Your notified body audit is booked, the technical documentation is close to final, and the auditor asks to see evidence that your person responsible for regulatory compliance is qualified. The CV on file shows a strong engineer with two years in R&D and no regulatory or quality system experience. That conversation rarely ends well.
Article 15 of the MDR (Regulation (EU) 2017/745) and Article 15 of the IVDR (Regulation (EU) 2017/746) make the PRRC a legal requirement, not an organisational nicety. This guide sets out who qualifies, when a micro or small enterprise may use an external PRRC, what the PRRC must ensure, how MDCG 2019-7 rev.1 interprets the rules, and why the authorised representative’s PRRC is a separate person.
What Article 15 requires of the person responsible for regulatory compliance
Article 15(1) MDR requires manufacturers to have available within their organisation at least one person responsible for regulatory compliance who possesses the requisite expertise in the field of medical devices. Article 15(1) IVDR is worded the same way, with the expertise in the field of in vitro diagnostic medical devices.
The obligation sits with each legal manufacturer. MDCG 2019-7 rev.1 notes that a group with several legal manufacturers under one parent must ensure each of them has its own PRRC. It also applies to an importer, distributor or other person who assumes a manufacturer’s obligations under Article 16(1), and to a person who takes on the manufacturer’s role for systems and procedure packs under Article 22(4) MDR.
PRRC qualifications: the two routes
Article 15(1) allows the expertise to be demonstrated in either of two ways:
- Route (a): a diploma, certificate or other evidence of formal qualification, awarded on completion of a university degree or a course of study recognised as equivalent by the Member State concerned, in law, medicine, pharmacy, engineering or another relevant scientific discipline, plus at least one year of professional experience in regulatory affairs or in quality management systems relating to medical devices (or IVDs).
- Route (b): four years of professional experience in regulatory affairs or in quality management systems relating to medical devices (or IVDs).
The MDR adds a third option for custom-made devices only: without prejudice to national rules on professional qualifications, a manufacturer of custom-made devices may demonstrate the expertise through at least two years of professional experience within a relevant field of manufacturing. The IVDR has no equivalent provision.
MDCG 2019-7 rev.1 adds useful detail on evidence:
- The manufacturer should keep proof of the qualification, such as a CV and copies of certificates, and competent authorities may ask for it during inspections.
- For qualifications obtained outside the EU, recognition as equivalent by one Member State, based on documentation the manufacturer provides, is sufficient.
- Purely administrative handling of documents, or shadowing regulatory staff, does not count as regulatory affairs experience.
The micro and small enterprise exception
Under Article 15(2) MDR and IVDR, micro and small enterprises within the meaning of Commission Recommendation 2003/361/EC are not required to have the PRRC within their organisation, but shall have such a person “permanently and continuously at their disposal”.
The Recommendation’s thresholds are in Article 2 of its Annex:
- Small enterprise: fewer than 50 persons, and annual turnover and/or annual balance sheet total not exceeding EUR 10 million.
- Microenterprise: fewer than 10 persons, and annual turnover and/or annual balance sheet total not exceeding EUR 2 million.
Under Article 6 of the same Annex, data from partner and linked enterprises are added in when assessing size, so a start-up owned by a larger group may not qualify.
MDCG 2019-7 rev.1 accepts that the PRRC may then be provided by an external organisation under a contract that guarantees continuous availability and states the person’s qualifications. The PRRC must be able to perform operational duties and react in a timely manner, which the guidance says does not necessarily mean 24-hour availability.
PRRC duties under Article 15(3)
Article 15(3) sets the minimum the PRRC shall be responsible for ensuring:
- the conformity of the devices is appropriately checked, in accordance with the quality management system, before a device is released;
- the technical documentation and the EU declaration of conformity are drawn up and kept up to date;
- post-market surveillance obligations are complied with — Article 10(10) MDR, Article 10(9) IVDR;
- the reporting obligations are fulfilled — Articles 87 to 91 MDR, Articles 82 to 86 IVDR;
- for investigational devices, the statement in Section 4.1 of Chapter II of Annex XV MDR is issued; under the IVDR, the statement in Section 4.1 of Annex XIV for devices used in interventional clinical performance studies or other performance studies involving risks for the subjects.
“Ensure” is the operative word. MDCG 2019-7 rev.1 describes the PRRC checking that devices for release have followed procedures, using methods such as auditing or sampling, and states that demonstrating conformity remains the manufacturer’s responsibility. Where several persons share the role, Article 15(4) requires their respective areas of responsibility to be stipulated in writing. Article 15(5) protects the PRRC: they shall suffer no disadvantage within the organisation for the proper fulfilment of their duties, whether or not they are an employee.
How MDCG 2019-7 rev.1 reads “within their organisation”
MDCG 2019-7 was first published in June 2019 and revised in December 2023. Rev.1 restructured the guidance around the paragraphs of Article 15, added IVD references and new sections on custom-made devices, EUDAMED registration and the no-disadvantage protection. Its main interpretations:
- Employment. For manufacturers that are not micro or small enterprises, the guidance says the PRRC would need to be an employee of the organisation.
- Location. It must be assumed that the PRRC of an EU manufacturer is in the Union and that the PRRC of a non-EU manufacturer is outside it; a footnote recommends physical and geographical proximity to manufacturing activities.
- EUDAMED. Manufacturers and authorised representatives register the PRRC’s name, address and contact details during actor registration and should update changes within one week.
Manufacturer PRRC versus the authorised representative’s PRRC
Article 15(6) requires authorised representatives to have permanently and continuously at their disposal at least one PRRC with expertise in the regulatory requirements for medical devices (or IVDs) in the Union, qualified by the same two routes. Because the “at their disposal” wording applies to every authorised representative, its PRRC need not be an employee; the custom-made route in Article 15(1) does not extend to it.
MDCG 2019-7 rev.1 draws three distinctions:
- The authorised representative’s PRRC ensures that the tasks in the representative’s mandate are fulfilled; the manufacturer’s PRRC covers the Article 15(3) duties above.
- The authorised representative’s PRRC should be located in the Union, whereas a non-EU manufacturer’s own PRRC is expected to be outside it.
- The PRRC of the authorised representative and the PRRC of a non-EU manufacturer cannot be the same person, even within the same large organisation. For a micro or small manufacturer, its external PRRC and the authorised representative’s PRRC cannot belong to the same external organisation.
Where this goes wrong
- Assuming the authorised representative’s PRRC covers the manufacturer. It does not. A non-EU manufacturer needs its own PRRC under Article 15(1) or 15(2), in addition to the one under Article 15(6).
- Counting the wrong experience. Years in R&D, production or sales do not meet route (b). The experience has to be in regulatory affairs or quality management systems for medical devices or IVDs, and MDCG 2019-7 expects it to be substantive.
- Claiming the micro/small exception without checking group data. Partner and linked enterprises count under Recommendation 2003/361/EC.
- A contract that does not guarantee availability. An external PRRC agreement that is vague about response times or qualifications fails the “permanently and continuously” test.
- A PRRC with no authority. If the PRRC cannot stop a release or see vigilance data, the Article 15(3) duties exist only on paper. Write the role, its access and its independence into the quality manual.
- Stale EUDAMED data. A new PRRC not updated in EUDAMED within a week is an easy audit finding.
Frequently asked questions
What qualifications does a PRRC need under the MDR?
Under Article 15(1), either a university degree or recognised equivalent course in law, medicine, pharmacy, engineering or another relevant scientific discipline plus at least one year of experience in regulatory affairs or quality management systems for medical devices, or four years of such experience. For custom-made devices only, two years in a relevant manufacturing field may be enough.
Can the PRRC be outsourced?
Only micro and small enterprises, as defined in Commission Recommendation 2003/361/EC, may use a PRRC outside their organisation, who must be permanently and continuously at their disposal. MDCG 2019-7 rev.1 accepts a contract with an external organisation that guarantees availability and states the person’s qualifications. Larger manufacturers need the PRRC within their organisation.
Can our authorised representative’s PRRC also be our PRRC?
No. MDCG 2019-7 rev.1 states that the PRRC of the authorised representative and the PRRC of a manufacturer outside the EU cannot be the same person, even within one large organisation. The aim is an additional layer of scrutiny. Each role also has different duties under Article 15(3) and Article 15(6).
Does the PRRC have to be based in the EU?
For the manufacturer, MDCG 2019-7 rev.1 assumes the PRRC of an EU manufacturer is in the Union and the PRRC of a non-EU manufacturer is outside it, ideally close to manufacturing. The authorised representative’s PRRC is expected to be located in the Union.
Is the PRRC personally liable for non-compliance?
Neither Article 15 nor MDCG 2019-7 rev.1 addresses personal liability; the guidance states that demonstrating conformity remains the manufacturer’s responsibility. Article 15(5) protects the PRRC from disadvantage for properly performing their duties. Questions of individual liability depend on national law and need legal advice.
Choosing and documenting the right PRRC arrangement is quick to get right at the start and slow to fix after an audit finding. Medfins has supported 100+ clients across 175+ regulatory projects, including setting up Article 15 roles and the quality system procedures behind them. See our CE marking services under EU MDR and IVDR, or talk to our regulatory team. Related reading: technical documentation under Annex II and III, EUDAMED registration requirements and PMCF plan and evaluation report.
