Person Responsible for Regulatory Compliance
Article 15 of both MDR and IVDR require manufacturers and authorized representatives to appoint a Person Responsible for Regulatory Compliance (PRRC). MDCG Guidance 2019-7 provides guidance (be aware that this guidance is under review and we may see a new version in Q4 of 2022). Appointing the right person for that task appears to be challenging. This tip of the week helps companies with this task. This will be presented in the form of some tests. Passing these tests will help to qualify as a PRRC and then it is up to management to select the best candidate. As a spoiler alert: selecting a PRRC should not be mistaken by a popularity contest.
PRRC qualifications and requirements
There is some confusion regarding the exact qualifications required in the Regulations and how the MDCG interprets that. Your first test for the qualifications of your PRRC would be to see if they manage to figure out if they would qualify and how this should be justified. Article 15(1)(a) states that qualifications of the PRRC may consist of: “…a diploma, certificate or other evidence of formal qualification, awarded on completion of a university degree or of a course of study recognised as equivalent by the Member State concerned, in law, medicine, pharmacy, engineering or another relevant scientific discipline, and at least one year of professional experience in regulatory affairs or in [relevant] quality management systems…” The MDCG interprets this as: “… any qualification acquired outside the EU, including any university diplomas or certificates, should have been recognised by an EU Member State as equivalent to the EU corresponding qualification…”
The perfect PRRC would immediately spot that the MDCG has added new legislation. The Regulations don’t make a difference in EU or non-EU diploma’s. The Member State concerned may provide an opinion on ‘a course of study’ other than a university degree. If there had been a comma between ‘study’ and ‘recognised’, all diploma’s or certificates would have to be recognized. We also don’t see Member States advertising where these recognitions can be stamped, so it appears that even the Member States themselves see this MDCG added rule as not to be taken seriously.
In case the university degree is a bit of a problem, there is also Article 15(1)(b): “…four years of professional experience in regulatory affairs or in [relevant] quality management systems…” The MDCG guidance adds that the professional experience must be related to EU requirements. However, the one year or four years of experience are not specified further. Is this about full time jobs? And what if that full time job consisted of work split between EU and FDA requirements? Anybody working in this field for some time – and those are the people you want as your PRRC – know that experience is build up in annual cycles.
Work is planned, executed, results are evaluated and reported and a new plan is made. Experience is build up by going through several of these cycles in consecutive years. Therefore, the experience criterion should be considered as calendar years in which someone has been significantly involved in regulatory work and/or quality management related to EU requirements with medical devices and/or IVD’s, as relevant.
With the above in mind, a good PRRC should be able to write a justification for their qualifications. Be aware that notified bodies review these justifications and check the evidence.
Availability
For micro and small enterprises (max 50 people and 10 million Euros annual turnover, but check Commission Recommendation 2003/361/EC for further definition of this status) may outsource the role of the PRRC to an external party. The same applies for authorized representatives. They must have their PRRC ‘permanently and continuously at their disposal’. The MDCG explains ‘permanently and continuously’ as ‘the permanent and continuous availability of that party’. This may not be clear to everybody, but a good PRRC would immediately put this requirement in the context of outsourced work: there should not be a limitation to the availability of the external PRRC in the agreement, like for example a maximum number of hours or periods in the year in which the PRRC would not be available.
This does not mean the PRRC cannot go on vacation or take a few days of sick leave. Most work of the PRRC is related to checking conditions and criteria before the actual work with the devices start and check afterwards, usually by sampling, if this is done in accordance with those preparations. Only in case of vigilance reporting, by a team that does not routinely report, the PRRC may be required to look over the shoulder of the people handling those cases, but that is mainly because of practical reasons (there are strict timelines in reporting and responding of vigilance reports). It is always possible to appoint a deputy PRRC that can jump in should the first PRRC not be available.
For larger organizations the PRRC just has to be ‘available’. The MDCG explains that as the PRRC being employed by that organization. This still leaves a lot of room for interpretation. For example, in the case of a company with multiple locations that are all part of the same legal person. especially if these locations are at some geographical distance, where to base the PRRC is a relevant question. For example, production takes place in Location A, Location B assembles the device with other components into procedure packs, Location C sterilizes these packages and Location D houses the head office where Regulatory Affairs, Clinical Affairs and the Vigilance Team are based.
If it is possible to define where the most crucial processes take place from a regulatory perspective, then that is where the PRRC should be based. In case of doubt, appoint multiple PRRC’s, each responsible for a specific part of the compliance, possibly with some overlap. Notified Bodies appear open to any reasonable setup. Again, a good PRRC should be able to write that justification.
Your day-to-day PRRC
When thinking about appointing a PRRC, it is crucial to understand the most critical risks to compliance. For example, in case of an implant with a complex production process, the PRRC may have to monitor closely the process of product release. In case of an authorized representative, the PRRC may be more relevant for the regulatory process in general and vigilance cases in particular. It is also important to understand where in your organization issues may find a place to hide. For example, in a large organization there could be a level of KPI driven middle managers with end-of-year driven bonuses or other personal reasons to suppress critical questions (think Volkswagen, Boeing and maybe Philips). In small organizations the PRRC may be checking their own work. Even with the best intentions something may be overlooked, while that could be spotted with an extra pair of eyes.
And of course there is at the level of management the issue of understanding the value of a PRRC. A good PRRC may be a bit of permanent irritating factor, always asking difficult questions, commenting decisions and talking with staff outside the direct view of management. But if the PRRC is working as expected, their company will usually know well ahead of developing issues and prevent them turning into a crisis. The PRRC will be your eyes and ears on the work floor, which is where most issues are detected in an early stage.
Maybe you should compare a PRRC with a pilot, who tells you to change the course of your ship while you can’t see the wrecks lurking below the waves, and afterwards you wonder why you went through all these troubles and costs, because nothing happened.
Selecting a PRRC is not a popularity contest
As you have seen above, your PRRC should be able to justify their qualifications and their availability and you know you must have someone who can make you aware of potential regulatory risks. This is someone who may spoil the planning for a product launch, insist on a recall or suggest to cut ties with a supplier or distributor. Despite Article 15(5), about the PRRC not suffering any disadvantage if they do their job well, not everybody in the company may fully appreciate the position your PRRC sometimes has to take.
Of course, it would be best if you select someone with some diplomatic skills, capable of sugaring the medicine. But that should not be top on the priority list. Qualifications, availability and of course high ethical standards should be center stage. Make sure that you can write your own justification for appointing this PRRC, and stick with that. Your PRRC needs full management support!
See here if you are looking for a seasoned PRRC, or reach out by mail: ronald@boumansconsulting.com
