The MDCG 2019-07 guidance on the Person Responsible for Regulatory Compliance (PRRC) was revised in December 2023, four and a half years after its initial publication in June 2019. This Rev.1 is not a simple cosmetic update. It clarifies several points that had given rise to diverging interpretations between Member States and between notified bodies, and it incorporates entirely new sections absent from the original version.
The context: four years of field feedback
The initial MDCG 2019-07 had been published before the MDR became applicable (26 May 2021). Four years of implementation surfaced unstable areas of interpretation: combining functions, the nature of the professional experience required, and the status of persons who assume the manufacturer’s obligations without being a manufacturer in the legal sense. Rev.1 settles these questions and introduces three entirely new sections (protection of the PRRC, entities treated as manufacturers, registration in EUDAMED).
The document has been reorganised to follow the order of Article 15 MDR/IVDR, which makes it easier to read alongside the regulation.
Combining PRRC / EC REP authorised representative roles explicitly ruled out
This is the most anticipated clarification of the revision, and the one that reconfigures the largest number of regulatory organisations in place since 2021.
What Rev.1 says precisely
The revised guidance specifies that the PRRC of the non-EU manufacturer and the PRRC of its European authorised representative cannot be the same person, even when the non-EU manufacturer and its authorised representative belong to the same large group. For micro and small non-EU manufacturers, the constraint is stronger still: the two PRRCs cannot belong to the same external organisation.
The exact wording, often misreported, deserves to be kept as written. It is not “the same entity” that is prohibited in the general case, but “the same person”. The nuance has operational consequences: a consultancy may, in theory, hold both roles for a medium-sized non-EU manufacturer, provided these are two distinct staff members. For a micro or small client company, two different organisations are required.
The MDCG’s reasoning
The justification comes down to one sentence in the document: the role of the authorised representative is to bring “an additional level of scrutiny” to the activities of the non-EU manufacturer, in particular over post-market surveillance and vigilance. If the same individual holds both functions, this additional level of oversight disappears.
This is not a theoretical position. Notified bodies are progressively integrating this clarification into their audit checklists. The point will be verified during the next MDR surveillance audits.
The legally correct wording to remember
A confusion circulates in professional documentation and on several consultancy websites: the wording “non-compliance with Article 15(6) MDR” to designate a combined PRRC / EC REP arrangement. This wording is legally inaccurate. Article 15(6) MDR sets the qualification requirements for the authorised representative’s PRRC; it does not prohibit a combined arrangement.
The prohibition on combining the roles comes from MDCG 2019-07 Rev.1 itself, which interprets the interplay between Article 15 and Article 11(3) MDR. The correct wording to include in an audit report or a CAPA is: “at-risk configuration in the light of MDCG 2019-07 (interpretation of Article 15 MDR)”. A finding drafted with the wrong wording is open to challenge.
PRRC qualifications clarified
Article 15(1) MDR sets two routes into the function: a university degree in a relevant discipline together with one year of experience in regulatory affairs or QMS related to medical devices, or four years of direct experience. Rev.1 removes several ambiguities.
Professional experience: substantive and recent
This is the main contribution on this point. Rev.1 specifies that the required professional experience must be “substantive and recent”, so as to enable the designated person to effectively carry out the PRRC’s tasks. A footnote (footnote 5) adds that “experience limited to the administrative management of documents or to observing regulatory affairs professionals is not considered sufficient”.
Direct consequence: the CVs presented in the technical documentation must demonstrate effective practice, not a formal presence. A “regulatory assistant” role that consisted of filing dossiers does not count towards the required seniority.
Degrees obtained outside the EU
Rev.1 clarifies that a degree obtained outside the EU may be accepted as soon as a single Member State recognises it as equivalent to its corresponding national qualification, on the basis of the documentation provided by the manufacturer. This may be, for example, the Member State where the manufacturer or its authorised representative is established.
Custom-made devices
An entirely new section, absent from the initial version. For manufacturers of custom-made devices, the PRRC qualification requirement may be satisfied by two years of professional experience in a relevant field of manufacturing, including technological, without a formal degree requirement. This experience must cover the regulatory or QMS aspects and be adapted to the device class, in particular for implantable devices.
Three less-discussed but structuring additions
Beyond the combining of roles, three new sections deserve a careful read.
Protection of the PRRC against internal pressure (Article 15(5))
Rev.1 adds an explicit section on Article 15(5) MDR, which provides that the PRRC “shall suffer no disadvantage” within the manufacturer’s organisation in connection with the exercise of their duties. The guidance specifies what this covers: no dismissal, no disciplinary sanction for having performed their tasks in accordance with their obligations, regardless of employee or external status.
A sensitive point for SMEs where the PRRC also holds the role of quality manager, operations director or founder. The job description and the organisation chart must document this protection visibly.
Extension to importers and distributors assuming the manufacturer’s obligations
Article 16(1) MDR provides that under certain conditions (substantial modification of a device, affixing a new trade name, etc.), an importer or distributor assumes the manufacturer’s obligations. Rev.1 confirms that in this case, the obligation to designate a PRRC under Article 15 also applies to these operators.
The same logic applies to persons who assume the role of manufacturer within the meaning of Article 17 MDR (reprocessing of single-use devices) or Article 22(4) MDR (systems and procedure packs). A distributor that adapts a device and places it back on the market under its own name must designate a PRRC, with all the associated qualification requirements.
Registration of the PRRC in EUDAMED
A section also absent from the initial version. Manufacturers and authorised representatives must register the PRRC’s details in EUDAMED (name, address, contact details), under Section 1 Part A of Annex VI MDR. Any change (change of contact details, termination of the contract, designation of a new PRRC) must be updated in EUDAMED within one week, in accordance with Article 31(4) MDR.
The deadline is short. It means building the EUDAMED update into the manufacturer’s HR and contractual procedures, in the same way as a statutory declaration or a change of articles.
What Rev.1 changes in practical terms for your organisation
Three typical situations call for immediate action.
Non-EU manufacturer that has entrusted the PRRC and the authorised representative to the same structure. You must either separate the natural persons holding the two functions (general case), or separate the organisations if you are a micro or small enterprise. The change must be documented in the mandate contract and registered in EUDAMED.
EU manufacturer outsourcing its PRRC. Verify that the PRRC provider does not also act as the authorised representative for the manufacturer. Also verify that the experience of the designated PRRC meets the “substantive and recent” criterion as clarified by Rev.1.
Importer, distributor, or operator assuming the manufacturer’s obligations. Verify that a PRRC is indeed designated, with the qualifications of Article 15(1) MDR. This is a frequent blind spot for distributors that adapt a device under a new trade name.
These three situations will be the subject of verifications during the upcoming MDR surveillance audits. Anticipating compliance costs less than adding a non-conformity to the CAPA following an audit finding.
Source
Primary source: MDCG 2019-07 Rev.1 (December 2023), European Commission.
Thomas TRULLEN and Jonathan BEDIN, co-founders of ISOFAC Group, work on bringing PRRC / authorised representative organisations into compliance with MDCG 2019-07 Rev.1. ISOFAC SASU is registered on EUDAMED under SRN FR-AR-000053751.