Since the publication of MDCG 2019-07 Rev.1, many medical device manufacturers have been asking the same question: can the roles of EU authorised representative (EC REP) and Person Responsible for Regulatory Compliance (PRRC) be entrusted to the same company?
The answer deserves some explanation. Regulation (EU) 2017/745 (MDR) contains no explicit prohibition, but the MDCG 2019-07 Rev.1 guidance sets two precise rules: the non-EU manufacturer’s PRRC and its authorised representative’s PRRC cannot be the same person, even within the same group; for a micro or small enterprise, the two PRRCs shall not belong to the same external organisation. The guidance justifies these rules by the intention that the authorised representative provide an additional level of control and ensure that the supervision and control of device manufacturing, as well as post-market surveillance and vigilance activities, are carried out adequately.
ISOFAC GROUP has a PRRC dedicated to its EU authorised representative activity for medical devices.
Two functions, two different objectives
Before turning to the MDCG’s position, it is essential to understand that the authorised representative and the PRRC do not have the same role.
The EU authorised representative (EC REP). The authorised representative, appointed in accordance with Article 11 of the MDR, represents a manufacturer established outside the European Union before the competent authorities.
Its main tasks consist in particular of:
- verifying that certain regulatory documents exist before the device is placed on the market;
- keeping the documentation provided for by the MDR;
- cooperating with the competent authorities;
- forwarding requests for information to the manufacturer;
- taking part in vigilance actions where necessary.
The authorised representative therefore acts as an independent economic operator with regulatory obligations of its own.
The person responsible for regulatory compliance. The PRRC is provided for in Article 15 of the MDR and is responsible at least for ensuring that:
- the conformity of the devices is checked, in accordance with the quality management system, before a device is released;
- the technical documentation and the EU declaration of conformity are drawn up and kept up to date;
- the post-market surveillance obligations are complied with (Article 10(10));
- the reporting obligations of Articles 87 to 91 (vigilance) are fulfilled;
- for investigational devices, the statement referred to in Section 4.1 of Chapter II of Annex XV is issued.
The PRRC acts on behalf of an economic operator, manufacturer or authorised representative, and takes part directly in its quality system. Its objective is to ensure that the economic operator meets all the MDR requirements applicable to it.
Why is combining the roles a problem?
At first glance, entrusting both functions to the same provider may seem logical. The manufacturer has a single point of contact and management appears simpler.
But this arrangement creates an independence problem.
The “four pairs of eyes” principle
The logic of the MDR can be summed up by a simple idea: several independent actors must take a critical look at the medical device’s compliance before and during its placing on the market.
Each economic operator therefore has responsibilities of its own and must not simply trust the other actors in the chain.
- The manufacturer is responsible for demonstrating that its device complies with the MDR requirements.
- The authorised representative (EC REP) verifies that the manufacturer has drawn up the regulatory elements required by the MDR, before accepting its mandate and throughout it.
- The importer performs the checks incumbent on it before the device is placed on the market, notably on the CE marking, the labelling, the UDI, the EU declaration of conformity and the appointment of an authorised representative where required.
- The distributor verifies, as part of its own obligations, that the applicable requirements are met before making the device available on the market.
Each party thus brings an independent viewpoint on one aspect of compliance. This succession of checks constitutes a genuine regulatory safety system, intended to limit the risk that non-compliant medical devices are placed on the European market.
It is precisely to preserve this independence that the guidance rules out the manufacturer’s PRRC and the authorised representative’s PRRC being the same person and, for a micro or small enterprise, belonging to the same external organisation. If a single organisation both brings the manufacturer into compliance and checks that compliance, this principle of an independent viewpoint disappears.
What MDCG 2019-07 states
The guidance points out that the authorised representative must provide an additional level of control over the non-EU manufacturer’s activities, and draws two rules from this: the non-EU manufacturer’s PRRC and its authorised representative’s PRRC cannot be the same person, even within a large group; for a micro or small enterprise, the two PRRCs shall not belong to the same external organisation.
The practical consequence is clear: it is inadvisable for one company to provide both the manufacturer’s PRRC and the EC REP mandate, and, for a micro or small enterprise that outsources its PRRC, the guidance rules it out.
This position does not rest on an explicit prohibition in the MDR, but on its official interpretation by the European Commission through the guidance.
What are the risks for a manufacturer?
Entrusting both tasks to a single company can lead to several difficulties.
For example:
- findings during a notified body audit;
- questions from competent authorities;
- a challenge to the independence of the regulatory functions;
- a weakening of the manufacturer’s quality organisation.
Even though each situation must be assessed case by case, it is generally preferable to separate the responsibilities clearly.
Which set-up is recommended?
Two configurations are currently regarded as the most robust.
Option 1: an in-house PRRC. The manufacturer appoints a qualified employee as PRRC and the EU authorised representative remains an independent external provider. This arrangement is often favoured by manufacturers that already have a regulatory team.
Option 2: two different providers (the small-company case). The manufacturer outsources:
- the PRRC function to a consultant or a specialised company;
- the EC REP mandate to a separate authorised representative.
This separation guarantees the independence expected by the MDCG, and therefore by the European Commission.
In summary
The MDR does not explicitly prohibit one and the same company from performing the PRRC and EU authorised representative functions.
MDCG 2019-07 Rev.1, however, rules out the non-EU manufacturer’s PRRC and its authorised representative’s PRRC being the same person and, for micro and small enterprises, belonging to the same external organisation, because this configuration would remove the additional level of control expected from the authorised representative.
For non-EU manufacturers, the most robust solution is to distinguish the two roles clearly, by appointing an authorised representative that is independent of the person responsible for regulatory compliance.
Need an independent EU authorised representative?
ISOFAC supports medical device manufacturers established outside the European Union with their EC REP authorised representative obligations, in accordance with Regulation (EU) 2017/745.
Our teams act exclusively in the authorised representative role and take care to preserve the independence of that function, in line with the expectations of the European authorities.