One of the many new requirements to be introduced under the Medical Device Regulation (MDR) is the introduction of the Person Responsible for Regulatory Compliance (PRRC):

“Manufacturers shall have available within their organisation at least one person responsible for regulatory compliance who possesses the requisite expertise in the field of medical devices.[1]”

The MDR permits micro and small enterprises to outsource the PRRC function, provided that the person performing the role is “permanently and continuously at their disposal”.[2]

The MDR sets out the key responsibilities of the PRRC, which include checking the conformity of the devices and the Quality Management System; ensuring compliance with Post-Market Surveillance obligations and reporting obligations; and keeping technical documentation and the declaration of conformity up to date.[3]

The MDR leaves open a number of practical questions. The Medical Device Coordination Group (MDCG) has published some much needed guidance. Sadly, the guidance is not as useful as it could have been.

The guidance is intended to answer the question of where the PRRC can be located. It explains that:

“a close linkage, of a permanent and continuous nature, is established between the PRRC and the manufacturing activities. For this reason, for manufacturers located outside the EU, it must be assumed that the PRRC should also be located outside the EU. On the other hand, for manufacturers located in the EU, it must be assumed that the PRRC should also be located in the EU.”

This guidance introduces a couple of new concepts “a close linkage” and “manufacturing activities”. In the absence of any definition, it is likely that the reference to “manufacturing activity” will be interpreted as a reference to a manufacturing facility, such as a factory. Similarly, the term “close linkage” is likely to be interpreted as requiring physical proximity to a the manufacturing facility. Given that the linkage must be of a “permanent and continuous nature”, this is likely to be interpreted as requiring full time attendance at the manufacturing facility.

Sadly, this approach doesn’t take account of modern logistics and raises a number of issues, best explored through some scenarios:

Scenario 1: US Manufacturer with a UK manufacturing facility

Background

1. Company A is the Manufacturer of a medical device and is established in Texas.
2. The medical device is manufactured at a plant in London.

Issue

The MDCG guidance requires  the PRRC to have a “close linkage” with the “manufacturing activities”. If manufacturing activities refers to the manufacturing plant, this would suggest that the PRRC should be based in London. Sadly, the next sentence of the Guidance appears to contradict that conclusion. Where the Manufacturer is located outside the EU, the MDCG guidance explicitly states that the PRRC should also be located outside the EU (presumably where the Manufacturer is established: in this scenario Texas). The guidance does not provide a means for reconciling this.

Scenario 2: Multi-site manufacturing

Background

1. Company B is the Manufacturer of a medical device and is established in Germany.
2. Physical manufacturing of the product takes place over a series of plants. The components are manufactured in Spain. The device is assembled in France. The device is calibrated in Belgium before the being sterilised and tested in the UK.

Issue

If the term “manufacturing activities” refers to the manufacturing facility and not head office, then we can eliminate the need for a PRRC in Germany (where B is established). However, the MDCG Guidance does not address whether a PRRC is required at all four sites in all four jurisdictions. If not, there is no guidance detailing which site should take priority: i.e. where the “manufacturing activities” take place.

Scenario 3 : Software

Background

1. Company C is the Manufacturer of a medical device based in France.
2. The medical device is standalone software.

Issue

If a Manufacturer is producing medical device software, where would the “manufacturing activities” be deemed to take place? Most of the program’s concepts are developed by C, but the code cutting and compiling is conducted elsewhere (often outsourced to individuals). Could this mean a PRRC would have to have a “close linkage” with a freelance coder?

Personal Liability?

A major issue ignored by the guidance is the potential liability of the PRRC. The current consensus is that this will be addressed by individual Member States in local law. Some commentators contend that the PRRC should have no personal liability (absent fraud by the PRRC), while others argue that the PRRC must be held personally liable.

This is critical for setting up the terms of engagement of the PRRC and in particular the extent of indemnification by the Manufacturer’s for compliance failures.

Conclusion

It would be unfair to say that the MDCG Guidance offered no help. It did clarify that the PRRC for the Manufacturer and the Authorised Representative cannot be the same person. But numerous ambiguities need further clarification. It would also be helpful if consolidated guidance was issued as regards the liability of the PRRC.

[1] Article 15(1) MDR
[2] Article 15(2) MDR
[3] Article 15(3) MDR