For a manufacturer whose device is subject to Article 15 and that does not qualify as a micro or small enterprise, a regulatory specialist legally employed by an employer of record (EOR) should not be assumed to satisfy the current person responsible for regulatory compliance (PRRC) requirement. The Medical Device Regulation (MDR) and In Vitro Diagnostic Medical Devices Regulation (IVDR) require that manufacturer to have a PRRC within its organisation. Current PRRC guidance interprets that phrase to mean an employee of the legal manufacturer.
Where Article 15 applies, a qualifying micro or small manufacturer has another route. It can use an external PRRC who is permanently and continuously at its disposal. An EOR-employed specialist may fit that structure if the candidate, location, contract, authority, systems access, and availability all satisfy the current rules and guidance. The EU sources do not address EOR arrangements by name, and Borderless has not confirmed that it accepts this regulated role.
The manufacturer's location also matters. The same PRRC guidance assumes that an EU manufacturer's PRRC is in the EU and a non-EU manufacturer's PRRC is outside the EU, close to the manufacturing activities. A regulatory specialist hired through an EOR in Europe can therefore be a poor fit for a non-EU manufacturer's own PRRC role. That manufacturer will also need a separate EU authorised representative for EU market access, and the representative needs its own PRRC in the EU.
The manufacturer's size sets the appointment path
The current MDR Article 15 and IVDR Article 15 create two different appointment paths.
The size exception is narrower than the everyday use of “SME.” Under the EU enterprise definition, a small enterprise has fewer than 50 staff and annual turnover or annual balance-sheet total of no more than EUR 10 million. A microenterprise has fewer than 10 staff and no more than EUR 2 million in annual turnover or annual balance-sheet total. Partner and linked businesses can affect the calculation, so a manufacturer should classify the enterprise rather than count one local team.
Medium-sized manufacturers do not receive the Article 15(2) external-PRRC exception.
Confirm Article 15 applies to the device
The appointment analysis belongs to devices governed by the MDR or IVDR. It should begin with the exact legal manufacturer and the regulatory status of the device portfolio.
This scope check matters during the transition from the earlier directives. Current MDR legacy guidanceand IVDR legacy guidance state that Article 15 does not apply to qualifying legacy devices during the relevant transition. The Commission currently marks those legacy documents as under revision. New MDR or IVDR devices and every transitional portfolio should be checked against the current rules before an appointment is designed.
This article covers manufacturer PRRC appointments where Article 15 applies. It does not decide whether a particular product is a medical device, an IVD, a qualifying legacy device, or subject to a national exception.
“Within the organisation” is the difficult part of an EOR structure
The regulation sets the rule. MDCG guidance explains the regulators' common practical interpretation. The Commission is clear that MDCG documents are not legally binding.
The current PRRC guidance says that a PRRC appointed within a manufacturer's organisation would need to be an employee of that organisation. It also says each legal manufacturer in a group needs its own PRRC. A shared parent company or a group regulatory team does not erase the legal-manufacturer boundary.
Borderless describes its EOR structure this way: Borderless is the legal employer while the client company directs daily work. That division can support close operational integration. It still leaves the specialist legally employed by the EOR.
The resulting EOR conclusion is an inference because Article 15 and the guidance never name an EOR. For a manufacturer outside the micro or small category, daily supervision and quality-system access do not establish employee status with the legal manufacturer. A buyer should treat the structure as unresolved until device counsel has reviewed it and the EOR, manufacturer, and any notified body or competent authority input has been documented where appropriate.
For a qualifying micro or small manufacturer, the same EOR employment fact is less problematic because Article 15 expressly permits an external PRRC. The guidance gives a contract with an external organisation as an example. That contract must make the PRRC permanently and continuously available so the person can perform operational duties and respond in time. This does not automatically require 24-hour availability every day.
A standard EOR services agreement may leave the regulated function unstated. The external-PRRC arrangement should be explicit about the named person, covered legal manufacturer, device families, qualifications, duties, availability, backup, access, escalation, conflicts, confidentiality, record retention, insurance, indemnity, and termination.
The appointment file must prove expertise and authority
Under the current MDR and IVDR, the usual qualification routes are:
- a relevant university degree or equivalent qualification, plus at least one year of professional experience in regulatory affairs or quality systems for the relevant device field; or
- four years of professional experience in regulatory affairs or quality systems for the relevant device field.
The IVDR requires expertise related to IVDs. Experience with other medical devices should not be treated as automatically interchangeable. The MDR has a separate experience route for manufacturers of custom-made devices, subject to national rules on professional qualifications.
MDCG guidance adds that the experience should be substantive, recent, and related to EU requirements. Administrative document handling or shadowing regulatory staff is not enough. The manufacturer is responsible for collecting evidence that the appointed person qualifies and can fulfil the role.
The appointment also has to work inside the quality system. Article 15 makes the PRRC responsible for ensuring that:
- device conformity is checked under the applicable quality system before release;
- technical documentation and the EU declaration of conformity are prepared and kept current;
- post-market surveillance obligations are met;
- vigilance reporting obligations are met; and
- the required statement is issued for an investigational device under the MDR or a relevant performance-study device under the IVDR.
“Responsible for ensuring” does not require the PRRC to carry out every task personally. It does require timely access to the evidence, people, and escalation channels needed to verify the work. If several people share PRRC responsibility, their areas must be set out in writing.
The PRRC must also be able to perform the role without disadvantage. The employment and services documents should preserve the person's ability to raise a nonconformity, delay a release, demand current documentation, or escalate a reporting issue without being penalised for proper performance of PRRC duties.
The rules may change
The Commission's December 2025 reform proposal would remove the detailed qualification routes and replace permanent and continuous availability with availability for an external manufacturer PRRC. As of 15 September 2026, the official legislative procedure was awaiting a committee decision. The proposal is not current law. Recheck Article 15 and the associated guidance immediately before appointment.
A non-EU manufacturer needs a separate EU representative
An EU authorised representative is a different regulated function. A non-EU manufacturer that wants to place a covered device on the Union market must designate a sole authorised representative, at least for each generic device group. The representative can be a natural or legal person established in the EU, but the designation is valid only when the representative accepts a written mandate.
An EU address, EOR employment, or regulatory-affairs job description does not create that mandate. The EOR also does not become the authorised representative by employing the specialist.
The current AR guidance describes duties that go beyond employment. The representative must perform the Article 11 tasks in its mandate, keep specified documents available, meet registration duties, respond to authorities, cooperate on corrective action, relay complaints and incident reports, and terminate the mandate if the manufacturer acts against its obligations. It may face joint and several liability with a noncompliant manufacturer for defective devices under the conditions in Article 11(5).
This is why a buyer needs three separate relationship checks:
Current MDCG guidance says the same individual cannot serve as the non-EU manufacturer's PRRC and the authorised representative's PRRC. The representative is intended to add another level of scrutiny. If the manufacturer is micro or small and uses an external PRRC, that person and the representative's PRRC should not belong to the same external organisation under the guidance.
An EOR-employed specialist could still support regulatory work for either organisation. Support work and formal appointment need separate decisions.
Choose the structure before signing the offer
Build a one-page appointment map before naming the person or finalising the employment arrangement.
- Identify the regulated product and legal manufacturer. Record whether the portfolio falls under the MDR, IVDR, or a qualifying legacy transition, and which legal entity appears as manufacturer.
- Classify the manufacturer. Apply the EU micro and small enterprise definition, including partner and linked-enterprise rules. Keep the calculation in the appointment file.
- Choose the permitted relationship. A manufacturer outside the micro or small category should plan for the PRRC to be employed by that legal manufacturer under current guidance. It can directly employ the candidate as PRRC, or keep an EOR-accepted regulatory-support hire and appoint a different qualified employee of the legal manufacturer as PRRC. A qualifying micro or small manufacturer can evaluate an explicit external-PRRC contract.
- Match expertise and location. Verify the current qualification route, recent EU regulatory or quality experience, device or IVD relevance, and the location expected by MDCG guidance.
- Give the role operating authority. Document quality-system access, information flows, release and change controls, post-market surveillance, vigilance escalation, written allocation among multiple PRRCs, backup, leave, and protection from disadvantage.
- Get EOR answers in writing. Confirm whether the EOR will permit the named appointment, sign any required external-PRRC terms, support the needed independence and access, and accept the proposed insurance, indemnity, discipline, termination, and continuity provisions.
- Separate the EU representative. A non-EU manufacturer should appoint an eligible EU authorised representative through a written mandate and confirm that the representative has its own, separate PRRC coverage.
