Your Questions Answered: Understanding the role of Person Responsible for Regulatory Compliance

At MedTech Digital Week 2021 (8 March 2021), TEAM-PRRC EU Association President Elem Ayne and Vice-President Anne Jury hosted a session on the role of Person Responsible for Regulatory Compliance (PRRC). The session featured a lengthy Q&A at the end, with dozens of questions from the audience, which we have gathered together here.

The regulation states "the person responsible for regulatory compliance shall suffer no disadvantage within the organization." What does this mean?

Anne Jury: "Suffer no disadvantage" is the term used in Article 15, Paragraph 5, and it's the one that refers to a point that the employer must address, which is that the PRRC, mainly, in practical terms, should not be penalized in any way for preventing a product from going onto the market.

We all know that when things go wrong, sometimes it can hold up a batch of product or, in the worst case, you need to recall it from the marketplace. And those are always rather loaded and difficult situations to find yourself in if you're the person saying it is necessary. You shouldn't be prevented from doing that in any way.

I have a company with 51 employees and a turnover of €10 million. Can I outsource the person responsible for regulatory compliance?

Elem Ayne: The answer is no, because if the company has more than 50 employees and more than €10 million turnover, the manufacturer cannot outsource the function. In this case, it has to employ a PRRC within its organization.

With supervision and control, could the person responsible for regulatory compliance be the quality manager (for example in a small company with one person as quality assurance/regulatory affairs)? Is it okay to control and supervise your own work?

AJ: First of all, we must make sure that we meet the requirements for qualification as a PRRC. So you need to have that diploma or certificate plus one year of experience in regulatory affairs or quality systems or four years of experience in those areas. But if you meet those, then the second part of the question is can you effectively mark your own work? Yes, the regulation does not prevent that. And it's a good question because we've debated it quite a lot, and obviously, you might be more comfortable to have someone else having a look, but it's not always possible, and the regulation certainly does not prevent you from doing that.

Should a manufacturer outside of Europe have a person responsible for regulatory compliance on the manufacturing site to sign off the EU declaration of conformity, or should the EU authorized rep, PRRC, sign the EU doc?

EA: The PRRC of the authorized representative cannot sign any declaration of conformity. It's under the responsibility of the manufacturer and it's the manufacturer that has to sign the declaration of conformity.

The PRRC can co-sign the declaration of conformity, but we don't recommend that the PRRC signs by itself because it's under the responsibility of the manufacturer.

AJ: You're not prevented from signing the declaration of conformity as a PRRC, and some will argue that that's a good idea because you really need to understand all the detail of all the technical documentation to do that. So it puts you in a good position to know about the entire compliance of the company. But that's even above and beyond what is required in the regulation of a PRRC. And as Elem said, the authorized rep cannot sign a declaration of conformity for a manufacturer.

Is it possible that the PRRC of an EU legal manufacturer, on a German site for example, also acts as PRRC for the EU rep, at the same German site of a non-EU manufacturer, for example in the US?

AJ: If we're talking about different legal entities, then a PRRC can potentially be PRRC for two different legal entities, except where they are manufacturer and authorized rep for the same manufacturer. So if I understand the question correctly, that person could be PRRC for a completely different company, yes. But we need to make sure this thing about being continuously and permanently available is part of the wording in the Article 15. It means that you mustn't take on too much. You have to be able to show that you are capable of performing all those tasks for as many companies as you take it on. And this is a question coming up for those who wish to operate as PRRCs of the external subcontractors for manufacturers.

I think, and we discussed this just last week actually, that the Notified Bodies will take a dim view if they find a PRRC who is externally contracted to a hundred different manufacturers. They may potentially argue that it's not possible to be continuously and permanently available to a hundred companies.

Should requirements to PRRC background differ depending on the type of medical device, e.g. surgical instrument versus software versus chemical product?

AJ: That's a good question. The regulation says a 'quality management system relating to medical devices'. This is one of those areas we're seeking additional guidance on, but it does make sense that your relevant experience is relevant. How far you need to go in demonstrating that is another matter. So, yes, I think it would be hard to say that you have relevant experience if you've not had any involvement in the technology for the company that you're representing as PRRC. This goes back to what I said about the manufacturer needing to have a policy on how they recruit for this.

We can say that there is a variation for the custom-made medical devices. If you are a manufacturer of custom-made medical devices, you need to have at least two years of professional experience in a relevant background, specific to custom-made medical devices. But it really depends on the Notified Body, as if the Notified Body audits the background of the PRRC, they will try to understand if they're in a good place or not.

Can the PRRC be designated but the authority be further delegated to others if documented?

AJ: That's a good one. Yes, within the quality system, you can have more than one. So that's clear. Article 15 says you shall appoint at least one. If you have several, we discussed this as well recently, do you therefore have to have a head PRRC? Yes, you have to have some kind of a hierarchy in mind. But I think if you're performing any of those tasks mentioned in paragraph three as an authorized rep, the person needs to be designated as a PRRC. We don't think you can delegate the authority.

What if the PRRC uses an independent contractor working from home? Does he or she need to display their private home address to the public?

EA: I would say it's better to. I would just say that maybe if they are an external consultant, so an independent consultant, and they are designated as a PRRC, and if they work from his home, they have no choice to share their personal address.

So it's always better to share a professional contact address and phone number.

Is the PRRC mandatory even for legacy devices?

AJ: All the regulation applies to legacy devices, and there are no exceptions. So a PRRC does need to be appointed by the date of application, which is, of course, 26 May this year (2021).

Is PRRC appointment mandatory also if a company decides not to apply for MDR certification until 2024?

EA: If it's a medical device which has a class of risk for which you need to do an investigational trial, you have to appoint a PRRC for sure. But if it's for devices which don't need an investigational trial and if the devices don't have a CE mark, you don't need to appoint a PRRC. I want to be very clear that there is no transitional period to appoint a PRRC, so if the devices already have a CE mark, as I said, the manufacturers have no transitional period and have to appoint a PRRC by 26 May 2021.

Can manufacturers from outside of Europe, can they now register actors - for example manufacturer, PRRC, importer, distributor, and authorized representative - in EUDAMED?

AJ: Yes, I believe so. The module for just that, for the registration of the economic operator as they're called, the collective term for all of them, that has been up and working and available since the beginning of December last year. So you can do that now on a voluntary basis. But for MDR, you have to do it by 26 May this year, and for IVDR, 26 May 2021.

What about an insurance for the role of PRRC? Is it needed? Should the PRRC ask their company for liability insurance?

AJ: Liability is a question that we are tossing around at Team PRRC a lot. We have spoken to a number of different lawyers in different countries, and they all have a different opinion on this. So it's difficult to give a definitive answer. My feeling is I'm a consultant. I work with a number of start-up companies in the UK who all want to sell into Europe, into the EU, so I'm looking at that question for myself. Of course, as a regulatory consultant in the field, I have professional indemnity insurance already because I'm making recommendations and giving advice on issues of compliance and have been all along. So it doesn't seem that alien to me to ask for my professional indemnity insurance to cover this aspect of the role as well.

So if you are an employee within a company, then I understand that you should be covered by the company's own indemnity insurance. But I'm not an expert in this field, and we are hoping to be able to address this more definitively in our position paper very soon. So watch this space for more details on that, and I'm sure there will be a lot more discussion on it yet.

EA: Anne talked about consultants, but if you are an employee of a manufacturer, for example, you should be covered by the insurance of the company.​