Person Responsible for Regulatory Compliance (PRRC) — EU MDR/IVDR Article 15
The PRRC is a statutory function under Article 15 of Regulation (EU) 2017/745 (MDR) and Regulation (EU) 2017/746 (IVDR). Guidance is provided in MDCG 2019-7 Rev.1 (December 2023). This guide consolidates legal requirements and practical implementation for manufacturers and authorised representatives (ARs).
1) Who must appoint a PRRC
- Manufacturers established inside or outside the Union (MDR/IVDR Art. 15(1)). Each legal manufacturer appoints a PRRC within its organisation, unless the SME exception in Art. 15(2) applies.
- Authorised Representatives (ARs) appoint a PRRC for AR obligations (Art. 15(6) with Art. 11(3)).
- Entities assuming manufacturer obligations (e.g., under MDR Art. 16 or Art. 22(4)) appoint a PRRC covering those obligations.
2) Minimum qualifications (Article 15)
Manufacturers — Art. 15(1)
- Route A: a university degree (or course of study recognised as equivalent by an EU Member State) in law, medicine, pharmacy, engineering, or another relevant scientific discipline and ≥1 year of professional experience in RA or QMS relating to devices/IVDs.
- Route B: ≥4 years of professional experience in RA or QMS for devices/IVDs.
- Custom-made devices: experience must be relevant to the technologies used; MDCG Rev.1 explains acceptable evidence paths for manufacturers of custom-made devices.
Maintain a qualification file: CV; diplomas/equivalency decisions; experience letters; continuing competence record. Purely administrative tasks are not sufficient as experience.
Authorised representatives — Art. 15(6)
The AR’s PRRC follows the same qualification routes. Competence must cover AR responsibilities in Article 11(3), including verification of EU Declaration of Conformity (DoC), UDI presence, vigilance forwarding, and cooperation with competent authorities and notified bodies.
3) Availability & the SME exception (“permanently and continuously at their disposal”)
Article 15(2) permits micro and small enterprises to subcontract the PRRC. “Permanently and continuously at their disposal” means the PRRC can perform Article 15(3) tasks and respond promptly; 24/7 coverage is not required. Contracts should state response times, substitution/backup, scope, authority, and access to records.
| Enterprise size | Headcount | Financial criterion (either) | PRRC model |
|---|---|---|---|
| Micro | ≤ €2m turnover or ≤ €2m balance sheet total | May subcontract PRRC under Art. 15(2) with contractual availability. | |
| Small | ≤ €10m turnover or ≤ €10m balance sheet total | May subcontract PRRC under Art. 15(2) with contractual availability. | |
| ≥ Medium | ≥ 50 FTE or above thresholds | — | PRRC must be an employee within the manufacturer’s organisation. |
4) Location of the PRRC
- EU-established manufacturers: PRRC located within the Union as an employee of the manufacturer.
- Non-EU manufacturers: PRRC typically located outside the Union, near manufacturing/RA/QMS functions. This PRRC is distinct from the AR’s PRRC.
- Authorised representatives: AR PRRC located in the Union to interface with competent authorities and notified bodies.
5) Independence and organisational safeguards
- No disadvantage: protection from disadvantage for fulfilling PRRC tasks; embed in employment/contract terms and HR policy.
- Governance: direct access to top management; documented escalation rights; whistleblower/anti-retaliation coverage; standing invitation to management review; access to all records necessary to perform tasks; authority to halt release if requirements are not met.
- Multiple PRRCs: allowed if all Article 15(3) duties are covered. Delineate responsibilities in writing (e.g., by device family, process area, geography) and maintain a responsibility matrix.
6) Article 15(3) responsibilities — activities and records
| Responsibility | Expected activities and records |
|---|---|
| (a) Conformity & release under the QMS | Verify devices are released per procedures proportionate to device type/risk class (MDR Art. 10(9); IVDR Art. 10(8)). Records: release gate or sampling log; DHR/lot review; GSPR checklist mapping; verification/validation reports; NB certificate status (if applicable). |
| (b) Technical documentation & EU Declaration of Conformity | Ensure TD and DoC are drawn up and kept current (MDR/IVDR Art. 10(4)–(6)). Records: TD index with PRRC sign-off; DoC master list; change control updates to TD before implementation; NB notifications when required. |
| (c) Post-market surveillance (PMS) | Verify PMS is established, implemented, and effective (MDR Art. 10(10); IVDR Art. 10(9)). Activities: review PMS plan and outputs; confirm PMCF/PMPF conduct; evaluate signal detection and trend criteria; ensure CAPA integration; include PMS metrics in management review. Records: PSUR/periodic reports, PMCF/PMPF results, signal assessments, CAPA linkage, management review minutes. |
| (d) Vigilance & trend reporting | Confirm processes for serious incident reporting, FSCAs, and trend reporting (MDR Arts. 87–91; IVDR Arts. 82 & 86). Records: escalation/decision log; submission copies; trend threshold reviews; correspondence with CA/NB. |
| (e) Statements for investigational/performance study devices | Confirm statements under Annex XV (MDR) or Annex XIV (IVDR) are issued and that GSPR are met except for study aspects. Records: signed statement; risk mitigation plan; subject safety measures; IFU for study use. |
7) Manufacturer PRRC vs Authorised Representative PRRC
- The same individual should not act as PRRC for both a manufacturer and its AR. The AR provides an independent layer of checks under Article 11(3).
- Use an interface/risk-owner matrix to define who signs the DoC, who files vigilance, who maintains UDI/Eudamed entries, and how escalations occur. Keep meeting notes and decision logs for traceability.
- For non-EU manufacturers: maintain two contacts—manufacturer PRRC (typically outside the Union) and AR PRRC (in the Union). Define communication timeframes and document exchange protocols.
8) Eudamed registration and updates
Enter PRRC details (name, address, contact) as part of actor registration (Annex VI, Part A). Update PRRC details promptly when changes occur. Maintain proof of registration and update confirmations. Internal procedures should target within 1 week of change for updates to reflect good practice.
9) Links to ISO 13485 and MDR/IVDR obligations
- Document control & records (ISO 13485:2016 §§4.2, 4.2.5, 7.5.1) — supports TD and release evidence for Article 15(3)(a–b).
- Production & service provision (ISO 13485 §7.5) — aligns with conformity and release checks.
- PMS & feedback (ISO 13485 §8.2.1, §8.2.5, §8.4) — maps to Article 15(3)(c) and MDR/IVDR PMS chapters.
- CAPA (ISO 13485 §8.5.2, §8.5.3) — supports PMS/vigilance effectiveness and PRRC oversight.
- Management review (ISO 13485 §5.6) — include PRRC report, PMS/vigilance metrics, TD/DoC status, and trends.
10) Document set to maintain
Core documents
- PRRC appointment letter (or SME/AR contract) with availability, authority to halt release, confidentiality, access to records, backups/substitutes.
- PRRC charter/mandate mapping Article 15(3)(a–e) to QMS processes; escalation rights; protection from disadvantage.
- Qualification file: CV, diplomas/equivalency, experience letters, CPD log.
- Eudamed registration proof and update history.
Operational logs
- Release review log or sample checklist sign-offs.
- TD/DoC currency log linked to change control and NB notifications.
- PMS oversight log: PSUR cycles, PMCF/PMPF actions, signal assessments, CAPA linkage.
- Vigilance decision log: incidents, trend triggers, FSCA decisions, CA/NB correspondence.
11) SME subcontracting — pitfalls & clauses
- Pitfalls: undefined response times; no backup; unclear release authority; lack of access to TD/records; missing confidentiality; no right to stop shipment.
- Clauses: scope aligned to Art. 15(3)(a–e); response times (e.g., routine ≤1 business day; urgent same day); right to halt release; access to TD/PMS/vigilance/DHR; confidentiality/data protection; named substitute PRRC; termination and handover duties.
Model clause — availability
The Provider shall supply a Person Responsible for Regulatory Compliance (PRRC) meeting Article 15 MDR/IVDR qualifications. The PRRC shall be permanently and continuously at the Manufacturer’s disposal, meaning the PRRC is enabled to perform all Article 15(3) tasks and to react within the following timeframes: (i) routine queries: 1 business day; (ii) release/vigilance escalations: same business day. The Provider shall nominate a qualified substitute for absences >24 hours and shall maintain secure access to the Manufacturer’s regulatory and QMS records necessary to perform PRRC duties.
12) Liability and accountability
The PRRC verifies compliance and may halt release where requirements are not met. Ultimate responsibility for MDR/IVDR compliance remains with the manufacturer (or with the AR for AR obligations). Clear delegation, access to information, and decision logs demonstrate diligence by the PRRC.
