For a manufacturer established outside the European Union, appointing an authorised representative, or EC REP, is not an administrative formality. Article 11 of Regulation (EU) 2017/745 makes it a full economic operator, subject to obligations of its own and, in certain situations, to joint and several liability with the manufacturer.
Comparing prices alone therefore means comparing services that do not necessarily cover the same level of control, availability or risk.
ISOFAC GROUP offers an EU authorised representative service for non-EU medical device manufacturers, including a prior documentation audit and ongoing regulatory monitoring.
An authorised representative is not just an address on the label
The name and address of the authorised representative appear on the device labelling. That visibility sometimes leads people to reduce its function to a European registered address.
Its role goes much further. The authorised representative must in particular verify that the EU declaration of conformity and the technical documentation have been drawn up, keep the required documents available to the authorities, fulfil its registration obligations, forward requests from authorities to the manufacturer and cooperate on preventive or corrective actions.
The mandate must be written and cover at least the tasks listed in the regulation. However, certain fundamental obligations of the manufacturer cannot be delegated to it. The manufacturer remains responsible in particular for design, technical documentation, the quality system, clinical evaluation and post-market surveillance.
The seven criteria to examine
1. A European establishment and verifiable operational resources. The candidate must be a natural or legal person genuinely established in the Union, with a verifiable registration, notably in EUDAMED where this is required.
A legal address and an SRN are not enough to demonstrate operational capability. The manufacturer must also examine:
- who the people handling the files are;
- the regulatory competences available;
- how absences and replacements are organised;
- the languages in which authorities can be handled;
- the escalation arrangements for an urgent request;
- the ability to face an announced or unannounced inspection.
The useful question is therefore not only “Where are you established?” but “Who handles a request from an authority when the usual contact is unavailable?”
2. Competence matched to the device portfolio. The regulatory obligations of the authorised representative are set by Article 11, whatever the device class. Implementing them nonetheless becomes more complex with the risk level, the technology, the number of references and the conformity assessment procedure.
A portfolio of class I devices does not create the same operational workload as one comprising implants, class IIb or III devices, complex medical software, or class C or D IVDs under the IVDR.
The manufacturer can ask for objective evidence on:
- the device categories already handled;
- experience of exchanges with authorities and notified bodies;
- command of vigilance and FSCA processes;
- in-house competences relating to the IVDR, where IVDs are involved;
- any exclusions applied by the provider.
Client references can help, subject to confidentiality obligations.
3. Permanent access to the required documentation. MDCG 2022-16 guidance states that the manufacturer must provide the authorised representative with up-to-date versions of the required documents, and that permanent access implies constant availability, through electronic or physical storage.
The authorised representative should therefore not depend on an improvised transfer when an authority requests the file. It must already hold, according to the applicable scope, the EU declaration of conformity, the technical documentation and the relevant certificates, including their amendments.
Before signing, it is worth checking:
- where the documents will be kept;
- how versions will be updated;
- which formats and languages are accepted;
- how access is secured;
- who checks that the file received is complete;
- what happens if the manufacturer fails to send an update.
A document portal is only worth something if the update and control responsibilities are clearly defined.
4. Realistic arrangements for vigilance and emergencies. The often-quoted two-day deadline deserves to be properly understood. Article 87 of the MDR requires the manufacturer to report immediately, and no later than two days after becoming aware of it, an incident constituting a serious public health threat.
That deadline is not a general obligation on the authorised representative to answer any authority within forty-eight hours. It nonetheless shows why the information chain between manufacturer, authorised representative, importers and distributors must be extremely short.
The contract and associated procedures should specify:
- the emergency contact details;
- the escalation criteria;
- the responsibilities for qualification and reporting;
- how complaints and incidents are transmitted;
- the rules applicable outside business days;
- the handling of requests for samples or access to the device;
- the coordination of FSCAs and safety communications.
Rather than testing the provider with a commercial email sent late in the day, it is more relevant to ask for a documented exercise: “Describe, step by step, how you would handle an alert received on a Friday evening that may fall under Article 87.”
5. A compliant PRRC arrangement. Article 15 requires the authorised representative to have permanently and continuously at its disposal at least one person responsible for regulatory compliance, or PRRC.
MDCG 2019-07 states that the PRRC of the authorised representative and that of the non-EU manufacturer cannot be the same person. This separation preserves the additional level of control expected from the authorised representative.
For a micro or small enterprise that outsources its PRRC, the guidance goes further: its PRRC and that of the authorised representative must not belong to the same external organisation.
You should therefore ask for:
- the identity and qualifications of the authorised representative’s PRRC;
- their contractual link with it;
- their availability arrangements;
- the person designated as the manufacturer’s PRRC;
- whether any link exists between the two individuals or organisations.
A bundled “authorised representative + manufacturer’s PRRC” offer should be examined with caution and in the light of the exact configuration of the parties.
6. A robust mandate and an anticipated transition. The mandate must reflect the minimum tasks set out in Article 11, but it must also organise the day-to-day relationship.
A careful review should cover:
- the generic device groups covered;
- the respective responsibilities;
- the communication deadlines;
- the arrangements for access to documentation;
- the obligations in the event of non-compliance;
- any audit rights;
- the costs linked to incidents, inspections or exceptional requests;
- termination and cooperation with the incoming authorised representative.
Article 12 provides that a change of authorised representative be framed by an agreement between the manufacturer, the incoming representative and, where possible, the outgoing one. The dates, the transfer of documents and the handling of complaints must be defined.
A poorly drafted exit clause can delay the change of representative, the update of labelling and the continuity of operations on the European market.
7. Credible liability and business continuity. Where the manufacturer has failed to comply with its obligations under Article 10, the authorised representative may be held liable for defective devices on the same basis as, and jointly and severally with, the manufacturer. This exposure explains why a serious authorised representative asks to review certain documents before accepting a mandate. Immediate acceptance, with no verification of the manufacturer or its devices, is not necessarily an advantage.
The manufacturer should also examine:
- the authorised representative’s insurance cover;
- its financial stability;
- its business continuity plan;
- how documents are backed up;
- how a prolonged unavailability would be managed;
- the conditions for handing over files if it ceases trading.
The annual price must be weighed against this real scope. A low-cost offer can be coherent for a simple, limited portfolio. It becomes worrying if it claims to cover, at no extra charge, dozens of references, extended availability, vigilance, inspections and in-depth regulatory monitoring.
The questions to ask before signing
A structured selection can start with eight questions:
- What is your SRN and which competent authority oversees your registration?
- Who will be responsible for our portfolio and who will cover for them?
- How do you guarantee permanent access to the up-to-date versions of our documentation?
- What is your procedure when a serious public health threat is suspected?
- Who is your PRRC and how do you verify their availability?
- How do you ensure that our PRRC remains separate from yours?
- Which services are included in the price and which are billed separately?
- How do you organise termination and transfer to a new authorised representative?
The answers should be capable of being supported by procedures, contractual clauses or records, and not only by commercial undertakings.
Key takeaways
The right authorised representative is not necessarily the most expensive. It is the one whose resources are proportionate to the manufacturer’s portfolio and whose organisation holds up under a request from an authority, a vigilance emergency, an inspection or a change of provider.
Price remains a legitimate criterion, but it should be assessed after competence, documentary access, responsiveness, the PRRC arrangement, the quality of the mandate and business continuity.
The authorised representative replaces neither the manufacturer’s quality system nor its regulatory function. It constitutes an additional level of representation and control within the Union. That is precisely why choosing one deserves genuine qualification.