Article 15 of the MDR requires every medical device manufacturer to have at least one person responsible for regulatory compliance, the PRRC. It is one of the most structuring organisational innovations of the regulation for small organisations, and one of the most misunderstood. The confusion often starts with the name of the function itself, and continues on the question that really matters: who is allowed to outsource, and who must recruit.
Who is concerned, and under what arrangements
Every manufacturer falling within the scope of the MDR is subject to the obligation, whatever its size. But the regulation distinguishes two arrangements.
Manufacturers that exceed the micro or small enterprise thresholds must have the PRRC within their organisation (Article 15(1)). The MDCG 2019-7 Rev.1 guidance clarifies the meaning of this wording: the person must be an employee.
Micro and small enterprises within the meaning of Recommendation 2003/361/EC — that is, fewer than 50 people and annual turnover or a balance-sheet total not exceeding EUR 10 million — are not required to have the PRRC in-house. They must instead have such a person permanently and continuously at their disposal (Article 15(2)). It is this provision that opens the door to outsourcing.
The three-person micro-enterprise manufacturing class I devices is therefore indeed subject to Article 15. It simply does not have to recruit: it must secure permanent access to a qualified person, in-house or by contract.
The required qualifications
Article 15(1) defines two routes.
Route 1, diploma and experience: a diploma, certificate or other evidence of formal qualification awarded on completion of university studies in law, medicine, pharmacy, engineering or another relevant scientific discipline (or a course of study recognised as equivalent by the Member State), together with at least one year of professional experience in regulatory affairs or quality management systems relating to medical devices.
Route 2, experience only: four years of professional experience in regulatory affairs or quality management systems relating to medical devices. The MDCG 2019-7 Rev.1 guidance expects substantial and recent experience, not four old and peripheral years.
For manufacturers of custom-made devices only, and without prejudice to national provisions on professional qualifications: two years of experience in a relevant field of manufacturing is sufficient.
These conditions must be evidenced: diplomas, employment contract, job description, CV, dated employment certificates. The notified body may check them during the certification audit as well as in the annual surveillance.
The tasks of the PRRC, close to the text
Article 15(3) entrusts the PRRC with ensuring five things.
First, that the conformity of the devices is appropriately checked, in accordance with the quality management system under which they are manufactured, before the release of each device. The control point is release, and the reference framework is the QMS.
Second, that the technical documentation and the EU declaration of conformity are drawn up and kept up to date.
Third, that the post-market surveillance obligations of Article 10(10) are complied with.
Fourth, that the reporting obligations of Articles 87 to 91"", vigilance, are fulfilled.
Fifth, that for devices that are the subject of a clinical investigation, the statement referred to in Annex XV, Chapter II, Section 4.1 is issued.
EUDAMED registration, often cited in job descriptions, does not appear in this list. It is a manufacturer obligation that the PRRC may oversee in practice, but Article 15(3) does not assign it to them.
Several people may share the function within the same organisation, provided that their respective areas of responsibility are set out in writing.
The protective status of Article 15(5)
The regulation does not define a regime of personal liability for the PRRC: penalties are a matter of national law (Article 113). What the text does provide is protection. The PRRC must not suffer, within the manufacturer’s organisation, any disadvantage in relation to the proper fulfilment of their duties, whether or not they are an employee (Article 15(5)). The MDCG 2019-7 Rev.1 guidance cites dismissal and penalisation as examples of prohibited disadvantages. In other words: a PRRC who blocks a batch release or triggers a vigilance report cannot pay the price for it professionally. This is the condition of their real independence.
Outsourcing: for whom, and on what conditions
Outsourcing is open only to micro and small enterprises on the manufacturer side, and to authorised representatives. A manufacturer above the thresholds must employ its PRRC.
For eligible organisations, the service contract must guarantee the reality of the function: permanent and continuous availability, including in the event of a vigilance incident where the reporting deadlines are counted in days"", full access to the technical documentation and the QMS, and a written scope of responsibility. An outsourced PRRC reachable during business hours with partial access to the documentation fulfils the commercial contract, not Article 15. A back-up arrangement is worth planning to cover absences.
The authorised representative must also have a PRRC
Article 15(6) requires the European authorised representative to have permanently and continuously at its disposal its own PRRC, whatever its size. Their tasks follow the mandate signed with the manufacturer, within the limits of Article 11: the manufacturer’s own obligations listed in Article 11(4) are not transferable to the authorised representative, and therefore cannot fall to the latter’s PRRC. A non-EU manufacturer thus has two PRRCs in its regulatory landscape: its own, and the PRRC of the European authorised representative"". Two functions, two scopes, two people.
The point of attention on combining PRRC / EC REP
The MDCG 2019-07 Rev.1 guidance (December 2023) specifies that an authorised representative cannot simultaneously perform the PRRC function for the same manufacturer. This combination creates a conflict of interest that is incompatible with the independent exercise of each role: the manufacturer’s PRRC is one of the controls the authorised representative must be able to look at without looking at itself. A non-EU manufacturer that has organised its regulatory arrangements in this way is in a configuration that is non-compliant with regard to MDCG 2019-07 (within the framework of the interpretation of Article 15 MDR). The MDCG 2022-16 guidance completes this reading of the separation of roles.
What it implies for a small organisation
The most frequent scenario when someone comes to audit your ISO 13485 QMS"" is not the absence of a PRRC. It is the paper PRRC: a director or a production manager designated on the org chart, without the qualification of Article 15(1), without dedicated time, and discovered at the first vigilance deviation. The function exists in the QMS, not in reality.
For an organisation below the thresholds, the question to settle is simple and arises once: who, by name, meets the qualification conditions, has permanent access to the documentation, and can be reached on the day a 10-day report is triggered. If there is no in-house answer, structuring your regulatory function"" can go through outsourcing, which the regulation provides precisely for this case. If the answer exists neither in-house nor by contract, the gap is already there, waiting only to be recorded.
Regulatory sources: Article 15 of Regulation (EU) 2017/745 — EUR-Lex. MDCG 2019-07 Rev.1 and MDCG 2022-16, health.ec.europa.eu.