Article 15(2) MDR: under 50 employees no in-house PRRC, but one "permanently and continuously"

Key takeaways

• Article 15(1) MDR: "Manufacturers shall have available within their organisation at least one person responsible for regulatory compliance who possesses the requisite expertise in the field of medical devices." The expertise is demonstrated by a university degree plus one year of professional experience, or by four years of professional experience.
• Article 15(2) MDR: "Micro and small enterprises within the meaning of Commission Recommendation 2003/361/EC shall not be required to have the person responsible for regulatory compliance within their organisation but shall have such person permanently and continuously at their disposal."
• Under Article 2(2) of the Annex to Recommendation 2003/361/EC, a small enterprise is one "which employs fewer than 50 persons and whose annual turnover and/or annual balance sheet total does not exceed EUR 10 million". The 50th employee ends the exemption.
• Article 15(3) MDR lists what the person is at least responsible for: conformity checks before release, technical documentation and the EU declaration of conformity, post-market surveillance, and the reporting obligations under Articles 87 to 91.
• Article 15(5) MDR protects the person from disadvantage "regardless of whether or not they are employees of the organisation"; paragraph 4 requires the areas of responsibility to be stipulated in writing where several persons share them.
• The PRRC is the manufacturer's person. The Beauftragter für Medizinproduktesicherheit under section 6 MPBetreibV is the person of the healthcare institution as operator. Neither discharges the other's duty.

A duty that changes shape at the 50-employee threshold

Most appointment duties in German law have a threshold above which someone must be appointed. Article 15 of Regulation (EU) 2017/745 on medical devices, the MDR, is built differently: the duty applies to every manufacturer from day one, but its form depends on size. Below the threshold, secured access to a person is enough; above it, the person must be within the organisation. For a manufacturer growing from 40 to 60 employees, what changes is therefore not whether it needs a person responsible for regulatory compliance, but where that person sits.

This article reads the provision in the consolidated version of 10 January 2025 as published by the Publications Office; apart from a corrigendum, Article 15 has not changed since the original 2017 text. Regulation (EU) 2017/746 on in vitro diagnostic medical devices contains an identically worded rule in its Article 15.

Paragraph 1: the person and the requisite expertise

The first subparagraph of Article 15(1) MDR reads: "Manufacturers shall have available within their organisation at least one person responsible for regulatory compliance who possesses the requisite expertise in the field of medical devices. The requisite expertise shall be demonstrated by either of the following qualifications: (a) a diploma, certificate or other evidence of formal qualification, awarded on completion of a university degree or of a course of study recognised as equivalent by the Member State concerned, in law, medicine, pharmacy, engineering or another relevant scientific discipline, and at least one year of professional experience in regulatory affairs or in quality management systems relating to medical devices; (b) four years of professional experience in regulatory affairs or in quality management systems relating to medical devices." For manufacturers of custom-made devices, the second subparagraph accepts "at least two years of professional experience within a relevant field of manufacturing".

The market has settled on the abbreviation PRRC; the Regulation itself does not use it. Two points stand out in the wording. First, the expertise is not tied to a specific degree but to a degree in "another relevant scientific discipline" plus one year of experience, or to four years of experience without a degree. Second, the experience is not any experience: it must have been gained "in regulatory affairs or in quality management systems relating to medical devices". A quality manager from mechanical engineering brings four years of experience, but not the years the provision asks for.

Paragraph 2: an exemption that is not a release

Article 15(2) MDR reads: "Micro and small enterprises within the meaning of Commission Recommendation 2003/361/EC shall not be required to have the person responsible for regulatory compliance within their organisation but shall have such person permanently and continuously at their disposal." The sentence has two halves, and the second is the obligation. What falls away is employment within the manufacturer's own organisation. What remains is the person with the expertise under paragraph 1 and the tasks under paragraph 3, whom the enterprise must have "permanently and continuously at their disposal". A consultancy agreement that runs on call and subject to availability does not satisfy "continuously"; an agreement that ends next year does not satisfy "permanently".

Who counts as small is defined by Commission Recommendation 2003/361/EC of 6 May 2003. Article 2 of its Annex provides in paragraph 2: "Within the SME category, a small enterprise is defined as an enterprise which employs fewer than 50 persons and whose annual turnover and/or annual balance sheet total does not exceed EUR 10 million." Paragraph 3: "Within the SME category, a microenterprise is defined as an enterprise which employs fewer than 10 persons and whose annual turnover and/or annual balance sheet total does not exceed EUR 2 million." The headcount criterion is mandatory; of the two financial ceilings, meeting one is enough. A manufacturer with 35 employees whose turnover and balance sheet total both exceed EUR 10 million is no longer a small enterprise and needs the person within its organisation. Article 3 of the Annex additionally counts partner enterprises and linked enterprises; the subsidiary of a group with 30 employees of its own is therefore usually not a small enterprise within the meaning of the Recommendation.

Paragraph 3: what the person is at least responsible for

Article 15(3) MDR reads: "The person responsible for regulatory compliance shall at least be responsible for ensuring that: (a) the conformity of the devices is appropriately checked, in accordance with the quality management system under which the devices are manufactured, before a device is released; (b) the technical documentation and the EU declaration of conformity are drawn up and kept up-to-date; (c) the post-market surveillance obligations are complied with in accordance with Article 10(10); (d) the reporting obligations referred to in Articles 87 to 91 are fulfilled; (e) in the case of investigational devices, the statement referred to in Section 4.1 of Chapter II of Annex XV is issued."

The words "at least" are the yardstick for any agreement with an external person. These five tasks are not optional extras; they are the person's responsibility. An agreement that engages the external PRRC only for the technical documentation and leaves the vigilance reporting under Articles 87 to 91 with the manufacturer does not reflect paragraph 3. And the release under point (a) is an ongoing process, not an annual one: a manufacturer that releases every batch or every software version needs the person at every release, and that is the practical content of "continuously".

Paragraphs 4 and 5: several persons, protection from disadvantage

Article 15(4) MDR: "If a number of persons are jointly responsible for regulatory compliance in accordance with paragraphs 1, 2 and 3, their respective areas of responsibility shall be stipulated in writing." For a small manufacturer that employs an internal quality lead without the qualification under paragraph 1 and engages an external qualified person alongside, this is the operative rule: the split of the five tasks under paragraph 3 must exist in writing, otherwise it is unclear who is responsible for which.

Article 15(5) MDR: "The person responsible for regulatory compliance shall suffer no disadvantage within the manufacturer's organisation in relation to the proper fulfilment of his or her duties, regardless of whether or not they are employees of the organisation." The closing clause is the bridge to paragraph 2: the external person is under this protection too. An agreement that can be terminated because the person refused a release runs against the purpose of the provision.

Distinction: the manufacturer's person and the operator's person

In German usage two functions with different addressees are regularly confused. The PRRC under Article 15 MDR is the manufacturer's person. The Beauftragter für Medizinproduktesicherheit under section 6(1) of the German Medical Devices Operator Ordinance (MPBetreibV) is the operator's person: healthcare institutions with regularly more than 20 employees must ensure that a competent and reliable person with medical, scientific, nursing, pharmaceutical or technical training is designated as medical device safety officer. A hospital needs the second, a manufacturer the first, and a manufacturer that also applies its devices to patients may need both. The thresholds differ, 20 employees of the healthcare institution on one side, 50 employees and EUR 10 million of the manufacturer on the other, and the tasks do not overlap.

What the wording means for a manufacturer with 20 to 200 employees

Three checks follow directly. First, classification under Recommendation 2003/361/EC, with headcount, turnover or balance sheet total and the links under Article 3 of the Annex. Second, below the threshold, the agreement with the external person: it evidences the qualification under paragraph 1, names all five tasks under paragraph 3, governs availability so that "permanently and continuously" is met, and protects the person under paragraph 5. Third, above the threshold, the transition: a manufacturer that crosses the threshold with the next financial year needs the person within its organisation, and filling that position usually takes longer than a quarter.

In CIVAC the person under Article 15 MDR can be kept as a role with evidence of qualification, the allocation of tasks under paragraph 3 and a deputy, the classification under Recommendation 2003/361/EC can be resubmitted annually as a task with the three figures, and the written allocation under paragraph 4 can be filed as a document against the role. This topic may in future receive its own role page on civac.de; this article is the reading of the wording, not the permanent home for the subject.

Where this article stops

CIVAC is not a law firm and does not provide legal services within the meaning of the German Legal Services Act (Rechtsdienstleistungsgesetz). This article reproduces the wording of Article 15 of Regulation (EU) 2017/745, Article 2 of the Annex to Recommendation 2003/361/EC and section 6(1) MPBetreibV. Whether a specific enterprise, taking its links into account, is a small enterprise within the meaning of the Recommendation, whether a specific professional history meets paragraph 1, and whether a specific contractual arrangement satisfies "permanently and continuously" is not decided by this text but by the manufacturer towards its notified body and the competent authority.

Frequently asked questions

Does a medical device manufacturer with 30 employees have to employ a PRRC?

Not employ, but have available. Article 15(2) MDR exempts micro and small enterprises within the meaning of Recommendation 2003/361/EC from having the person within their own organisation, but requires that they "have such person permanently and continuously at their disposal". Small is an enterprise which employs fewer than 50 persons and whose annual turnover and/or annual balance sheet total does not exceed EUR 10 million, counting partner and linked enterprises.

What qualification must the PRRC demonstrate?

Under Article 15(1) MDR, either a university degree in law, medicine, pharmacy, engineering or another relevant scientific discipline plus at least one year of professional experience in regulatory affairs or in quality management systems relating to medical devices, or four years of such professional experience. Manufacturers of custom-made devices may demonstrate the expertise by at least two years of professional experience within a relevant field of manufacturing.

What is the PRRC at least responsible for?

Article 15(3) MDR names five tasks: checking the conformity of the devices in accordance with the quality management system before release, drawing up and keeping up to date the technical documentation and the EU declaration of conformity, post-market surveillance in accordance with Article 10(10), the reporting obligations under Articles 87 to 91 and, for investigational devices, the statement under Section 4.1 of Chapter II of Annex XV. Where several persons share these, paragraph 4 requires their areas of responsibility to be stipulated in writing.

Is the PRRC the same as the Beauftragter für Medizinproduktesicherheit?

No. The PRRC under Article 15 MDR is the manufacturer's person. The Beauftragter für Medizinproduktesicherheit under section 6(1) MPBetreibV is the operator's person, whom healthcare institutions with regularly more than 20 employees must designate. The two functions have different addressees, different thresholds and different tasks.

What happens when the manufacturer crosses the 50-employee threshold?

It is then no longer a small enterprise within the meaning of Recommendation 2003/361/EC, and Article 15(1) MDR applies without the relief in paragraph 2: the person must be within the manufacturer's organisation. The same applies where annual turnover and annual balance sheet total both exceed EUR 10 million, even with fewer than 50 employees. The Recommendation refers to the data of the latest approved accounting period.