Person Responsible for Regulatory Compliance (PRRC)
The Person Responsible for Regulatory Compliance or PRRC is a requirement for all medical device manufactures under Article 15 of the European Medical Device Regulations (MDR) 2017/745 and In Vitro Diagnostic Regulations (IVDR) 2017/746.
The requirement is that a manufacturer must have at their disposal at least one qualified person within the organisation to ensure that they are compliant with the regulations.
There are two options for what a makes for a qualified person.
Option 1:
A diploma, certificate or other evidence of formal qualification, awarded on completion of a university degree or of a course of study recognised as equivalent by the Member State concerned, in law, medicine, pharmacy, engineering or another relevant scientific discipline.
Any qualification acquired outside the EU, including any university diplomas or certificates, should have been recognised by an EU Member State as equivalent to the EU corresponding qualification.
And
At least one year of professional experience in regulatory affairs or in quality management systems relating to medical devices and in vitro diagnostic (the professional experience in regulatory affairs or in Quality Management Systems should be related to the EU requirements in the field.
Option 2:
Four years of professional experience in regulatory affairs or in quality management systems relating to medical devices/ in vitro diagnostic.
Manufacturers
The MDCG 2019-7 explains that “within their organisation” means that the PRRC appointed to larger manufacturers would need to be an employee of the organisation. In cases where an organisation has more than one legal manufacturer under the parent company, it would need to ensure that each legal manufacturer has its own PRRC. In the case of micro and small manufacturers, defined by the Commission Recommendation 2003/361/EC as enterprises which employ fewer than 50 persons and whose annual turnover and/or annual balance sheet total does not exceed 10 million Euros, the PRRC are required to be “permanently and continuously at their disposal” as opposed to “within their organisation”. Therefore, micro and small manufacturers are permitted to designate an external subcontractor as their PRRC.
The MDCG 2019-7 interprets that the micro or small enterprise may subcontract the responsibilities of a PRRC to a third party, as long as the qualification criteria are met, and the manufacturer can demonstrate and document how they can meet their legal obligations. Therefore, in these cases, the PRRC may be part of an external organisation with which the manufacturer has established a contract laying down provisions to ensure the permanent and continuous availability of that party. The contract should also mention the relevant person’s qualifications demonstrating compliance with points a) or b) of Article 15 (1). Each micro and small manufacturer is supposed to evaluate its needs and define in the contract with the subcontracted PRRC how the availability requirements are intended to be met (e.g. two PRRCs or deputies might be needed to cover the availability obligations, or the contract could state to inform the client if the PRRC will be out of contact for more than two business days etc.)
Importers, distributors and other persons acting as manufacturers
Where Article 16 (1) of the Regulations applies, importers, distributors or other natural or legal person assume the obligations incumbent on manufacturers. If it is assumed that the obligations incumbent on manufacturers include Article 15, then these types of organisations are required to designate a PRRC in certain cases. The types of organisations or persons that need to appoint a PRRC include those who do any of the following:
- Make available a device on the market under their own name where there is no other manufacturer identified on the label (Article 16 1a)
- Change the intended purpose of a device already placed on the EU market (Article 16 1b)
- Modify a device which has already been placed on the market to the extent that its compliance with the regulations may be affected (Article 16 1c) In any of these situations the importer, distributor or other person is considered to be a manufacturer and needs to appoint a PRRC.
Systems and Procedure Packs
Companies who put devices together into systems or procedure packs using devices which do not already bear the CE marking, or where the combination of devices is not compatible in view of their original intended purpose, or where sterilization has not been performed in accordance with the manufacturer’s instructions, are the subject of Article 22 (4). Such systems and procedure packs are treated as a medical device in their own right, and therefore such organisations assume the obligations incumbent on manufacturers and are required to designate a PRRC.
Role of the PRRC
The responsibilities of the PRRC within a manufacturer can be associated with 3 main areas of the Quality Management System:
- Product release under the manufacturer’s Quality Management System,
- Compliance of technical documentation and declaration of conformity with regulation requirements
- Post Market Surveillance (PMS)/Vigilance There is also a specific requirement related to compliance of investigational devices and in vitro diagnostic for performance studies.
Checks in proportion to Risk Class
The extent to which the PRRC should be directly involved in the activities for which they are responsible, as opposed to supervising others, is best determined according to the risks presented by a number of factors. In particular, when planning the quality management system in this regard, the following should be taken into consideration:
- the type and risk class of devices concerned. For example, it would seem sensible to require a greater degree of direct involvement of the PRRC for high risk devices than might be necessary for Class I devices where a sampling or auditing approach might be sufficient
- the number of devices or generic device groups to be covered by a PRRC A company with, for example, just a handful of different medical devices may find it easier to require the PRRC to directly sign off every batch for release than a multi-national company with hundreds of different product groups where a supervisory approach using other staff might be more appropriate.
- the number of manufacturing locations in which the manufacturer has premises A manufacturer with sites in several different countries and many different product types may well require a number of PRRCs who perhaps need a section of the QMS all to themselves to describe their activities and reporting requirements. Taking these factors into account should also help a manufacturer to determine how many PRRCs should be appointed to ensure that there is always one, whether internal or external, “permanently and continuously” available.
In addition to making sure that technical files are up to date and updated as needed and drawing up the declaration of conformity the PRRC is responsible for helping the manufacturer with their Post Market Surveillance obligations. This is a legal requirement of all medical devices placed onto the market irrelevant of device classification.
Manufacturers
The MDCG 2019-7 explains that “within their organisation” means that the PRRC appointed to larger manufacturers would need to be an employee of the organisation. In cases where an organisation has more than one legal manufacturer under the parent company, it would need to ensure that each legal manufacturer has its own PRRC. In the case of micro and small manufacturers, defined by the Commission Recommendation 2003/361/EC as enterprises which employ fewer than 50 persons and whose annual turnover and/or annual balance sheet total does not exceed 10 million Euros, the PRRC are required to be “permanently and continuously at their disposal” as opposed to “within their organisation”. Therefore, micro and small manufacturers are permitted to designate an external subcontractor as their PRRC.
The MDCG 2019-7 interprets that the micro or small enterprise may subcontract the responsibilities of a PRRC to a third party, as long as the qualification criteria are met, and the manufacturer can demonstrate and document how they can meet their legal obligations. Therefore, in these cases, the PRRC may be part of an external organisation with which the manufacturer has established a contract laying down provisions to ensure the permanent and continuous availability of that party. The contract should also mention the relevant person’s qualifications demonstrating compliance with points a) or b) of Article 15 (1). Each micro and small manufacturer is supposed to evaluate its needs and define in the contract with the subcontracted PRRC how the availability requirements are intended to be met (e.g. two PRRCs or deputies might be needed to cover the availability obligations, or the contract could state to inform the client if the PRRC will be out of contact for more than two business days etc.)
Importers, distributors and other persons acting as manufacturers
Where Article 16 (1) of the Regulations applies, importers, distributors or other natural or legal person assume the obligations incumbent on manufacturers. If it is assumed that the obligations incumbent on manufacturers include Article 15, then these types of organisations are required to designate a PRRC in certain cases. The types of organisations or persons that need to appoint a PRRC include those who do any of the following:
- Make available a device on the market under their own name where there is no other manufacturer identified on the label (Article 16 1a)
- Change the intended purpose of a device already placed on the EU market (Article 16 1b)
- Modify a device which has already been placed on the market to the extent that its compliance with the regulations may be affected (Article 16 1c) In any of these situations the importer, distributor or other person is considered to be a manufacturer and needs to appoint a PRRC.
Systems and Procedure Packs
Companies who put devices together into systems or procedure packs using devices which do not already bear the CE marking, or where the combination of devices is not compatible in view of their original intended purpose, or where sterilization has not been performed in accordance with the manufacturer’s instructions, are the subject of Article 22 (4). Such systems and procedure packs are treated as a medical device in their own right, and therefore such organisations assume the obligations incumbent on manufacturers and are required to designate a PRRC.
Role of the PRRC
The responsibilities of the PRRC within a manufacturer can be associated with 3 main areas of the Quality Management System:
- Product release under the manufacturer’s Quality Management System,
- Compliance of technical documentation and declaration of conformity with regulation requirements
- Post Market Surveillance (PMS)/Vigilance There is also a specific requirement related to compliance of investigational devices and in vitro diagnostic devices for performance studies.
Checks in proportion to Risk Class
The extent to which the PRRC should be directly involved in the activities for which they are responsible, as opposed to supervising others, is best determined according to the risks presented by a number of factors. In particular, when planning the quality management system in this regard, the following should be taken into consideration:
- the type and risk class of devices concerned. For example, it would seem sensible to require a greater degree of direct involvement of the PRRC for high risk devices than might be necessary for Class I devices where a sampling or auditing approach might be sufficient
- the number of devices or generic device groups to be covered by a PRRC A company with, for example, just a handful of different medical devices may find it easier to require the PRRC to directly sign off every batch for release than a multi-national company with hundreds of different product groups where a supervisory approach using other staff might be more appropriate.
- the number of manufacturing locations in which the manufacturer has premises A manufacturer with sites in several different countries and many different product types may well require a number of PRRCs who perhaps need a section of the QMS all to themselves to describe their activities and reporting requirements. Taking these factors into account should also help a manufacturer to determine how many PRRCs should be appointed to ensure that there is always one, whether internal or external, “permanently and continuously” available.
In addition to making sure that technical files are up to date and updated as needed and drawing up the declaration of conformity the PRRC is responsible for helping the manufacturer with their Post Market Surveillance obligations. This is a legal requirement of all medical devices placed onto the market irrelevant of device classification.
Post Market Surveillance
For each device, manufacturers are required to plan, establish, document, implement, maintain and update a post-market surveillance system in a manner that is proportionate to the risk class and appropriate for the type of device.
The post-market surveillance system needs to gather, record and analyse relevant data on the quality, performance and safety of a device throughout its entire lifetime, and to drawing the necessary conclusions in determining, implementing and monitoring any preventive and corrective actions actively and systematically.
Data generated though the PMS are used for the following:
- to update the benefit-risk determination and to improve the risk management
- to update the design and manufacturing information, the instructions for use and the labelling
- to update the clinical evaluation
- to update the summary of safety and clinical performance
- for the identification of needs for preventive, corrective or field safety corrective action
- for the identification of options to improve the usability, performance and safety of the device
- when relevant, to contribute to the post-market surveillance of other devices; and
- to detect and report trends.
If, in the course of the post-market surveillance, a need for preventive or corrective action or both is identified, the manufacturer shall implement the appropriate measures and inform the competent authorities concerned and, where applicable, the notified body. Where a serious incident is identified or a field safety corrective action is implemented, it shall be reported under vigilance reporting.
PMS Plan
The PMS plan is a document that details how the manufacturer of medical devices will perform post market surveillance and this document sits within the medical device technical file.
PMS Report
Manufacturers of class I devices shall prepare a post-market surveillance report summarising the results and conclusions of the analysis of the post-market surveillance data gathered as a result of the post-market surveillance plan together with a rationale and description of any preventive and corrective actions taken. The report shall be updated when necessary and made available to the competent authority upon request. The reports must be documented within the medical device technical file.
Periodic safety update report
Manufacturers of class IIa, class IIb and class III devices shall prepare a periodic safety update report (PSUR) for each device and where relevant for each category or group of devices summarising the results and conclusions of the analysis of the post-market surveillance data gathered as a result of the post-market surveillance plan together with a rationale and description of any preventive and corrective actions taken. Throughout the lifetime of the device concerned, that PSUR shall set out:
- the conclusions of the benefit-risk determination;
- the main findings of the PMCF; and
- the volume of sales of the device and an estimate evaluation of the size and other characteristics of the population using the device and, where practicable, the usage frequency of the device.
Manufacturers of class IIb and class III devices shall update the PSUR at least annually. Manufacturers of class IIa devices shall update the PSUR when necessary and at least every two years.
The reports must be documented within the medical device technical file.
For class III devices or implantable devices, manufacturers shall submit PSURs to the EUDAMED system to the notified body involved in the conformity assessment. The notified body shall review the report and add its evaluation to EUDAMED with details of any action taken. Such PSURs and the evaluation by the notified body shall be made available to competent authorities through EUDAMED.
For devices other than class III and implantable devices, manufacturers shall make PSURs available to the notified body involved in the conformity assessment and, upon request, to competent authorities.
Vigilance
Manufacturers of devices made available on the Union market, other than investigational devices, shall report, to the relevant competent authorities via the electronic system EUDAMED, to the competent authority of the Member State in which the incident occurred the following:
- any serious incident involving devices made available on the Union market, except expected side-effects which are clearly documented in the product information and quantified in the technical documentation and are subject to trend reporting
- any field safety corrective action in respect of devices made available on the Union market, including any field safety corrective action undertaken in a third country in relation to a device which is also legally made available on the Union market, if the reason for the field safety corrective action is not limited to the device made available in the third country.
As a general rule, the period for the reporting of incidents shall take account of the severity of the serious incident. Manufacturers must report any serious incident immediately after they have established the causal relationship between that incident and their device or that such causal relationship is reasonably possible and not later than 15 days after they become aware of the incident.
In the event of a serious public health threat the report shall be provided immediately, and not later than 2 days after the manufacturer becomes aware of that threat.
In the event of death or an unanticipated serious deterioration in a person’s state of health the report shall be provided immediately after the manufacturer has established or as soon as it suspects a causal relationship between the device and the serious incident but not later than 10 days after the date on which the manufacturer becomes aware of the serious incident.
Where necessary to ensure timely reporting, the manufacturer may submit an initial report that is incomplete followed up by a complete report.
If, after becoming aware of a potentially reportable incident, the manufacturer is uncertain about whether the incident is reportable, it shall nevertheless submit a report within the timeframe required in accordance with the above timelines.
Except in cases of urgency in which the manufacturer needs to undertake field safety corrective action immediately, the manufacturer shall, without undue delay, report the field safety corrective action in advance of the field safety corrective action being undertaken.
For similar serious incidents that occur with the same device or device type and for which the root cause has been identified or a field safety corrective action implemented or where the incidents are common and well documented, the manufacturer may provide periodic summary reports instead of individual serious incident reports, on condition that the coordinating competent authority has agreed with the manufacturer on the format, content and frequency of the periodic summary reporting.
Where the manufacturer of the device concerned considers that the incident is not a serious incident or is an expected undesirable side-effect, which will be covered by trend reporting, it shall provide an explanatory statement. If the competent authority does not agree with the conclusion of the explanatory statement, it may require the manufacturer to provide a report and require it to ensure that appropriate follow-up action is taken.
Trend Reporting
Manufacturers shall report, by means of EUDAMED, any statistically significant increase in the frequency or severity of incidents that are not serious incidents or that are expected undesirable side- effects that could have a significant impact on the benefit-risk analysis and which have led or may lead to risks to the health or safety of patients, users or other persons that are unacceptable when weighed against the intended benefits. The significant increase shall be established in comparison to the foreseeable frequency or severity of such incidents in respect of the device, or category or group of devices, in question during a specific period as specified in the technical documentation and product information.
The manufacturer shall specify how to manage the incidents referred to in the first subparagraph and the methodology used for determining any statistically significant increase in the frequency or severity of such incidents, as well as the observation period, in the post-market surveillance plan
Analysis of serious incidents and field safety corrective actions
Following the reporting of a serious incident via vigilance the manufacturer shall, without delay, perform the necessary investigations in relation to the serious incident and the devices concerned. This shall include a risk assessment of the incident and field safety corrective action.
The manufacturer shall co-operate with the competent authorities and where relevant with the notified body concerned during the investigations referred to in the first subparagraph and shall not perform any investigation which involves altering the device or a sample of the batch concerned in a way which may affect any subsequent evaluation of the causes of the incident, prior to informing the competent authorities of such action.
Upon request by the national competent authority, manufacturers shall provide all documents necessary for the risk assessment.
The manufacturer shall provide a final report to the competent authority setting out its findings from the investigation via EUDAMED. The report shall set out conclusions and where relevant indicate corrective actions to be taken.
The manufacturer shall ensure that information about the field safety corrective action taken is brought without delay to the attention of users of the device in question by means of a field safety notice.
Field Safety Notice
The field safety notice shall be edited in an official Union language or languages determined by the Member State in which the field safety corrective action is taken. Except in cases of urgency, the content of the draft field safety notice shall be submitted to the evaluating competent authority or to the coordinating competent authority to allow it to make comments. Unless duly justified by the situation of the individual Member State.
The field safety notice shall allow the correct identification of the device or devices involved, in particular by including the relevant UDIs (Unique Device Identifiers), and the correct identification, in particular, by including the SRN (Single Registration Number), if already issued, of the manufacturer that has undertaken the field safety corrective action.
The field safety notice shall explain, in a clear manner, without understating the level of risk, the reasons for the field safety corrective action with reference to the device malfunction and associated risks for patients, users or other persons, and shall clearly indicate all the actions to be taken by users.
The manufacturer must enter the field safety notice in EUDAMED through which that notice shall be accessible to the public.
How can Patient Guard help?
Our team of consultants are all qualified with relevant degrees accepted by the European Union and have at least 2 years’ experience within Quality Assurance and Regulatory Affairs.
As we are a team of consultants we have the availability to be permanently at your disposal for all relevant PRRC requirements your organisation requires.
If you are a micro or small sized company with less then 50 employees and an annual turn over or balance sheet of less than 10 million euros then outsourcing this service will be cheaper for you than employing someone internally.
Our combined experience in medical devices give us a much broader knowledge depth than employing a single person.
Our services are tailored based on the level of work needed to carry out PRRC activities.
If you require a PRRC and sell CE marked medical devices then please contact us today for a free consultation on your needs.
