… and when does the QMR come into play? The introduction of the mandatory role of the Person Responsible for Regulatory Compliance (PRRC) was just one of many novelties that economic operators, in particular manufacturers and authorised representatives, have had to deal with since the MDR and IVDR came into force.
But what is the status today? What impact has this new role had on the economic operators concerned? Has the PRRC now taken up his station in the new corporate structures transformed by the MDR/IVDR? Has it been possible to create a clear delineation of the role of the quality management representative (QMR) or have interdisciplinary synergies developed between the two functions?
Has the PRRC been integrated into functional processes – or does it exist in isolation, without sustainable integration with quality management and regulatory affairs?
Profile: Responsible person according to Article 15 MDR/IVDR
According to Article 15 (1) and (6) MDR and IVDR, manufacturers of medical devices and authorised representatives must designate at least one responsible person for regulatory compliance. This means that a professionally qualified person who is responsible for the regulatory compliance of the products is enshrined in law for these economic operators.
The duties of the responsible person include tasks relating to
- Ensuring that the conformity of devices is adequately checked prior to their release in accordance with the manufacturer’s quality management system
- Maintaining the technical documentation and the EU Declaration of Conformity
- Fulfilling post-market surveillance (PMS) obligations
- Fulfilment of reporting obligations in the context of vigilance
- Submission of declarations on investigational devices in the context of clinical investigations (MDR) or performance studies (IVDR).
Neither the MDR nor the IVDR make clear recommendations on the organisational integration of the PRRC: the focus is more on qualifications, scope of duties and availability. The integration of the PRRC into the company structure depends heavily on the size, structure and organisational culture of the company. It is not uncommon for the organisational structure to need to be specifically adapted in order to meet the requirements of Article 15 MDR/IVDR.
Due to the qualifications required by the regulations, the PRRC is often located in the Regulatory Affairs (RA) or Quality Management (QM) department and thus usually also ensures effective implementation of the regulatory requirements. In larger companies with usually clearly defined role profiles, responsibilities and escalation paths, the PRRC is technically assigned to the RA department and reports directly to the management or to the head of quality management.
In small and medium-sized enterprises (SMEs), where functions often overlap, the function of the management representative (best known as the ”QMR”) or the in accordance with EN ISO 13485 is often combined with other tasks. This makes it all the more important to clearly define the tasks and responsibilities vis-à-vis the RA, QM or even management so that the PRRC can fulfil its duties independently and in compliance with the regulations. It is not uncommon for the PRRC to report directly to top management.
Furthermore, a deputy arrangement should be established so that, above all, the closely regulated reporting obligations can be complied with in the event of incidents.
Where does the responsibility of the QMR begin and where does the responsibility of the PRRC end?
As Article 10 MDR/IVDR explicitly requires manufacturers to establish and maintain a quality management system (QMS), the QMR or management representative as defined in EN ISO 13485 remains a central function in the QMS of manufacturers of medical devices and in vitro diagnostic medical devices. Because the areas of responsibility of the PRRC and QMR overlap to some extent, the question often arises: Where is the line between the regulatory responsibility of the PRRC and the quality-related system responsibility of the QMR ?
The management representative in accordance with EN ISO 13485 is responsible for the following areas of responsibility
- Maintaining the effectiveness of the QMS by documenting required processes
- Reporting to management and submitting proposals for continuous improvement of the QMS
- Promoting quality and regulatory awareness within the company.
This also results in significant differences between the two roles:
- Legal framework: The role of the PRRC is prescribed by law and enshrined in Article 15 MDR/IVDR. In contrast, the role of the QMR, including responsibility and authorisation, is “only” defined in EN ISO 13485, Chapter 5.5.2.
- Task focus: The PRRC focuses on ensuring regulatory compliance (e.g. technical documentation, conformity assessment, vigilance, market surveillance and product release in accordance with MDR/IVDR), while the QMR is primarily responsible for implementing and maintaining the quality system and processes.
- Day-to-day collaboration: The PRRC monitors compliance with regulatory requirements on a risk basis, e.g. randomly checking batch releases, while the QMR is responsible for operational quality assurance and process control.
The PRRC checks what is required by regulation – the QMR ensures that it is implemented in the company. For example, the PRRC is responsible for post-market surveillance (PMS) and maintaining the technical documentation, but the conformity of the relevant processes and their integration into the QMS is the responsibility of the QMR. The QMR ensures that the internal processes/procedures fulfil the regulatory and normative requirements.
With regard to PMS, for example, this means that suitable systems and procedures must be implemented for proactively recording and evaluating of the experience gained with the products on the market. The QMR supports these processes by implementing and maintaining quality management, providing the basis for implementing PMS in the first place.
What has changed for the QMR with the introduction of the PRRC role? In many organisations, hardly anything. The QMR continues to fulfil his duties, while the PRRC delegates some of its own duties to the QMR, but retains full responsibility.
The PRRC’s responsibility ends where it is no longer a matter of ensuring the regulatory requirements in accordance with the MDR/IVDR, but rather the operational implementation and monitoring of the QMS – this is where the QMR’s responsibility begins. The responsibility of the PRRC therefore extends far beyond that of the QMR, particularly in the area of post-market surveillance (PMS) and reporting.
In consequence taking on the PRRC role comes with high liability risks
How dangerous is the PRRC’s life?
In view of the PRRC’s extensive responsibilities – particularly in the areas of product conformity, post-market surveillance (PMS) and vigilance – the question of personal liability arises in the event of breaches of duty, for example in the event of physical injury and/or damage to the health of patients/users.
In order to ensure the independence of decisions in terms of product safety and patient protection, even in the event of potential conflicts of interest, Article 15 (5) MDR/IVDR introduces a prohibition of discrimination: PRRCs, both internal and external, may not be disadvantaged if they fulfil their duties properly, even if their decisions are financially detrimental to the company. This is intended to ensure that PRRCs can fulfil their duties independently of instructions without having to fear negative consequences.
These liability issues become particularly important in a cross-border context. Although the role of the PRRC is clearly anchored in the European regulations, questions of personal liability are not regulated there. These arise from the respective national law – see Article 113 MDR /Article 106 IVDR . Which law applies usually depends on the country in which the manufacturer or authorised representative is based. A case-by-case assessment remains essential, as the national liability law is decisive for the type and scope of the personal risk. The differences in sanctions are specified in national legislation and range from substantial administrative fines to criminal sanctions such as custodial sentences.
The regulatory kaleidoscope of Europe is particularly illustrated by the examples of Germany, Austria and France:
- Germany: The MPDG does not impose any direct fines on PRRCs in the event of non-compliance with the obligations under Article 15 (3) – the responsibility remains with the economic operator concerned. However, the PRRC can be held criminally liable if he culpably breaches his obligations (e.g. fails to carry out vigilance) and this results in patient harm.
- Austria: The national implementing regulation for the MDR/IVDR in Austria, Section 80 of the Medical Devices Act (MPG 2021), treats violations of MDR/IVDR regulations, such as failure to fulfil the obligations of the PRRC, failure to comply with vigilance and market surveillance obligations, etc., as administrative offences. These can be penalised with fines of up to 25,000 euros and, in the event of a repeat offence, even up to 50,000 euros.
- France: In France, the provisions of the Code de la santé publique, among others, must be taken into account. Failure by the manufacturer or authorised representative to report a serious incident pursuant to Article 87 MDR, a serious risk posed by a device made available in France pursuant to Article 10(12) MDR or a field safety corrective action pursuant to Article 87(8) MDR to the competent authority can be punished with up to two years’ imprisonment and a fine of up to EUR 150,000.
Another risk relates to the PRRC’s obligations in connection with batch release. Although the PRRC does not have to carry out the operational batch release itself from a regulatory perspective, the person has a crucial responsibility in the background. In accordance with the MDR and based on EN ISO 13485, it must be ensured that a release only takes place if product conformity with the regulatory requirements and the quality management system (QMS) is guaranteed. A particular focus here is on ongoing documentation: the PRRC is responsible for ensuring that all release decisions are fully and comprehensibly documented.
In this way, the PRRC assumes responsibility with a direct link to the product, which entails certain liability risks in the event of a breach of duty. If problems arise after the release and it turns out that this was done despite deficiencies or incomplete testing, this constitutes a breach of duty on the part of the PRRC – with consequences under labour, civil or criminal law, depending on national law and the type of employment.
The obligation to register the PRRC by name, e.g. in the Actor Registration Module of EUDAMED, can also entail additional personal liability risks for the person responsible. If there is a change of PRRC, Article 31(4) of the MDR obliges manufacturers and authorised representatives to update the data promptly within one week. If this considered in the internal processes and (even more importantly!) truely implemented, compliance violations and personal liability risks can be effectively avoided. The departing PRRC should independently check whether their personal data has been deleted from the system as to rule out the possibility that they will continue to be listed as responsible even though they no longer fulfil the function.
Can civil and criminal liability risks be minimised in the day-to-day work of a PRRC? The minimum is the continuous improvement of quality management processes, careful monitoring and complete documentation providing to prove the traceability of decisions made or possible misconduct by the organisation.
For whom is a PRRC mandatory from a regulatory perspective?
According to Article 15 of the MDR/IVDR, manufacturers (established in and outside the Union) and EU authorised representatives of a non-EU manufacturer are obliged to designate a responsible person.
It should also be noted that a PRRC obligation also applies to other economic operators, including importers, distributors and other persons, if they assume tasks within the meaning of Article 16 (1) MDR/IVDR and are therefore considered manufacturers.
In addition, natural and legal persons who place systems and procedure packs on the market as a separate medical device in accordance with Article 22(4) MDR assume the obligations incumbent on manufacturers and are obliged to designate a PRRC.
Hire or outsource?
Manufacturers as per MDR / IVDR must have at least one responsible person “in their organisation”. MDCG 2019-7 clarifies that “in their organisation” basically means that a PRRC must be employed by the manufacturer.
However, for manufacturers that are considered micro and small enterprises in terms of size and turnover within the meaning of Recommendation 2003/361 (EU), the legislator provides for the possibility of fully outsourcing the PRRC function to an external service provider, provided they can “permanently and continuously” rely on a PRRC (Article 15 (2) MDR/IVDR), as long as other conditions are met. Microenterprises are defined as companies with fewer than 10 employees and an annual turnover and/or annual balance sheet total of no more than EUR 2 million. Small companies are those that employ fewer than 50 people and whose annual turnover and/or annual balance sheet total does not exceed EUR 10 million.
Similar to micro and small enterprises, it is also sufficient for EU authorised representatives to appoint an external service provider as PRRC, provided that they can rely on this person “permanently and continuously […].” In this case, the responsibilities of the PRRC relate to the duties assigned to the authorised representative under the mandate concluded with the manufacturer in accordance with Article 11(3) MDR.
Clear contractual provisions are essential if the PRRC duties are outsourced. The economic operators concerned should take particular care to specify the responsibilities, availabilities (“permanent and continuous”) and authorisations of the external PRRC in order to avoid potential liability gaps.
Only one or several PRRCs? And where should it be located?
The decision to designate several PRRCs to fulfil the broad range of PRRC tasks is not restricted by Article 15 MDR/IVDR. However, such a division should be made sensibly, taking into account the product portfolio, the company locations, the focal points of the professional qualifications, etc. Not to be forgotten: If more than one person is appointed as PRRC, Article 15 (4) requires a written definition of the respective areas of responsibility. It must be ensured that all responsibilities are clearly delineated without overlaps or gaps as to guarantee complete regulatory coverage. And here, too, don’t forget to arrange for a deputy!
Companies that are obliged to fill the position of the PRRC internally may also delegate individual tasks to an external PRRC, provided that the “splitting” of responsibilities is clearly documented. If several manufacturers within the meaning of Article 2 (30) MDR/Article 2 (23) IVDR are located under the umbrella of a group of companies, each manufacturer requires its own PRRC.
In order to fulfil its function properly, the PRRC must be effectively integrated into the manufacturer’s internal processes. In the opinion of the MDCG 2019-7, it is generally recommended that an external PRRC should also be based within the EU, if the manufacturer or authorised representative is based in the EU, to ensure sufficient organisational integration into the company. For manufacturers based outside the Union, the PRRC should also be located outside the Union – ideally in geographical proximity to the production sites.
Clarity in sight? Are economic operators well prepared for the regulatory requirements?
Implementation of the PRRC role according to Article 15 MDR/IVDR is at different stages among economic operators. Larger market players have mostly implemented the requirements for the PRRC role, but fine-tuning is still ongoing. Smaller companies (SMEs) in particular, often face challenges in implementing the MDR/IVDR requirements – also considering the areas of responsibility of the PRRC and integration within the company due to a lack of qualified specialists or limited resources. Many therefore rely on external PRRC service providers to fulfil regulatory requirements and avoid liability risks.
The integration of the PRRC role into existing processes and QM systems is proving difficult, not least due to a lack of willingness to rethink established structures and a lack of acceptance of the new regulatory requirements.
Further details on the practical implementation of the PRRC role, including custom-made devices, registration obligations in EUDAMED, etc. can be found in the revised guideline MDCG 2019-7 Rev. 1 (2023) “Guidance on Article 15 of the Medical Device Regulation (MDR) and in vitro Diagnostic Device Regulation (IVDR) on a ‘person responsible for regulatory compliance’ (PRRC).
Appointing a competent PRRC is far more than just a legal obligation – properly implemented, the PRRC becomes a driving force for product quality, safety, structure and trust. Companies that clearly define the PRRC role, integrate it sensibly into the company structure and accept the independence of PRRC decisions not only create regulatory certainty, but also lay a strong foundation for product safety and promote a vivid culture of compliance awareness.
Do you have questions about the compliant implementation of PRRC obligations? Do you need a competent external PRRC? Let’s go for clarity together.
