The role of a PRRC under the EU MDR & IVDR
All medical device manufacturers and EU authorised representatives must have appointed at least one Person Responsible for Regulatory Compliance (PRRC), with the required expertise and qualifications. If you are not familiar with the PRRC role or have doubts about the related requirements, read on.
Replaces the version of 11.08.2020
Key takeaways:
- EU MDR and IVDR introduce the role of the Person Responsible for Regulatory Compliance (PRRC).
- Manufacturers and, where the manufacturer is based outside of the EEA, their EU authorised representatives are required to appoint at least one PRRC.
- PRRCs have to demonstrate adequate qualifications for this role.
- For micro- and small companies, it is possible to outsource the PRRC role to an outside expert.
- There are some uncertainties regarding personal liability and the enforcement of the role.
Content:
What is a PRRC?
PRRC stands for Person Responsible for Regulatory Compliance.
Article 15 in both the EU MDR (Regulation (EU) 2017/745 on medical devices) and the IVDR (Regulation (EU) 2017/746 on in-vitro diagnostic devices) requires manufacturers and, for manufacturers based outside of the EEA, their EU authorised representatives to have at least one PRRC in their organization.
Guidance document MDCG 2019-7 explains that the role of the PRRC adds an additional level of scrutiny and ensures that the mandatory activities related to the supervision and control of the manufacturing and post-market surveillance and vigilances are carried out appropriately. To achieve this additional level effectively, a same person cannot endorse the role of PRRC for a manufacturer located outside the EU as well as for the manufacturer’s EU authorised representative.
Who needs a PRRC?
Article 15 of the EU MDR and IVDR require manufacturers and, for manufacturers located outside the EEA, their EU authorised representatives to appoint a PRRC.
Now, because Article 15 does not apply to “legacy” devices, as it is not a requirement in the transitional provisions of the EU MDR and IVDR, a PRRC does not need to be appointed for those devices either at the manufacturer or at the EU authorized representative. This is indicated in guidance documents MDCG 2021-25 for the EU MDR and MDCG 2022-8 for the IVDR. In practice, a partial PRRC role can be difficult to implement for manufacturers with a mixed portfolio that includes “legacy” devices along with devices already CE-marked under the EU MDR or IVDR, because the quality management system procedures would have to specify what is done under the control of the PRRC and what is not. As a result, it is easier to apply PRRC’s oversight on “legacy” devices, even to the aspects still governed by the former Directives.
Manufacturers located outside the EEA are required to confirm that their EU authorised representative has appointed a person meeting the PRRC qualifications, as outlined in Article 15(1) of the EU MDR or IVDR. In doing so, the manufacturer and its EU authorised representative shall not appoint the same person to the role of PRRC.
If a company consists of more than one legal manufacturer, each legal manufacturer must appoint its own PRRC.
Who can be a PRRC?
Article 15(1) of the EU MDR and the IVDR requires a person with expertise in the field of medical devices, which is defined as qualifications that are demonstrated by either:
(a) a diploma, certificate or other evidence of formal qualification, awarded on completion of a university degree or of a course of study recognised as equivalent by the Member State concerned, in law, medicine, pharmacy, engineering or another relevant scientific discipline, and at least one year of professional experience in regulatory affairs or in quality management systems relating to medical devices; or:
(b) four years of professional experience in regulatory affairs or in quality management systems relating to medical devices.
While formal qualification is easily proven with a diploma or certificate, professional experience in medical device regulatory affairs or in quality management systems (referring to experience gained in the EU) has to be demonstrated with documents such as a work contract, organization chart, training evidence or internal records such as document releases.
«PRRCs have to demonstrate adequate qualifications for this role.»
Guidance document MDCG 2019-7 clarifies that, for the purpose of fulfilling the requirements in Article 15(1), qualifications acquired outside the EU should have been recognized by an EU Member State as equivalent to the corresponding qualification in the EU.
Can a company have more than one PRRC?
Companies are not limited to one PRRC and the responsibilities can be allocated to several people, as long as the requirements concerning qualification are met and the distribution of the respective areas of responsibility are documented in writing (Article 15[4]). If the responsibilities are divided among more than one person, the company shall ensure that all responsibilities are covered.
It is also good practice to have a deputy PRRC to ensure coverage for any absence or temporary unavailability of the PRRC.
What are the responsibilities of a PRRC under the EU MDR?
Article 15(3) of the EU MDR outlines the responsibilities of the PRRC, which entail ensuring that:
(a) the conformity of the devices is appropriately checked, in accordance with the quality management system under which the devices are manufactured, before a device is released;
(b) the technical documentation and the EU declaration of conformity are drawn up and kept up-to-date;
(c) the post-market surveillance obligations are complied with in accordance with Article 10(10);
(d) the reporting obligations referred to in Articles 87 to 91 are fulfilled; NOTE: This refers to Vigilance reporting, i.e. serious incident, field safety corrective action, and incident trend reporting).
(e) in the case of investigational devices, the statement referred to in Section 4.1 of Chapter II of Annex XV is issued.
NOTE: This refers to the statement confirming that the investigational device conforms to the General Safety and Performance Requirements in Annex I of the EU MDR, except those relative to aspects covered by the clinical investigation and that, for these, precautions are taken to protect the subject’s health and safety.
The role of the PRRC has to be included in the manufacturer’s quality management system and will be subject to scrutiny during audits.
These duties apply in fact to a manufacturer’s PRRC. For an authorised representative, the PRRC (who is subject to the same qualification requirements as a PRRC of a manufacturer) consists of ensuring compliance with the requirements applicable to the EU authorised representative, as outlined in Article 11(3) of the EU MDR. No further clarification or guidance is provided in MDCG 2022-16 relative to the role of an EU authorised representative.
The PRRC is not required to perform all tasks and activities in order to ensure compliance with the requirements, but must ensure that those are performed under his/her responsibility.
The EU MDR stipulates that the name and contact details of the appointed person responsible for regulatory compliance have to be entered in the EUDAMED database.
What are the responsibilities of a PRRC under the IVDR?
Per Article 15(3) of the EU IVDR, the PRRC is responsible for ensuring that:
(a) the conformity of the devices is appropriately checked, in accordance with the quality management system under which the devices are manufactured, before a device is released;
(b) the technical documentation and the EU declaration of conformity are drawn up and kept up-to-date;
(c) the post-market surveillance obligations are complied with in accordance with Article 10(9);
(d) the reporting obligations referred to in Articles 82 to 86 are fulfilled; NOTE: This refers to Vigilance reporting, i.e. serious incident, field safety corrective action, and incident trend reporting).
(e) in the case of devices for performance studies intended to be used in the context of interventional clinical performance studies or other performance studies involving risks for the subjects, the statement referred to in Section 4.1 of Chapter II of Annex XV is issued.
NOTE: This refers to the statement confirming that the device conforms to the General Safety and Performance Requirements in Annex I of the EU IVDR, except those relative to aspects covered by the clinical performance study and that, for these, precautions are taken to protect the subject’s health and safety.
Like for the EU MDR, the responsibilities of the PRRC of an EU authorised representative are in fact ensuring the fulfilment of the EU authorised representative’s duties, as stated in the manufacturer’s mandate and in accordance with Article 11(3) of the IVDR.
Does the PRRC need to be an employee of the company?
Yes. Moreover, the manufacturer’s PRRC shall suffer no disadvantage within the organization in relation to the proper fulfilment of his/her duties.
The role of the PRRC has to be included in the manufacturer’s quality management system (read more about quality management systems and ISO 13485 here), and the role will be subject to scrutiny during audits.
Only companies with fewer than 50 employees and an annual turnover under EUR 10 million (falling within the definition of micro and small enterprises as per Commission Recommendation 2003/361/EC) are allowed to outsource their PRRC to an outside expert, under the conditions that the PRRC fulfils the qualification criteria and is permanently and continuously at their disposal.
«For micro- and small companies, it is possible to outsource the PRRC role.»
It is important to note that neither the EU-MDR/IVDR nor the guidance document MDCG 2019-7 provides details as to the practical implications of permanent and continuous availability. Hence, it is recommended that manufacturers and EU authorised representatives interpret this requirement conservatively, and their external PRRC remains reachable 24/7 and has an officially appointed designee for absences. The contractual agreement with the PRRC should detail his/her permanent and continuous availability should also include the relevant person’s qualification.
Outsourcing the PRRC function requires appropriate agreements, as the person will be responsible for compliance with procedures, technical documentation, and post-market obligations (read more about post-market obligations here). An outsourced PRRC must be integrated in a manner that allows all involved parties to fulfil the requirements of the EU-MDR/IVDR.
Note that a micro or small manufacturer located outside the EEA and its EU authorised representative cannot outsource its PRRC to the same expert individual or organization.
When it comes to the location of the PRRC, MDCG 2019-7 clarifies that a PRRC of manufacturers located in the EU must also be located in the EU, and the PRRC of manufacturers outside the EU must therefore be located outside the EU,. This is because a close link, of a permanent and continuous nature, has to be established between the PRRC and the manufacturing activities. This is important for multinational companies who might have PRRC expertise in remote sites.
What does this mean in terms of liability?
Whereas the EU MDR and IVDR specify that the PRRC must not be discriminated against because of their duties, it does not elaborate on the potential liability of the person responsible for regulatory compliance. Neither does guidance document MDCG 2019-7. But this information would be valuable in order to ensure that the PRRC does not suffer any disadvantage for proper fulfilment of the duties as well as to structure the mandate accordingly. While some of these points (such as limitation of liability) can be a part of the employment contracts, national laws will have to clarify these points until there is an EU-wide provision.
It is unclear whether an infringement of the PRRC’s duties set forth in Article 15(3) of the EU MDR and IVDR will lead to enforcement directed against the company or also against the PRRC, and to what extent and under which circumstances (such as gross negligence, severe fault, fraud) a PRRC can be punished for not exercising his/her responsibilities.
How Decomplix can help
Decomplix has extensive regulatory and quality expertise in medical devices and can help manufacturers and authorized representatives define and establish the PRRC role either internally or externally.
Our team of experts will be happy to support you in the development of the PRRC roles and contracts within your quality management system, as well as in any specific questions regarding the regulatory requirements for your medical devices and IVDs. You can learn more about our services here.
