The PRRC Under EU MDR Article 15: Who Qualifies and What They Are Responsible For

Among the obligations the EU Medical Device Regulation places on manufacturers, Article 15 is unusual: it does not regulate a product or a process, it regulates a person. Every manufacturer must have at least one Person Responsible for Regulatory Compliance — the PRRC — and the Regulation sets out who is eligible to hold the role, what they are answerable for, and the protection they are owed for doing it properly.

That makes it one of a small family of mandated appointments across regulated sectors where the individual, not just the organisation, carries defined statutory duties. The same structure appears in legal practice, where the SRA requires every firm to appoint a COLP and a COFA with named responsibilities attaching to the role-holder.

The two qualification routes

Article 15(1) gives two alternative paths, and a candidate needs only one of them.

Route A — qualification plus a year. A diploma, certificate or other evidence of formal qualification awarded on completion of a university degree or a course of study recognised as equivalent, in law, medicine, pharmacy, engineering or another relevant scientific discipline, plus at least one year of professional experience in regulatory affairs or in quality management systems relating to medical devices.

Route B — four years’ experience. Four years of professional experience in regulatory affairs or in quality management systems relating to medical devices, with no degree requirement.

Route B matters commercially, because it means the role is reachable by experienced quality and regulatory staff who came up through industry rather than through a relevant degree. It is the reason PRRC capability is often developed internally rather than recruited.

Custom-made devices. Manufacturers of custom-made devices may instead demonstrate at least two years of professional experience in a relevant field of manufacturing — without prejudice to national provisions on professional qualifications.

The five statutory duties

Article 15(3) sets out what the PRRC must ensure, and the wording is “at least” these things — an organisation can give the role more, but not less:

1. Conformity before release. That the conformity of devices is appropriately checked, in accordance with the quality management system, before a device is released.
2. Technical documentation and the EU declaration of conformity. That both are drawn up and kept up to date — the maintenance obligation is as much part of the duty as the original drafting.
3. Post-market surveillance. That the post-market surveillance obligations under Article 10(10) are complied with.
4. Vigilance reporting. That the reporting obligations in Articles 87 to 91 are fulfilled.
5. Investigational devices. That, in the case of investigational devices, the statement referred to in Section 4.1 of Chapter II of Annex XV is issued.

Read together, these put the PRRC at the gate on release, on documentation currency, on what happens after the device is on the market, and on what gets reported when something goes wrong. It is a continuing operational role rather than a sign-off at the end of a project.

Micro and small enterprises: available, not necessarily employed

Article 15(2) recognises that a small manufacturer may not be able to carry the role in-house. Micro and small enterprises are not required to have a PRRC within their organisation, but they must have one permanently and continuously at their disposal.

Two points follow. First, “permanently and continuously” is a meaningful standard — an arrangement that produces someone on request during a project is not obviously the same as continuous availability. Second, this is what creates the market for outsourced and consultant PRRCs, which is a legitimate route rather than a workaround.

The size thresholds come from Commission Recommendation 2003/361/EC, under which a small enterprise has fewer than 50 employees and a turnover or balance sheet total not exceeding €10 million.

Authorised representatives need one too

Article 15(6) extends the requirement: an authorised representative must have at least one PRRC permanently and continuously at their disposal, with expertise in the EU regulatory requirements for medical devices, demonstrated through the same two qualification routes that apply to manufacturers.

For non-EU manufacturers placing devices on the EU market through an authorised representative, that means two PRRCs are in the picture, not one.

The protection clause, and why it matters

Article 15(5) states that the PRRC shall suffer no disadvantage within the manufacturer’s organisation in relation to the proper fulfilment of their duties — and this applies whether or not they are an employee.

This is the clause that gives the role its substance. A person who can be overruled or penalised for refusing to release a device is not performing the Article 15 function. In practice it has organisational consequences: reporting lines that put the PRRC under commercial pressure, or contractual arrangements with an outsourced PRRC that allow termination for an inconvenient decision, sit awkwardly against 15(5).

What this means for workforce planning

Three practical implications for manufacturers and for anyone building a career toward the role.

The four-year route is a development pathway, not a loophole. It means a quality or regulatory specialist can become eligible through experience alone, which makes internal succession planning realistic — and makes it worth tracking who is accumulating qualifying experience.

Deputy capability is a gap worth closing. The Regulation requires at least one PRRC. It does not require a second, but a single point of failure on release authorisation, documentation currency and vigilance reporting is an operational risk independent of compliance.

The duties assume current knowledge. Keeping technical documentation and the declaration of conformity up to date, and meeting vigilance obligations correctly, both depend on tracking regulatory change. That is a continuing professional development requirement in substance even where no CPD scheme mandates it — unlike, for example, medical scientists in Ireland, who carry a formal CORU obligation of 30 credits every 12 months.

How it sits alongside GMP and other quality obligations

Manufacturers operating under both device and medicinal-product frameworks will recognise the pattern. EU GMP takes a comparable approach to competence: Chapter 2 requires continuing training whose practical effectiveness is periodically assessed, and names the role-holders who must approve the training programme. In both regimes the regulator is interested in who is accountable and whether they are genuinely competent, not simply whether a procedure exists.

Where software is the device, the classification and compliance questions become more involved; our guide to AI software as a medical device under the MHRA framework covers that angle from the user’s perspective. And for organisations whose quality obligations run across clinical and manufacturing settings, our guide to infection prevention and control compliance covers the equivalent where the regulator is the CQC.

Frequently asked questions

Does every medical device manufacturer need a PRRC?

Yes. Article 15(1) requires manufacturers to have at least one person responsible for regulatory compliance. Micro and small enterprises are exempt from having one within the organisation but must have one permanently and continuously at their disposal.

Can the PRRC be a consultant rather than an employee?

Yes, and for micro and small enterprises that is the expected arrangement. Note that the no-disadvantage protection in Article 15(5) applies whether or not the PRRC is an employee, which has implications for how an outsourcing contract is written.

Do I need a degree to be a PRRC?

No. Article 15(1)(b) allows four years of professional experience in regulatory affairs or in medical device quality management systems, with no formal qualification requirement. The degree route under 15(1)(a) requires only one year of such experience alongside it.

Which degrees count?

Law, medicine, pharmacy, engineering, or another relevant scientific discipline — evidenced by a diploma, certificate or other formal qualification from a university degree or a course of study recognised as equivalent.

Can one person be PRRC for more than one organisation?

The Regulation does not prohibit it, and consultant PRRCs commonly serve several small manufacturers. The practical limit is the “permanently and continuously at their disposal” standard, which has to be met for each one.

What happens if the PRRC and management disagree about a release?

Article 15(5) is the relevant provision: the PRRC must suffer no disadvantage in relation to the proper fulfilment of their duties. A structure in which the PRRC can be overridden or penalised for a properly reasoned refusal does not sit comfortably with that.

Is the role the same under the IVDR?

The In Vitro Diagnostic Regulation contains an equivalent requirement for in vitro diagnostic devices. The qualification structure is comparable, but check the IVDR text directly rather than assuming the provisions are identical.

This guide is a general explainer on Article 15 of Regulation (EU) 2017/745 and is not regulatory or legal advice. Work from the current text of the Regulation and your national competent authority’s guidance when determining your own obligations.