An MDR compliance service provider refers to an external provider that supports medical device manufacturers in meeting the requirements of Regulation (EU) 2017/745 without being a manufacturer itself. The Regulation does not recognise this term as a separate role; it defines economic operators such as manufacturers, authorised representatives, importers and distributors, as well as notified bodies, but not consultants. From a legal perspective, such service providers are therefore either suppliers or subcontractors within the meaning of the quality management system, or they assume a function regulated in the Regulation, such as that of the authorised representative. For manufacturers, this distinction is crucial because it determines which obligations can be effectively delegated and which remain unchanged with them.
Typical service profiles
The range of services extends from preparing and maintaining technical documentation in accordance with Annexes II and III, through clinical evaluations and post-market clinical follow-up (PMCF) reports, to establishing quality management systems in accordance with ISO 13485. Other common services include assuming the function of authorised representative under Article 11, providing qualified personnel to ensure compliance with regulatory requirements, operating complaint handling and vigilance processes, and preparing reports under Articles 85 and 86.
Depending on the service, the regulatory character differs significantly: drafting documentation remains a pure supply activity, whereas the role of authorised representative establishes an independent responsibility defined in the Regulation, with its own set of obligations.
Limits of delegation
Article 10 assigns responsibility for conformity, technical documentation, risk management, clinical evaluation, post-market surveillance and reporting obligations to the manufacturer. This responsibility cannot be shifted by commissioning a third party: anyone who purchases a clinical evaluation remains responsible for its substantive correctness and must be able to review and approve it professionally. Article 10(9) therefore explicitly requires the quality management system to cover resource management, including the selection and monitoring of suppliers and subcontractors.
This implies a minimum infrastructure at the manufacturer: selection criteria, documented evidence of qualifications, defined interfaces, rules for retention and release of documents, and regular performance evaluation. Without in-house expertise to review the results, a systemic deficiency arises that will be cited in audits as a lack of supplier control.
Person Responsible for Regulatory Compliance (PRRC) as a service
Article 15 requires manufacturers to have at least one Person Responsible for Regulatory Compliance (PRRC) within their organisation and specifies that person’s qualifications based on education and professional experience, as well as their tasks, including verifying conformity before release, ensuring the technical documentation and the EU declaration of conformity are up to date, post-market surveillance obligations, and reporting obligations. For micro and small enterprises, simplified rules apply that allow such a person to be permanently and continuously available even outside the organisation.
If this function is filled externally, availability, arrangements for substitution, independence from instructions, and access to the relevant records must be contractually secured. An appointment that amounts to occasional consulting hours does not meet the requirement for permanent and continuous availability.
Contractual structuring
Contracts should regulate the scope of services, the manufacturer’s duties to cooperate, deadlines, escalation paths, confidentiality, data protection, and the retention and handover of documents upon contract termination. Since retention periods under Article 10(8) are at least ten years, and at least fifteen years for implantable devices, documentation obligations extend well beyond typical contract terms. The manufacturer’s audit and inspection rights, as well as cooperation in authority inspections, should also be included in the contract.
Distinction from the notified body and from service providers in the clinical trial context
Notified bodies must not provide consultancy that could jeopardise their impartiality; certification and consultancy are therefore institutionally separated. An MDR compliance service provider can prepare conformity, but can never certify it.
In the clinical trial context, the term service provider is used differently: there it refers to the organisations commissioned by the sponsor to take on trial-related tasks, as described in the entry on service providers. The difference lies in the reference point for responsibility: there it remains with the sponsor of the clinical investigation, here with the manufacturer of the product. In practice, both roles often overlap, but they must be regulated contractually and documented separately.
Relevance for clinical trials
In clinical investigations of medical devices, two delegation structures intersect: the product-related outsourcing of regulatory tasks by the manufacturer and the trial-related transfer of sponsor tasks. If it is not clearly defined who is responsible for the investigator’s brochure, safety reporting, site contracts and the final reports, gaps arise precisely at the interfaces that inspections review first.
For this reason, a responsibility matrix is recommended that assigns each regulatory and trial-related task to a named person with approval authority and identifies the handover points between trial and product documentation. Full-service CROs such as Mediconomics support sponsors and manufacturers in establishing such assignments, aligning trial and regulatory submission documentation, and keeping the required evidence traceable for audits.
Frequently Asked Questions (FAQ)
Can a manufacturer outsource regulatory responsibility?
No. Activities can be outsourced, but responsibility under Article 10 remains with the manufacturer. The manufacturer must demonstrate selection, monitoring and review of results within the quality management system.
May the same service provider be both authorised representative and consultant?
In principle, yes, provided that the authorised representative’s tasks under Article 11 are governed by a written mandate and the required expertise is permanently available. Conflicts of interest must be assessed and documented.
What happens when a mandate ends?
Documents, records and ongoing matters must be handed over in full. The authorised representative must terminate the mandate if the manufacturer acts contrary to its obligations, which makes early succession arrangements necessary.
Regulatory References
- Regulation (EU) 2017/745, Article 10 — Obligations of manufacturers, including paragraph 9 on the control of suppliers
- Regulation (EU) 2017/745, Article 11 — Tasks and mandate of the authorised representative
- Regulation (EU) 2017/745, Article 15 — Person Responsible for Regulatory Compliance (PRRC)
- Regulation (EU) 2017/745, Article 10(8) — Retention periods for documentation
- ISO 13485:2016, Section 7.4 — Purchasing and the evaluation and monitoring of suppliers
