Updated July 2026. Scope: PRRC requirements under EU MDR 2017/745 and IVDR 2017/746, Article 15, operational practice. For appointment mechanics and whether you need one at all, see the guide on when you need a PRRC and how to appoint one.
Key takeaways
- The PRRC (Person Responsible for Regulatory Compliance) is a statutory role under MDR and IVDR Article 15. Manufacturers must have at least one person with the requisite expertise responsible for specific compliance tasks; micro and small enterprises may use an external person who is permanently and continuously at their disposal.
- The PRRC requirements are not met by a name in an organisation chart. The role fails in practice when the named person has no documentation access, no defined availability, no deputy arrangement, and no written scope.
- Appointing a PRRC, internal or external, does not transfer the manufacturer’s legal responsibility. The manufacturer stays accountable for every obligation the PRRC oversees.
- Under MDCG 2019-7 Rev.1, the authorised representative’s PRRC and the manufacturer’s PRRC cannot be the same person.
Where PRRC arrangements fail in practice
Notified body assessors and competent authorities do not stop at whether you have a PRRC. They ask how the role works. The common failure patterns:
- Named on paper, absent in the process. The PRRC appears in the quality manual but no procedure routes release decisions, technical documentation changes, or vigilance decisions through them. There is nothing showing the person actually ensures what Article 15(3) says they must ensure.
- No documentation access. An external PRRC without standing access to the technical documentation, the quality management system, and post-market data cannot perform the role. Availability without access is a listing, not an arrangement.
- No absence coverage. One person, no deputy, no documented handover. Release decisions still happen during vacations and sick leave; nobody can show who ensured conformity checks in that window.
- Conflicting hats. The same person owns commercial release targets and PRRC oversight of release conformity. Article 15(5) protects the PRRC from disadvantage for doing the job; an incentive structure that punishes them for doing it is a finding waiting to be written.
PRRC requirements: what Article 15 actually says
The qualification routes, Article 15(1):
| Route | Requirement |
|---|---|
| (a) Formal qualification | A diploma, certificate or other evidence of formal qualification in law, medicine, pharmacy, engineering or another relevant scientific discipline, plus at least one year of professional experience in regulatory affairs or quality management systems relating to medical devices |
| (b) Experience | Four years of professional experience in regulatory affairs or in quality management systems relating to medical devices |
Manufacturers of custom-made devices have a further option under Article 15(1): at least two years of professional experience within a relevant field of manufacturing, without prejudice to national qualification rules.
The responsibilities, Article 15(3): the PRRC is responsible for ensuring that
| Duty | In practice |
|---|---|
| (a) Conformity of devices is appropriately checked, in accordance with the QMS, before release | A defined release checkpoint the PRRC oversees, with records |
| (b) Technical documentation and the EU declaration of conformity are drawn up and kept up to date | Change control that involves the PRRC, not just informs them |
| (c) Post-market surveillance obligations are complied with (Article 10(10) MDR) | PMS plan and reports the PRRC reviews on a defined cycle |
| (d) Reporting obligations under Articles 87 to 91 are fulfilled | Vigilance decisions and timelines the PRRC can evidence |
| (e) For investigational devices, the statement referred to in Section 4.1 of Chapter II of Annex XV is issued | Only relevant where clinical investigations run |
Source: Regulation (EU) 2017/745, Article 15 (the IVDR, Regulation (EU) 2017/746, carries the parallel provision).
Three further provisions shape how the role is organised:
- Micro and small enterprises, Article 15(2): they are not required to have the PRRC within their organisation, but must have such a person permanently and continuously at their disposal. An external PRRC under a documented arrangement is an accepted model.
- Several PRRCs, Article 15(4): where several persons are jointly responsible, their respective areas of responsibility must be stipulated in writing.
- No disadvantage, Article 15(5): the PRRC shall suffer no disadvantage within the manufacturer’s organisation in relation to the proper fulfilment of their duties, whether or not they are an employee.
Law versus practice. Article 15 does not define response times, deputy models, or meeting cadences. Those are organisational choices you must design and document so the arrangement demonstrably works. Everything in the next two sections is practice, informed by the regulation and MDCG 2019-7 Rev.1, not additional legal requirements.
Availability and deputies: making “permanently and continuously” real
“Permanently and continuously at their disposal” is the standard the arrangement has to meet. In practice that means:
- Put the arrangement in writing. For an external PRRC: a contract naming the person, their qualification route under Article 15(1), the scope of duties, access rights, and how they are reached. MDCG 2019-7 Rev.1 expects the contract to reflect the person’s qualifications.
- Give the PRRC standing access. Technical documentation, QMS records, PMS data, and vigilance files, without having to request them case by case.
- Define the routing. Which decisions stop at the PRRC checkpoint (release conformity, declaration of conformity updates, reportable-event decisions), and how the PRRC records their involvement.
- Cover absence. Either a second qualified person with a written split of responsibilities under Article 15(4), or a documented deputy protocol for planned and unplanned absence. What matters is that the checkpoint never silently disappears.
- Review the arrangement. A short annual check that access still works, the scope still matches the product portfolio, and the named person still meets the qualification route.
The records that demonstrate the role works
When the arrangement is assessed, the questions are evidence questions. Records worth being able to produce as objective evidence:
- The written PRRC appointment or contract, including the qualification basis under Article 15(1)(a) or (b)
- The written split of responsibilities where more than one PRRC shares the role (Article 15(4))
- Release-checkpoint records showing PRRC oversight in accordance with the QMS
- Technical documentation and declaration of conformity change records with PRRC involvement
- PMS review records and vigilance decision records tied to the PRRC
- The deputy or absence protocol, and at least one instance showing it was used
Boundaries worth stating plainly
- The PRRC is not a rubber stamp, and it is not a liability shield. The manufacturer’s obligations stay with the manufacturer; the PRRC ensures defined tasks are done, and Article 15 does not move legal responsibility onto the person.
- The authorised representative has its own PRRC obligation, Article 15(6). Under MDCG 2019-7 Rev.1, the manufacturer’s PRRC and the authorised representative’s PRRC cannot be the same person.
- The role is protected. Article 15(5) means an organisation that penalises its PRRC for escalating or halting release has a compliance problem on top of the original one.
Frequently asked questions
Can the PRRC be an external consultant?
For micro and small enterprises, yes. Article 15(2) requires the person to be permanently and continuously at the manufacturer’s disposal rather than employed in-house. The arrangement should be contractual, name the person, state their qualification route, and give them standing access to the documentation the role covers.
What qualifications does a PRRC need?
Article 15(1) gives two general routes: a relevant formal qualification (law, medicine, pharmacy, engineering or another relevant scientific discipline) plus at least one year of professional experience in regulatory affairs or quality management systems relating to medical devices, or four years of such professional experience without the formal qualification. Manufacturers of custom-made devices may instead demonstrate at least two years of professional experience in a relevant field of manufacturing.
Can one person be the PRRC for both the manufacturer and its authorised representative?
No. MDCG 2019-7 Rev.1 states the two roles cannot be held by the same person. The authorised representative needs its own PRRC under Article 15(6).
Does appointing a PRRC reduce the manufacturer’s liability?
No. The manufacturer remains accountable for all obligations under the MDR and IVDR. The PRRC ensures specific compliance tasks are carried out; it is an oversight function, not a transfer of responsibility.
What happens if the PRRC is on leave when a reportable incident occurs?
The reporting clocks in MDR Articles 87 to 91 (and the IVDR parallels) do not pause. This is why a written deputy or absence protocol matters: someone qualified must be able to take the decision, and the records must show who did.
Related guides and services
- PRRC services from CENIT Consulting: a named, qualified PRRC with documented availability, defined escalation paths, and deputy coverage agreed before engagement.
- Quality management support: the QMS procedures, release checkpoints, and objective evidence the PRRC role depends on.
For the role’s legal background and appointment decision, start with when you need a PRRC and how to appoint one and the role of the PRRC under MDR and IVDR.
This article is for general information only and is not legal or regulatory advice. Teams remain responsible for regulatory decisions and staying current with applicable regulations and guidance.
Talk to CENIT Consulting about PRRC coverage for your organisation: book a 30-minute consult.