Roles and Responsibilities for Medical Devices

Roles and responsibilities at medical device manufacturers are partly prescribed by law and partly open to interpretation. The Medical Device Regulation (MDR), formally Regulation (EU) 2017/745, and In Vitro Diagnostic Regulation (IVDR), formally Regulation (EU) 2017/746 explicitly require the appointment of a Person Responsible for Regulatory Compliance (PRRC) in accordance with Article 15. National law supplements this with the medical device consultant as defined in Section 83 of the Medical Device Law Implementation Act (Medizinprodukterecht-Durchführungsgesetz, MPDG). Other roles, such as quality management representatives, risk managers, or vigilance coordinators, arise from process requirements and responsibilities.

In practice, the scope of these roles determines whether obligations are reliably fulfilled. Unclear areas of responsibility usually only become apparent during an Audit or in the event of an Incident. Added to this is the issue of liability, as personal responsibilities exist alongside corporate liability, and product liability law is currently being revised.

This article describes which functions are mandatory, which are usefully supplemented, and what must be considered regarding liability and insurance.

Legally required functions for manufacturers

The PRRC under Article 15 of the MDR and IVDR

Manufacturers must designate at least one PRRC. The PRRC ensures that product conformity is tested prior to release, that technical documentation and the EU declaration of conformity are prepared and kept up to date, that post-market surveillance obligations are fulfilled, and that reporting obligations under Articles 87 through 91 of the MDR are met. For investigational devices, the declaration under Annex XV, Chapter II, Section 4.1 of the MDR also applies. Article 15(1) of the MDR/IVDR currently requires specific qualifications for the PRRC, namely a relevant university degree or qualification of equivalent value plus at least one year of professional experience in regulatory affairs or Quality management systems, or alternatively, four years of relevant professional experience. For manufacturers of custom-made devices, specific proof of two years of professional experience in a relevant manufacturing field is sufficient. Micro and small enterprises are not required to employ the PRRC within their own organization but must have the PRRC permanently available. The PRRC must not suffer any disadvantages because of performing their duties (Article 15(5) of the MDR). The PRRC is listed as part of the stakeholder registration in EUDAMED. Guidance on interpretation is provided in MDCG 2019-7 Rev.1.

The European Commission’s current reform proposal dated December 16, 2025, calls for the removal of the detailed qualification requirements and stipulates that, for external PRRCs of small enterprises, mere availability shall suffice. The proposal is currently undergoing ordinary legislative procedure. Until then, Article 15 remains unchanged in effect. Even if the explicit qualification criteria are eliminated, Authorities and Notified Bodies are likely to expect comparable evidence, subject to further clarification.

PRRC for authorized representatives

authorized representatives also require their own PRRC (Article 15(6) in conjunction with Article 11(3) of the MDR or IVDR). According to MDCG 2019-7 Rev.1, the authorized representative’s PRRC should not be identical to the manufacturer’s PRRC. Manufacturers based outside the EU should verify, when selecting and entering into a contract with an authorized representative, whether the authorized representative has designated its own PRRC and how the collaboration is structured.

Medical device consultants under Section 83 of the MPDG

Medical device consultants provide professional healthcare practitioners with information about products or instruct them on their use. This activity requires expertise and experience with the respective products, which also applies to information provided by telephone. Such expertise stems in particular from relevant education and product-specific training or from relevant practical experience and must be demonstrated to the competent authority upon request. The client must ensure regular training. The medical device consultant must record reports from healthcare professionals regarding side effects, interactions, malfunctions, technical defects, contraindications, or other risks and, if necessary, forward them immediately in writing or electronically. The recipients are the manufacturer, the authorized representative, or their PRRC, as well as the importer if placing the device on the market under the importer’s responsibility. In practice, this role thus encompasses sales, application consulting, and technical service.

Eliminated and related mandatory functions

The former safety officer for medical devices under the Medizinproduktegesetz (MPG) no longer exists. Their safety-related duties must now be addressed within the PMS and vigilance system as well as by the PRRC. Regardless of MPG, other designated officer roles may be mandatory, such as the data protection officer under Article 37 of the General Data Protection Regulation (GDPR) and Section 38 of the Bundesdatenschutzgesetz (BDSG), or roles arising from occupational safety and hazardous substances legislation. For AI systems, Article 4 of the AI Act requires staff to possess sufficient AI competence, without prescribing a specific role.

Roles derived from standards

Standards generally require processes and competencies, not designated individuals. ISO 13485 requires the designation of a management representative for the quality management system (clause 5.5.2) as well as documented responsibilities and authorities. ISO 14971 requires defined responsibilities for risk management. IEC 62304 requires defined responsibilities throughout the software life cycle. How these responsibilities are distributed within the organization is left to the manufacturer, if competence and effectiveness are demonstrated.

Roles and responsibilities for medical devices from a business perspective

In addition to the mandatory roles, many manufacturers establish additional roles. Common roles include regulatory affairs managers, quality management representatives, risk management managers, clinical evaluation managers, pharmacovigilance coordinators, software and cybersecurity managers, and supplier management representatives.

In small organizations, several of these roles are combined, often within the PRRC. While this is permissible, it can lead to conflicts of interest if the same person is responsible for both development and approval. As the number of products grows, it is recommended to separate operational and review functions and to designate a deputy.

Function	Legal Basis / Status
PRRC	Article 15 MDR / IVDR – mandatory
PRRC of the authorized representative	Article 11(3), Article 15(6) MDR / IVDR – mandatory
Medical Device Consultant	Section 83 Medizinprodukterecht-Durchführungsgesetz (MPDG) – mandatory for relevant activities
Management representative of top management	ISO 13485 Section 5.5.2 – required by the standard
Data Protection Officer	Article 37 of the GDPR, § 38 of the BDSG – mandatory if the criteria are met
QM, Risk, Vigilance, and Cybersecurity Responsibilities	Role title is flexible. Duties are required by regulations or standards.
Medical Device Safety Officer	Section 6 of the Medical Device Operator Regulation (Medizinprodukte-Betreiberverordnung, MPBetreibV) --- applies to operators, not Manufacturers

Document roles and responsibilities for medical devices

This assignment is part of the quality management system pursuant to Article 10(9) of the MDR or Article 10(8) of the IVDR. The following are recommended:

Job or role descriptions detailing tasks, authorities, and interfaces
Proof of qualifications (education, professional experience, training) for each role
Written designation of the PRRC, including provisions for representation; if there are multiple PRRCs, a written delineation of their respective areas of responsibility
Evidence of training for medical device advisors
Contractual provisions for outsourced tasks, such as external PRRCs, authorized representatives, and design and development and service providers
Regular verification of up-to-date status during the management review

Operator’s perspective and interface with the manufacturer

From the user’s perspective, the Medical Device Operator Regulation (MPBetreibV) applies. Accordingly, health institutions with more than 20 employees on a regular basis must designate a medical device safety officer (Section 6 MPBetreibV). This person serves as the point of contact for authorities, manufacturers, and distributors regarding risk reports and Field Safety Corrective Actions (FSCA), coordinates internal reporting and cooperation obligations, and is identified via a designated email address. Additionally, Section 3 of the Medical Device User Reporting and Information Regulation (Medizinprodukte-Anwendermelde- und Informationsverordnung, MPAMIV) governs the reporting obligations for individuals who operate or use products in a professional or commercial capacity.

For manufacturers, this results in specific requirements: instruction and training programs, instructions for use that reflect the operator’s obligations, accessible reporting channels for vigilance and recalls, as well as clear roles regarding maintenance, remote maintenance, and software updates. The revised version also contains requirements regarding IT security audits and instruction following software updates that result in more than minor changes to how the product is used. Service, maintenance, and cloud contracts should explicitly define who is responsible for what.

Liability

Liability exists on several levels. At the corporate level, strict liability under the Product Liability Act and tort liability under Section 823 of the German Civil Code (Bürgerliches Gesetzbuch, BGB) apply. In addition, there are the criminal and administrative penalty provisions of Sections 92 et seq. of the Medical Device Law Implementation Act (Medizinprodukterecht-Durchführungsgesetz, MPDG), which may also be linked to individual conduct.

The MDR and the IVDR do not impose any independent liability under product liability law on the PRRC toward third parties. The management’s organizational responsibility remains unaffected by this. However, personal risks may arise from criminal law, administrative offense law, or obligations under employment contracts.

For products placed on the market or put into service after December 8, 2026, the new product liability law will apply. The corresponding Directive (EU) 2024/2853 covers software regardless of its form, provides for a reduced burden of proof and disclosure obligations, regulates significant changes after placing on the market separately, and removes the previous liability cap. The German ministerial draft bill was published in September 2025. The status of the legislative process should be reviewed again prior to publication.

Liability coverage and insurance

The MDR and IVDR require financial safeguards for manufacturer liability. Manufacturers must take precautions appropriate to the risk class, the type of product, and the size of the company to ensure sufficient financial coverage for their potential product liability (Article 10(16) of the MDR, Article 10(15) of the IVDR). The regulations do not specify a particular type of insurance or a minimum coverage amount. The requirement for coverage can therefore be met through product liability insurance or through the manufacturer’s own reserves. Proof of coverage is expected as part of the conformity assessment and should be documented in the quality management system. Stricter national regulations remain unaffected. German law does not currently provide for any general insurance obligation for manufacturers beyond this.

Under Article 11(5) of the MDR, authorized representatives are jointly and severally liable with the manufacturer for defective products. This particularly affects manufacturers outside the Union and should be explicitly addressed in the mandate. Who assumes the coverage should be contractually stipulated.

Insurance for trial participants is expressly required for clinical investigations, performance studies, and other clinical investigations: The scope of coverage must be proportionate to the risks and must amount to at least EUR 500,000 for each case of death or permanent incapacity for work (section 25 MPDG).

Other areas of practical relevance include business and product liability, extended product liability (including coverage for recall costs), cyber coverage for connected products, and D&O insurance for board members and executives. Coverage limits, exclusions, and the treatment of software should be reviewed in light of the new product liability law.

Practical approach

Assessment: Identify all regulatory tasks and assign them to a specific person.
Testing mandatory roles: PRRC designated, qualified, reachable, and registered in EUDAMED; medical device advisors identified, trained, and documented.
Review gaps and overlapping roles: Document and resolve conflicts of interest and gaps in representation.
Regulate interfaces: Contractually bind authorized representatives, importers, distributors, operators, and service providers. Explicitly define obligations regarding information, reporting, escalation, and updates.
Align liability and insurance: Demonstrate coverage in accordance with Article 10 of the MDR/IVDR and ensure that coverage amounts and exclusions reflect the new product liability law.

FAQ

Does a separate PRRC have to be designated for each product group?

No. A PRRC can cover multiple product groups, provided that the individual’s qualifications, responsibilities, and availability are appropriate.

Can the PRRC also serve as the quality management representative?

Yes. However, conflicts of interest should be assessed if testing and operational duties overlap.

Does a software manufacturer need a medical device consultant?

Yes, if healthcare professionals are provided with professional information or trained in the use of the software.

What role does management play alongside the PRRC?

The PRRC assumes defined regulatory control and monitoring tasks but does not replace management’s organizational responsibility. Management must ensure appropriate structures, resources, responsibilities, and escalation procedures.

What should be addressed when regulatory tasks are outsourced?

Tasks, authorities, reporting channels, response times, documentation, and representation should be clearly agreed upon.

Conclusion

The following are mandatory for manufacturers: the PRRC pursuant to Article 15 of the MDR/IVDR and, depending on the nature of their activities in Germany, the medical device advisor pursuant to Section 83 of the MPDG. All other requirements arise from process requirements and the size of the organization. It is crucial that tasks, authorities, and representation are documented and aligned with liability and insurance risks. The upcoming changes to the MDR, IVDR, and product liability law should be monitored in this regard.

Would you like to have your role model reviewed or set up the PRRC function from scratch? Please feel free to schedule a no-obligation initial consultation.

Roles and Responsibilities of Medical Device Manufacturers: Requirements, Practices, and Liability

Do you have any questions about your project or product?