PRRC
Summary
Every manufacturer of medical devices needs a person responsible for regulatory compliance according to Article 15 of the MDR or IVDR.
Different legal tasks and qualification requirements for the PRRC are defined, which must be demonstrated.
The PRRC is responsible for ensuring that various tasks are carried out, but does not necessarily have to perform them personally. To fulfill this responsibility, this new role must be implemented in the relevant processes of a quality management system.
The liability for responsible persons employed by the company is limited through internal damage compensation. It is possible to take out insurance for the PRRC’s activities regarding slight and moderate negligence. A liability exclusion in the employment contract can protect the employee.
For external providers who take on the tasks from Article 15 of the MDR, appropriate contractual arrangements should be made. Service providers should in any case take out insurance, including for negligence.
We provide an external responsible person as part of the PRRC service.
We train your employees so that they can competently perform the role of PRRC.
We advise you on topics related to the Responsible Person and their integration into your QMS.
Table of Contents
The Responsible Person - PRRC
The MDR and IVDR are causing many changes in medical technology. The focus of both regulations is clear: patient safety! This results in the influences on technical documentation, adjustments to the quality management system, and the associated, sometimes enormous, workloads that have already been extensively discussed in the industry.
But have you already considered the impact these regulations have on various responsibilities?
Economic operators, i.e., manufacturers, authorized representatives, importers, distributors, and manufacturers of systems and treatment units, now have a clear framework that defines responsibilities. This also applies to healthcare institutions that manufacture and use products themselves.
One aspect of these clearly regulated responsibilities is the person according to Article 15 – Also referred to as the Person Responsible For Regulatory Compliance (PRRC); or Qualified Person.
Every manufacturer needs such a person. Depending on the size of the organization, either internally or externally. But it’s important that organizations have permanent and constant access to such a person.
Why is a PRRC Necessary?
Medical technology is a regulated environment. To navigate it safely and in compliance with requirements, a certain expertise is necessary. Since many companies lack this specific expertise, they are sometimes unable to meet the special requirements of medical technology.
The qualification and competence of employed personnel are important pillars for enabling a functioning company and safe products. These requirements are already known in the industry from standards such as ISO 13485. The European Commission has now improved at the level of EU regulations in this sense and summarized some important tasks and necessary qualifications in the role of the PRRC.
In Germany, the safety officer was already known, who is relevant in the context of reporting incidents.
What are the Tasks of the PRRC?
- Responsibility for ensuring that the conformity of products is appropriately checked according to the quality management system before a product is released.
- Responsibility for ensuring that the technical documentation and the EU declaration of conformity are drawn up and kept up to date.
- Responsibility for ensuring that post-market surveillance obligations are met.
- Responsibility for ensuring that reporting obligations are met.
- Responsibility for ensuring that the certificate according to Annex XV Chapter II Section 4.1 of the MDR is issued for investigational products.
An overview of implementation possibilities and deadlines is shown in the following graphic. Click on it to enlarge (displayed as PDF).
What is the PRRC Liable for?
Neither the MDR nor the IVDR contain regulations on the personal liability of the PRRC. They also do not contain any criminal or administrative offense provisions against the PRRC. The MDCG 2019-7 guideline (Guidance on Article 15 of the Medical Device Regulation (MDR) and in vitro Diagnostic Device Regulation (IVDR) regarding a “person responsible for regulatory compliance” (PRRC)) also does not provide any further clarification on the liability of the PRRC.
The same applies to the German Medical Device Implementation Act (MPDG), which applies from the time the MDR comes into force. This also does not contain any personal liability, criminal, or administrative offense elements of the PRRC.
However, the MPDG regulates in § 94 para. 3 no. 5 and 6 MPDG administrative offenses to the detriment of the manufacturer (and the authorized representative), which can be punished with a fine of up to 30,000 €, for cases where it is not ensured,
- that a PRRC is present in their organization,
- who has the required expertise and
- has also demonstrated this expertise
- or that a PRRC can be accessed permanently and constantly.
In the following, we would like to outline the civil liability of the PRRC in general terms. Any potential criminal liability of the PRRC is not assessed here.
Contractual Relationships
The Responsible Person can be available in different contractual relationships. When the role is filled internally, it is usually a regular employee. When the role is filled externally, it is usually a service provider or consultant.
But can the PRRC also be employed on a mini-job basis?
Case 1: PRRC is Permanently Employed
Basically, manufacturers must have at least one PRRC in their organization. This means that the PRRC must be a (permanently employed) employee of the manufacturer. For these internal PRRCs, they are thus employees of the manufacturer.
Employees – and thus the internal PRRC – can be personally liable for damages that arise both within the company and in external relationships.
However, the principles of employee liability allow for a limitation of liability in the internal relationship (so-called employee liability privilege or internal company damage compensation). This depends on what type of fault can be attributed to the employed PRRC and that the damage was caused in the performance of company activities.
Roughly speaking, this means that the PRRC is generally not personally liable in cases of simple negligence. Rather, the employer must then bear the damage. In cases of gross negligence, the manufacturer can take recourse against its employee, but liability relief is possible here. In cases of intent, the PRRC must fully bear the damage.
In external relationships (towards third parties outside the company), the employee, i.e., the PRRC, continues to be liable themselves.
Moreover, what is essential here is what was agreed in the employment contract. Thus, a limitation of liability or an indemnification agreement can be included in the employment contract with the PRRC. It is also recommended to take out insurance for the employee. Usually, slight and moderate negligence is insurable.
Case 2: PRRC is an External Service Provider
Only manufacturers that are classified as micro or small enterprises are allowed to rely on an external PRRC. They are not obliged to have an internal PRRC available in their organization. This includes companies that employ fewer than 50 people and whose annual turnover or annual balance sheet does not exceed €10 million (cf. Commission Recommendation 2003/361/EC of 6 May 2003 concerning the definition of micro, small and medium-sized enterprises). The same applies to authorized representatives; they can also engage an external PRRC.
These exceptions apply on the condition that the PRRC meets the qualification criteria and is permanently and constantly available to the company, and these requirements are contractually stipulated.
Regarding the liability of the external PRRC, it generally applies that primarily the one who caused the damage is fully responsible for it. The damage incurred must be based on fault (a reproachable error) of the PRRC, and this fault must also be causal for the damage. In other words: Damage must have occurred that was caused by misconduct of the PRRC that can be attributed to the PRRC. The principles of employee liability privilege or internal company damage compensation do not apply here.
What is essential is what the parties regulate in the underlying contract. Effective limitations of liability and indemnification agreements for the PRRC can be agreed upon here. In addition, taking out insurance for the external PRRC is strongly recommended.
If you are interested in our PRRC Service, please feel free to contact us directly.
Case 3: PRRC on a Mini-Job Basis
Since organizations must be able to access the PRRC permanently and constantly, it is already questionable whether a PRRC in the context of an employment relationship on a mini-job basis can meet the legal requirements at all.
Neither the MDR/IVDR nor the MDCG 2019-7 guideline provide details or explanations on the requirement that an outsourced PRRC must be permanently and constantly available or how this can be ensured. Therefore, it is recommended that manufacturers and authorized representatives interpret this requirement conservatively, and that their external PRRC is available around the clock and has an official representation during absences. The contractual agreement with the PRRC should specify details on permanent and constant availability, as well as include the qualification of the person concerned.
Regarding liability, the explanations in relation to Case 1 apply equally, even in the context of a mini-job.
