The role of a PRRC under the MDR

All manufacturers and EU authorised representatives must have a PRRC. Manufacturers are required to confirm that their EU authorised representative has appointed a person meeting the PRRC qualifications as outlined in Article 15 of the MDR and IVDR. If a company consists of more than one legal manufacturer, each legal manufacturer must appoint its PRRC.

Key takeaways:

• MDR and IVDR introduce the new role of the Person Responsible for Regulatory Compliance (PRRC).
• Manufacturers and authorized representatives are required to appoint a PRRC.
• PRRCs have to demonstrate adequate qualifications for this role.
• In some cases, it is possible to outsource the PRRC role to an outside expert.
• There are some uncertainties regarding personal liability and the enforcement of the role.

Content:

What is a PRRC?

PRRC stands for person responsible for regulatory compliance. It is one of the newly introduced requirements of the European Union’s Medical Device Regulation (MDR) and In-Vitro Diagnostic Medical Device Regulation (IVDR). It intends to ensure companies have a qualified regulatory expert at their disposal. 

Article 15 of the EU MDR and EU IVDR requires manufacturers (and authorised representatives) to have at least one person responsible for regulatory compliance available within their organisation to make sure the company is meeting the requirements of the MDR/IVDR. This requirement is mandatory as of the date of application of the respective EU Regulation, i.e. 26 May 2021 for the MDR and 26 May 2022 for the IVDR. In the following, we will take a closer look at the newly introduced requirements related to this role.

Who can be a PRRC?

Article 15(1) of the MDR and the IVDR calls for a person possessing the requisite expertise in the field of medical devices, which is defined as qualifications that are demonstrated by either:

(a) a diploma, certificate or other evidence of formal qualification, awarded on completion of a university degree or of a course of study recognised as equivalent by the Member State concerned, in law, medicine, pharmacy, engineering or another relevant scientific discipline, and at least one year of professional experience in regulatory affairs or in quality management systems relating to medical devices;

or:

(b) four years of professional experience in regulatory affairs or in quality management systems relating to medical devices.

While formal qualification is easily documented with a diploma or certificate, professional experience in medical device regulatory affairs or in quality management systems (referring to experience gained in the EU) has to be demonstrated as well. Qualification based on professional experience has to be substantiated with documents such as a work contract, organisation chart, training evidence or internal records such as document releases. 

In the additional guidance document MDCG 2019-7, the EU Medical Device Coordination Group clarifies how to interpret Article 15. With regard to the required qualifications, the guidance adds that, for the purpose of fulfilling the requirements in Article 15(1), qualifications acquired outside the EU should have been recognised by an EU Member State as equivalent to the corresponding qualification in the EU.

Can a company have more than one PRRC?

Companies are not limited to one PRRC and the responsibilities can be allocated to several people, as long as the requirements concerning qualification are met and the distribution of the respective areas of responsibility are documented in writing (Article 15[4]). If the responsibilities are divided among more than one person, ensure that all responsibilities are covered.

What are the responsibilities of a PRRC under the MDR?

Article 15(3) of the EU MDR outlines the requirements and responsibilities of the PRRC. The PRRC of a manufacturer is responsible for ensuring that:

(a) the conformity of the devices is appropriately checked, in accordance with the quality management system under which the devices are manufactured, before a device is released;

(b) the technical documentation and the EU declaration of conformity are drawn up and kept up-to-date;

(c) the post-market surveillance obligations are complied with in accordance with Article 10(10);

(d) the reporting obligations referred to in Articles 87 to 91 are fulfilled; NOTE: This refers to Vigilance reporting, i.e. serious incident, field safety corrective action, and incident trend reporting).

(e) in the case of investigational devices, the statement referred to in Section 4.1 of Chapter II of Annex XV is issued. NOTE: This refers to the statement confirming that the investigational device conforms to the General Safety and Performance Requirements in Annex I of the EU MDR, except those relative to aspects covered by the clinical investigation and that, for these, precautions are taken to protect the subject’s health and safety.

Under the MDR, the responsibility of a PRRC of an authorised representative (who is subject to the same requirements regarding qualification as a PRRC of a manufacturer) consists of ensuring compliance with the requirements applicable to the EU authorised representative, as outlined in Article 11(3) of the MDR.

The MDR stipulates that the name and contact details of the appointed person responsible for regulatory compliance have to be entered in the EUDAMED database. 

The MDR does not stipulate that the PRRC has to perform all tasks and activities in order to ensure compliance with the requirements, but that those are performed under his/her responsibility. 

What are the responsibilities of a PRRC under the IVDR?

Per Article 15(3) of the EU IVDR, the PRRC is responsible for ensuring that:

(a) the conformity of the devices is appropriately checked, in accordance with the quality management system under which the devices are manufactured, before a device is released;

(b) the technical documentation and the EU declaration of conformity are drawn up and kept up-to-date;

(c) the post-market surveillance obligations are complied with in accordance with Article 10(9);

(d) the reporting obligations referred to in Articles 82 to 86 are fulfilled; NOTE: This refers to Vigilance reporting, i.e. serious incident, field safety corrective action, and incident trend reporting).

(e) in the case of devices for performance studies intended to be used in the context of interventional clinical performance studies or other performance studies involving risks for the subjects, the statement referred to in Section 4.1 of Chapter II of Annex XV is issued. NOTE: This refers to the statement confirming that the device conforms to the General Safety and Performance Requirements in Annex I of the EU IVDR, except those relative to aspects covered by the clinical performance study and that, for these, precautions are taken to protect the subject’s health and safety.

Like for the MDR, the EU Medical Device Coordination Group clarifies in its guidance document MDCG 2019-7 that the responsibilities of the PRRC of an EU authorised representative are in fact ensuring the fulfilment of the EU authorised representative duties, as stated in the manufacturer’s mandate and in accordance with Article 11(3) of the IVDR. 

The role of the PRRC has to be included into the quality management system, and the role will be subject to scrutiny during audits.

Who needs a PRRC?

All manufacturers and EU authorised representatives must have a PRRC. Manufacturers are required to confirm that their EU authorised representative has appointed a person meeting the PRRC qualifications as outlined in Article 15. If a company consists of more than one legal manufacturer, each legal manufacturer must appoint its own PRRC.

The MDCG 2019-07 document explains that the new role of the PRRC adds an additional level of scrutiny and ensures that the mandatory activities related to the supervision and control of the manufacturing and post-market surveillance and vigilances are carried out appropriately. To achieve this additional level effectively, one individual cannot serve as the PRRC for a manufacturer outside the EU and as the company’s EU authorised representative. In this sense, if a micro or small company outsources its PRRC to an external organisation, the authorised representative of this company cannot outsource their PRRC to the same outside expert.

Class I medical device manufacturers must have a PRRC, too. You can find more about the class I medical device requirements on our related blog article.

Does the PRRC need to be an employee of the company?

Yes. Only companies with fewer than 50 employees and an annual turnover under EUR 10 million (falling within the definition of micro and small enterprises as per Commission Recommendation 2003/361/EC) are allowed to outsource their PRRC to an outside expert, under the conditions that the PRRC fulfils the qualification criteria and is permanently and continuously at their disposal.

It is important to note that neither the MDR/IVDR nor the guidance document MDCG 2019-7 provides details as to the practical implications of permanent and continuous availability. Hence, it is recommended that manufacturers and EU authorised representatives interpret this requirement conservatively, and their external PRRC remains reachable 24/7 and has an officially appointed designee for absences. The contractual agreement with the PRRC should detail his/her permanent and continuous availability should also include the relevant person’s qualification. 

Outsourcing the PRRC function requires appropriate agreements, as the person will be responsible for compliance with procedures, technical documentation, and post-market obligations (read more about post-market obligations here). An outsourced PRRC must be permanently available and should be integrated in a manner that allows all involved parties to fulfil the requirements of the MDR/IVDR. 

When it comes to the location of the PRRC, the MDCG document clarifies that a PRRC of manufacturers located in the EU must also be located in the EU (the PRRC of manufacturers outside the EU must therefore be located outside the EU). This is because a close link, of a permanent and continuous nature, has to be established between the PRRC and the manufacturing activities. 

 The role of the PRRC has to be included in the quality management system (read more about quality management systems and ISO 13485 here), and the role will be subject to scrutiny during audits.

What does this mean in terms of liability?

While the MDR/IVDR specifies that the PRRC must not be discriminated against because of their duties, it does not elaborate on the potential liability of the person responsible for regulatory compliance. Neither does the MDCG guidance (MDCG 2019-7). But this information would be valuable in order to ensure that the PRRC does not suffer any disadvantage for proper fulfilment of the duties as well as to structure the mandate accordingly. While some of these points (such as limitation of liability) can be a part of the employment contracts, national laws will have to clarify these points until there is an EU-wide provision.

The question remains if the infringement of Article 15(3) will lead to enforcement directed against the company or also against the PRRC and to what extent and under which circumstances (such as gross negligence, severe fault, fraud) a PRRC can be punished for not exercising his responsibilities as outlined in Article 15(3).

TEAM-PRRC is a European not-for-profit association that has been launched to represent its members at the level of the European Commission and Medical Device Coordination Group. The association aims to gain insight and to influence the guidance that is being developed for the PRRC role and to promote understanding of the PRRC responsibilities. As the role carries considerable responsibility and potentially weighty personal liability, TEAM-PRRC will support its members by analysing available guidance and to promote greater security of the PRRC professionals themselves. 

Further questions about PRRC and MDR

If you have other questions regarding how to ensure compliance with MDR, our team of experts is always ready to help. Feel free to contact us.