that pulled existing buildings in
New construction is the easy case. What makes this directive different is that it was phased across the buildings that already stood, by category, over three years.
Planning and new development
The directive comes into force on the date it is registered, and from that date it applies to buildings in the planning process and to new development. It applies to all lightning protection installations in buildings from the date it is enforced. The document does not print the registration date, so confirm it with the Commission for any argument that turns on it.
Buildings under construction
For buildings already in the process of being built when the directive landed, it applied from 1 January 2021. That is the transitional case, and it is the one where a design signed off under the withdrawn 2011 circular had to be reconciled with the directive mid-project.
Existing, first wave
Hospitals, higher education institutions, commercial buildings, industrial buildings, condominium residential buildings, apartment residential buildings and airports. The highest occupancy and highest consequence categories went first, and they have been in scope since the start of 2021.
Existing, later waves
1 January 2022 for flats, schools and government buildings. 1 January 2023 for landed residential buildings other than those already named. For any category outside these lists, the directive says the Commission will set the date from time to time, so an unusual building type is not necessarily out of scope, only undated.
Read as a whole, this is a retrofit obligation rather than a new build one, and that is the commercially significant part. Every hospital, university, shopping centre, factory, condominium and airport standing in Malaysia has been inside the scope of this directive since 1 January 2021, and the assessment that establishes what each one needs is the same IEC 62305-2 assessment a new project would run.
Who carries it, and what non-compliance costs
Two paragraphs of the directive decide how seriously it is taken in practice, and both are more pointed than the equivalent in most jurisdictions.
Down to the owner, across the life
The directive is to be applied by all Competent Persons, Electrical Service Contractors, Electrical Contractors, consultants, and building owners or management, at the stages of design, installation, supervision, testing, operation and maintenance. It does not stop at handover and it does not stop at the contractor, so a system installed correctly in 2021 and left unmaintained is still the owner's exposure.
A criminal penalty
The directive records that a person found to have failed to comply commits an offence and may, on conviction, be fined not more than two hundred thousand ringgit, or imprisoned for a term not exceeding two years, or both, under section 50E of the Electricity Supply Act 1990. Very few lightning protection obligations anywhere carry a custodial provision.
The Energy Commission's own guidance explains the move from circular to directive in exactly these terms: the 2011 circular had been issued and taken effect, some parties had not complied, and the directive was issued so that legal action could be taken against those who breach it. That is a regulator saying, on the record, that the previous instrument was ignored. It is a reasonable indicator of how the current one is meant to be read.
Here the calculation genuinely decides
A mandate this firm invites an obvious assumption, which is that every building in scope now needs a lightning protection system. The Commission anticipated the question and answered it directly, and the answer is no.
Its guidance explains that the directive requires compliance with MS IEC 62305:2007, and that Part 2 of that standard requires a risk assessment to be carried out before an installation is made. The assessment determines whether the building is at high or low risk, and establishes the appropriate protection level, 1 to 4. A building assessed as low risk does not need to be equipped with a system. The Commission also expects the building owner to keep the risk assessment report available for inspection.
That is worth setting beside the neighbouring jurisdiction, because the two look similar from a distance and behave differently. In Singapore, building control fixes a minimum Class III system for compliance, so the assessment can raise the requirement but never remove it. In Malaysia the assessment is the thing that decides, in both directions. A defensible assessment can conclude that no installation is required, and that conclusion is the compliance position.
Which puts unusual weight on the report. When the assessment is the only evidence that a building lawfully has no lightning protection, and an inspector may ask to see it, its quality is not an internal engineering matter. Every input, every parameter and every figure has to be traceable to where it came from, because the report is being asked to justify an absence, which is always the harder thing to defend. For what that looks like in practice, read audit-ready risk reports.
Malaysia is two editions behind, and it is mandated
The directive lists the four parts by their full designations: MS IEC 62305-1:2007 General principles, MS IEC 62305-2:2007 Risk management, MS IEC 62305-3:2007 Physical damage to structures and life hazard, and MS IEC 62305-4:2007 Electrical and electronic systems within structures. The national foreword of Part 2 records that it is identical with IEC 62305-2:2006, and the IEC title page reproduced in the same document reads "First edition 2006-01".
So the standard Malaysia enforces is the first edition. The IEC has since published a second edition in 2010 and a third in 2024, each a technical revision rather than a reprint. Singapore, for comparison, adopted the 2010 text, and the United Kingdom is on the 2024 one. Malaysia's mandated text predates both.
The consequence is practical rather than rhetorical. A figure computed on IEC 62305-2:2024 is not a figure computed on the standard the directive names, and offering the newer result as evidence of compliance with the older mandate conflates two different models. It runs the other way too: an assessment on the 2006 text is not evidence about the current international standard. Whichever you run, the report should say so on its face. For what separates the editions, read what changed in IEC 62305:2024.
The tolerable value needs the same care. In the current international text, Clause 7.3 NOTE 1 gives RT = 1×10-5 per year as a representative value of tolerable risk and adds that another value may be set once the case has been investigated in detail. Printed p.12 then lets national or local regulations fix RT, the tolerable frequency of damage FT, and the Annex A, B, C and E calculation rules and parameter values. Those clause and page references belong to the 2024 edition and do not number the 2006 text MS IEC 62305-2 adopts, so do not cite them as if they did. The value an assessment is judged against is something to establish and record for the project, from the standard edition in force for it and from whatever the Commission, the client and the specification require.
What this means on a Malaysian project
Four consequences, in the order they usually matter on a real job.
Assess before you specify
Part 2 requires the assessment before the installation, and the assessment can conclude that none is needed. Specifying a system first and assessing afterwards inverts the directive's own sequence and wastes the one route to a smaller scope.
Keep the report retrievable
The Commission expects the owner to hold the risk assessment report for inspection. On an existing building with no system, that report is the entire compliance case, so it needs to be findable years later and readable by someone who was not there.
Name the edition
MS IEC 62305-2:2007 is identical to the 2006 first edition. A report that says only IEC 62305 leaves a reader unable to tell which of three editions produced the figures, and they are not interchangeable.
Check the category date
For an existing building, the obligation began on the date for its category: 2021, 2022 or 2023. If the category is not listed, the Commission sets the date from time to time, so an unlisted type is undated rather than exempt.
Where to go from here
The instructive comparison is next door. SS 555 in Singapore adopts a later edition, adds national deviations, and fixes a minimum class that the assessment cannot go below, which is the mirror image of Malaysia's arrangement. For the wider picture, read IEC 62305 around the world, and for a country that left the IEC method entirely, read CTE DB SUA 8 in Spain.
New to the standard? Start with what is IEC 62305, then the IEC 62305-2 risk assessment, which is the part the directive leans on. To see the arithmetic worked through, read how an IEC 62305 risk is calculated, and for what the protection levels 1 to 4 mean, read lightning protection levels.
An assessment an inspector can follow
Lumex computes the IEC 62305-2:2024 method, the current international edition, with every figure traceable to the clause, equation or table behind it, which is exactly the property a report needs when it has to justify its conclusion to somebody else later. Being straight about the boundary: it does not compute the 2006 first edition text that MS IEC 62305-2:2007 adopts, and it does not ship a Malaysia jurisdiction profile. Where a Malaysian job must be assessed on the edition the directive names, that is a different calculation and the report should say which one produced its figures. We would rather name that gap than let a country page imply a coverage that is not there. See the Lumex platform.
Questions answered
What is MS IEC 62305?
Is MS IEC 62305 identical to IEC 62305?
Is lightning protection mandatory in Malaysia?
Does every building in Malaysia need a lightning protection system?
When did the Malaysian lightning protection directive take effect?
What is the penalty for not complying in Malaysia?
Who does the Malaysian directive bind?
Which edition of IEC 62305 does Malaysia use?
Did the 2019 directive replace the earlier 2011 circular?
Lumex computes the IEC 62305-2 method and shows the working. It does not certify a structure. You may not issue or submit a Lumex output until a competent person, qualified where the structure is located, has reviewed the inputs and the result and signed it.
The tolerable risk in IEC 62305-2 is not a fixed constant. Clause 7.3 NOTE 1 gives RT = 1×10-5 per year as a representative value of tolerable risk and adds that another value may be set once the case has been investigated in detail. Printed p.12 then lets national or local regulations fix RT, the tolerable frequency of damage FT, and the Annex A, B, C and E calculation rules and parameter values. Every Lumex assessment states the jurisdiction it was computed under and the values that applied.