PRRC: who can be one and what are their responsibilities?

Article 15 of Regulation (EU) 2017/745 (MDR) and its IVDR equivalent introduced an unprecedented function in the regulatory chain of responsibility: the PRRC — Person Responsible for Regulatory Compliance. Five years after entry into force, the role has become clearer, sometimes painfully so, through inspections, EUDAMED registration refusals and a few disputes.

This guide brings together everything a QA/RA professional needs to know about the PRRC — for themselves, for their employer, or to advise clients.

Who is concerned?

The obligation to designate a PRRC applies to:

• All manufacturers of medical devices or IVDs (except for micro and small enterprises, see below)
• All European authorised representatives (economic operators acting on behalf of a manufacturer established outside the EU)

It does not apply to distributors or importers as such — although these bear their own, distinct obligations.

The case of micro and small enterprises

Article 15.2 provides that micro and small enterprises within the meaning of Recommendation 2003/361/EC (fewer than 50 employees and less than €10M turnover) are not obliged to have an in-house PRRC — they may have permanent and continuous availability of an external PRRC.

In practice, this "permanent availability" is interpreted strictly by most authorities: a formal contract, a regular presence, real authority over compliance matters.

Required qualifications

Article 15.1 requires a combination of diploma + experience. Two routes are open:

Route A — University degree

• University degree or equivalent (at least four years of higher education)
• In law, medicine, pharmacy, engineering or another relevant scientific discipline
• AND at least one year of professional experience in regulatory affairs or quality management systems in the medical device field

Route B — Extended experience

• Four years of professional experience in regulatory affairs or QMS in the medical device field
• With no degree requirement

Important note: for custom-made devices, Article 15.6 provides specific arrangements (two years of experience is sufficient).

"Relevant" disciplines: an extensive interpretation

Beyond law, medicine, pharmacy and engineering, authorities generally accept:

• Life sciences (biology, biochemistry, biotechnology)
• Chemistry, physics
• Biomedical engineering, bioengineering
• Statistics applied to health

Less readily accepted: management, business, marketing — unless combined with complementary regulatory training.

PRRC duties

Article 15.3 lists five duties the PRRC must ensure:

1. Conformity check before batch release

The PRRC checks the conformity of devices with the manufacturer's QMS before release. They act as the final quality filter — their name (or department) formally appears in the release process.

2. Keeping the technical documentation and declaration of conformity

The PRRC ensures that:

• The technical documentation (Annexes II and III of the MDR / IVDR) is drawn up and kept up to date
• The EU declaration of conformity is correctly drafted

3. Compliance with post-market surveillance obligations

The PRRC ensures that:

• The post-market surveillance (PMS) plan is in place
• The periodic reports (PSUR for classes IIa, IIb, III under the MDR; classes C, D under the IVDR) are produced on time
• The data collected is actually analyzed and used

4. Vigilance — incident reporting

The PRRC is responsible for compliance with vigilance obligations (Articles 87 to 92 MDR / 82 to 87 IVDR):

• Reporting of serious incidents within deadlines (15 days, 10 days, 2 days depending on nature)
• Reporting of FSCAs (field safety corrective actions)
• Keeping the PSUR up to date with trend analysis

5. Clinical investigations / performance studies

For devices subject to a clinical investigation (MDR) or a performance study (IVDR), the PRRC ensures the conformity of the statement provided for in Annex XV section 4.1 of the MDR (or its IVDR equivalent).

Legal status: employee, freelance or subcontractor?

The manufacturer's case: internal or external?

The regulation does not explicitly require the PRRC to be an employee. In practice, a large company almost always designates an internal PRRC — to ensure continuity, legal responsibility and operational authority.

For very small and medium enterprises and foreign companies, an external PRRC (consultant) is common, but they must:

• Have a formal contract setting out the scope of duties
• Enjoy real authority — able to block a release, to impose a corrective action
• Be available to authorities during inspections
• Be clearly identified in EUDAMED

The authorised representative's case: necessarily internal

For the authorised representative, the PRRC must be present within the representative's own structure, permanently. A PRRC shared between several authorised representatives is not compliant.

Outsourcing and delegation

Article 15.5 of the MDR sets out a fundamental principle: the PRRC "shall suffer no disadvantage within the manufacturer's organisation in relation to the proper fulfilment of their duties, regardless of whether or not they are employees of the organisation".

In plain terms: the PRRC cannot be sanctioned for having refused to release a non-conforming batch. This is a fundamental protection akin, in principle, to that enjoyed by a statutory auditor.

However, certain operational tasks can be delegated (drafting technical documentation, maintaining a vigilance file) — the PRRC remains responsible for supervision and final validation.

Multiple PRRCs

Article 15.1 says "at least one" PRRC. Several PRRCs may therefore be designated within the same organisation, which is common for:

• Multinational groups (one PRRC per EU subsidiary)
• Organisations covering both MDR and IVDR (often one PRRC for each framework)
• Manufacturers with substantial volume (split by product range)

Registration in EUDAMED

Each PRRC is registered in EUDAMED via the "Actors" module. Registration includes:

• Surname, first name, date of birth
• Professional contact details
• Substantiated degree and experience (document upload)
• Link with the economic operator(s)

Point of vigilance: a change of PRRC must be declared in EUDAMED within one month — many organisations forget this and end up in formal non-compliance.

Penalties and personal risks

While the regulation does not specify personal penalties for the PRRC, several risks exist:

Risks for the manufacturer or authorised representative

• Refusal of registration / EUDAMED suspension
• Refusal or withdrawal of a certificate by the notified body
• National administrative penalties (Article 113 MDR — each Member State sets its own regime)
• Suspension of placing on the market by the competent authority

Risks for the individual

• Civil liability in the event of a characterised breach
• Criminal liability in cases of endangering safety (in France, Article 223-1 of the Criminal Code in extreme cases)
• Disciplinary risks if the PRRC is registered with a professional body (doctors, pharmacists, engineers)

In practice, the criminal risk is very limited as long as the PRRC can document their internal alerts and their action.

How to prepare for the role?

For a QA/RA professional who wishes (or is invited) to take on a PRRC assignment, several prerequisites:

1. Documentary mastery — know Annexes II and III by heart, be able to read a notified body certificate
2. Structured regulatory monitoring — a system that never lets a relevant MDCG, ANSM or EMA publication slip through
3. Peer network — QA/RA professional groups, RAPS, regular exchanges
4. Continuing education — follow developments (MDR amendments, IVDR transition, AI Act…)
5. Management tools — reliable document management and monitoring systems

It is precisely to address points 2 and 5 that MedQara exists — the platform continuously aggregates the critical sources (ANSM, FDA, EMA, MDCG, EUDAMED) and structures alerts according to their impact on your PRRC scope.

Conclusion

The PRRC has become the operational pivot of regulatory compliance. The role requires a rare combination of skills — law, quality, technical, communication. Authorities are increasingly demanding during inspections regarding the availability, real authority and traceability of the PRRC's actions.

The smaller the organisation, the more exposed the PRRC role. Being well equipped, documenting well, and keeping your records — that is what separates an unassailable PRRC from a vulnerable one.

Also read: Understanding the MDR 2017/745 regulation · MDR vs IVDR: essential differences · QARA glossary