A practical guide to Malaysian heavy-metal limits under the Food Act 1983, why ICP-MS testing is the defensible standard, and why raw material suppliers need independent validation.
Most contamination problems in food raw materials do not start on the factory floor. They start upstream, in the soil a crop grew in, the water used to irrigate it, or the equipment used to dry, grind, and store it before it ever reaches a manufacturer. Heavy metals such as lead, arsenic, cadmium, and mercury can enter raw materials via contaminated soil and irrigation water, or through processing equipment and food-contact packaging. Industrial emissions and vehicle exhaust can raise metal concentrations in agricultural soils near mining or manufacturing zones, while crops such as rice, cocoa, leafy greens, and root vegetables are known to absorb these metals through their root systems.
None of this is visible on inspection. A batch of turmeric, cocoa powder, or dried herbs can look, smell, and taste normal while harboring contamination levels that only become apparent under laboratory analysis. That gap between appearance and actual composition is where recalls, regulatory action, and reputational damage originate.
A raw material can look completely normal while hiding contamination that only shows up under laboratory analysis.
This piece works through three things a QA or compliance team needs to get right: what Malaysian law actually requires, why ICP-MS testing produces results that hold up under scrutiny, and why raw material suppliers, not just finished products, need independent verification.
The legal basis: Food Act 1983 and Food Regulations 1985
Malaysia's food-safety framework runs on two documents. The Food Act 1983 (Act 281) is the parent statute, giving the Minister of Health authority to regulate contaminants and toxic substances in food sold in Malaysia. The operational details are set out in the Food Regulations 1985 (P.U.(A) 437/85), administered by the Ministry of Health's Food Safety and Quality Division.
Metal contaminants fall under Part VII of the regulations, titled "Incidental Constituent." Regulation 37 defines a metal contaminant as a type of incidental constituent, and Regulation 38 prohibits importing, preparing, advertising, or selling any specified food that contains a metal contaminant above its applicable maximum permitted proportion. The Fourteenth Schedule, specifically Table I, sets out those permitted proportions across the parameters most relevant to F&B raw materials: arsenic, lead, mercury, cadmium, and antimony.
What matters for QA teams is that these limits are not one flat number applied across the board. The Fourteenth Schedule sets maximum permitted proportions by food category, so a limit that applies to cocoa powder will not necessarily match the limit for a spice blend or an infant formula ingredient. Matching your raw material to the correct category in the current schedule is part of the compliance exercise, not a side detail.
We're deliberately not reproducing specific mg/kg figures here. Reproductions of the schedule circulating online, including older PDFs, do not always reflect the current consolidated version, and citing an outdated number is arguably worse than citing none. For the current maximum permitted proportions by food category, check the Ministry of Health's schedule updates directly or refer to our breakdown in the KKM Food Regulations 1985 Compliance Guide for F&B Manufacturers. We've also covered category-specific nuances, including tighter thresholds for sensitive products, in Managing Closer-to-Zero Lead and Arsenic Thresholds in Baby Food and in our piece on elemental impurity limits and compliance.
Knowing the legal structure is only half the problem. The other half is generating a result that is accurate and defensible enough to prove where your raw material stands against it.
Why ICP-MS is the reference method for trace metal detection
Inductively coupled plasma mass spectrometry (ICP-MS) is an analytical technique that identifies and quantifies elements by ionizing a sample and then sorting the ions by mass. A liquid sample is nebulized into a fine aerosol, carried into an argon plasma heated to several thousand degrees, where it is vaporized, atomized, and ionized into predominantly singly charged ions. Those ions pass through a sampler and skimmer cone interface into the mass spectrometer's vacuum region, get separated according to their mass-to-charge ratio, and hit a detector that counts them, typically as ion counts per second at each mass value.
Every ICP-MS result traces back through a fixed sequence of physical stages, which is precisely what auditors want to see documented, not just the final number.
That process is what gives ICP-MS its edge over older techniques such as atomic absorption spectroscopy (AAS). It can measure multiple elements in a single run rather than one at a time, and it distinguishes between isotopes of the same element. Detection limits typically fall in the parts-per-billion to parts-per-trillion range, depending on the element and the sample matrix, and the method's detection limits are generally lower than those achieved by AAS configurations, though the gap varies by analyte. For a spice blend or infant formula ingredient where the legal limit sits at a low fraction of a milligram per kilogram, that sensitivity is the difference between confidently clearing a batch and guessing.
Sensitivity alone doesn't make a result defensible. Quantification depends on calibrating against known standards and using internal standards to correct for matrix effects and instrument drift, and a lab has to document that workflow the same way every time a sample comes through. This is where ISO/IEC 17025 becomes relevant. The standard sets out the general requirements for the competence of testing and calibration laboratories, covering everything from method validation to equipment calibration to how results get reported. It exists so a lab can demonstrate, not just claim, that its results are valid.
When a regulator or auditor questions a heavy-metal result, the first question is rarely about the number itself. It's about how the number was generated: what method was used, whether the lab is accredited for that specific test, and whether the process can be reconstructed and defended on paper. That's the gap ISO 17025 closes, and it's worth understanding in more detail why ISO 17025 matters for legally defensible evidence and why the accreditation is a requirement for F&B export compliance.
Where contamination actually starts
By the time a finished product is tested, the heavy metal is already there. It got in earlier, usually at the raw material stage, through contaminated soil, irrigation water, atmospheric deposition, or metal-containing fertilizers and pesticides absorbed by crops before they ever reached a processing line. Cocoa is a well-documented case: cadmium and lead levels vary by growing region and cocoa-solids content, and lead concentrations generally increase as beans are processed into cocoa powder rather than remaining flat. Testing only the finished product tells you whether that particular batch failed. It doesn't tell you why or whether the next shipment from the same supplier will fail too.
This is why supply-chain analysts increasingly frame heavy metal control as a sourcing problem rather than a finished-goods problem, arguing for traceability back to specific lots and growing origins instead of relying on end-of-line checks. The practical version of that looks like prequalifying suppliers based on elemental profiles, tracking crop origin, running random third-party tests on incoming lots, and verifying that supplier certificates of analysis match independent results.
Contamination risk often starts at the soil and the supplier, long before a product ever reaches the factory floor.
The gap between assuming a supplier's paperwork is accurate and having independent evidence that it is tends to surface later, as customer complaints, returns, or a recall. Recent recall cases involving metal contamination traced to supplier materials, including a 2025 shredded cheese recall and a 2017 Greencore sandwich recall, show that manufacturers often discover the upstream source only after products have already reached distribution.
For raw materials in food, beverage, feed, and fertilizer supply chains, independent verification through services such as heavy metal and elemental analysis is one way to close that gap before it becomes a distribution-stage problem.
Putting the three pieces together
The legal limits under the Food Act 1983 and Food Regulations 1985 set the compliance bar. ICP-MS testing is the method capable of measuring against that bar with the precision and traceability that regulators and auditors expect. Supplier validation is where those two pieces are actually applied, before a contaminated lot reaches your production line, rather than after it shows up as a finished-goods failure or a recall.
None of the three works well on its own. A legal limit without accurate testing is unenforceable. Accurate testing without supplier-level checks catches problems too late to prevent them cheaply. The practical sequence is: know the limit, test with a method sensitive and defensible enough to be trusted, and apply that testing upstream, at the raw-material stage, not just at release.
For QA and procurement teams building or auditing a supplier validation program, working with a laboratory holding ISO/IEC 17025 accreditation matters because it means the lab's methods, equipment calibration, and reporting have been independently assessed against a recognized competence standard, giving the results legal and regulatory standing rather than just a number on a certificate.
Three checks, one conclusion: legal limits, validated method, and verified supplier all confirmed before a raw material lot moves forward.