Section 4

Roles and Responsibilities Under MDR/IVDR

Understanding the obligations of all stakeholders in the medical device supply chain and healthcare delivery system.

The Regulatory Ecosystem

The Medical Device Regulation (EU) 2017/745 and In Vitro Diagnostic Regulation (EU) 2017/746 establish a comprehensive framework of responsibilities for all parties involved in placing medical devices on the EU market and using them in healthcare settings. Unlike the previous directive system, the MDR/IVDR explicitly defines the obligations of each economic operator and introduces new responsibilities for healthcare institutions.

For healthcare workers, understanding these roles is essential not only for compliance but also for effective collaboration with suppliers, manufacturers, and regulatory authorities. This knowledge enables better procurement decisions, more effective incident reporting, and improved patient safety outcomes.

Economic Operators: An Overview

The MDR defines four categories of economic operators, each with distinct legal obligations. The regulation follows a principle of proportionate responsibility—those with greater control over the device bear greater regulatory burden.

Manufacturer

The natural or legal person who manufactures or fully refurbishes a device, or has a device designed, manufactured, or fully refurbished, and markets that device under their name or trademark.

Authorised Representative

A natural or legal person established in the EU who has received and accepted a written mandate from a manufacturer located outside the EU to act on their behalf.

Importer

A natural or legal person established in the EU who places a device from a third country on the EU market.

Distributor

A natural or legal person in the supply chain, other than the manufacturer or importer, who makes a device available on the market.

Manufacturer Obligations (Article 10)

The manufacturer bears the primary responsibility for ensuring that devices placed on the EU market are safe and perform as intended. The MDR significantly expands these obligations compared to the MDD, requiring a lifecycle approach to device management.

Quality Management System

Manufacturers must establish, document, implement, maintain, and continuously improve a quality management system (QMS) that covers the entire device lifecycle. The QMS must address:

Strategy for regulatory compliance
Identification of applicable general safety and performance requirements
Responsibility of management for quality
Resource management including supplier and subcontractor selection
Risk management throughout the product lifecycle
Clinical evaluation including post-market clinical follow-up
Product realisation including design, production, and verification
UDI assignment and device registration in EUDAMED
Post-market surveillance system
Communication with competent authorities and Notified Bodies

Technical Documentation

Before placing a device on the market, manufacturers must draw up and keep up-to-date technical documentation that demonstrates conformity with the regulation. This must be retained for:

10 Years

General medical devices

15 Years

Implantable devices

Person Responsible for Regulatory Compliance (PRRC)

A significant new requirement under MDR—manufacturers must have at least one person responsible for regulatory compliance permanently and continuously available. This person must possess:

A diploma, certificate, or other evidence of formal qualification in law, medicine, pharmacy, engineering, or another relevant scientific discipline, AND at least one year of professional experience in regulatory affairs or quality management systems relating to medical devices, OR
Four years of professional experience in regulatory affairs or quality management systems relating to medical devices

Note for SMEs: Micro and small enterprises are not required to have the PRRC within their organisation but must have such a person permanently and continuously at their disposal.

PRRC Responsibilities

Ensure conformity of devices is appropriately checked before release
Ensure technical documentation and EU declaration of conformity are drawn up and kept up-to-date
Ensure post-market surveillance obligations are complied with
Ensure reporting obligations for incidents and corrective actions are fulfilled
In case of investigational devices, ensure the statement referenced in Annex XV is issued

Authorised Representative Obligations (Article 11)

When a manufacturer is established outside the EU, devices may only be placed on the EU market if the manufacturer designates a sole Authorised Representative (AR). The AR's mandate must cover at least the following tasks:

Core AR Responsibilities

Documentation Verification

Verify that the EU declaration of conformity and technical documentation have been drawn up, and where applicable, that an appropriate conformity assessment procedure has been carried out by the manufacturer.

Registration

Keep available a copy of technical documentation, EU declaration of conformity, and where applicable, a copy of the relevant certificate including any amendments and supplements.

Cooperation with Authorities

Comply with registration obligations and cooperate with competent authorities on any preventive or corrective actions.

Sample and Access Provision

Forward to the manufacturer any request by a competent authority for samples or access to a device and verify that the manufacturer provides them.

Mandate Termination

Terminate the mandate if the manufacturer acts contrary to its obligations under the MDR—and inform competent authorities and the Notified Body accordingly.

Healthcare Implications

When procuring devices from manufacturers outside the EU, healthcare facilities should verify that a valid Authorised Representative is designated and that their contact details appear on the device labelling. The AR serves as the point of contact for regulatory matters and can be held legally responsible for defective devices.

Importer Obligations (Article 13)

Importers are the gatekeepers for devices entering the EU from third countries. The MDR places significant verification and documentation obligations on importers—far greater than under the MDD.

Obligation	Requirement
CE Marking Verification	Verify the device bears the CE marking and that the EU declaration of conformity has been drawn up
Manufacturer Identification	Verify the manufacturer is identified and has designated an Authorised Representative
UDI Verification	Verify that the device has been assigned a UDI (where applicable)
Labelling	Indicate on the device or packaging their name, registered trade name or trademark, and registered place of business
Language Requirements	Verify that the device is labelled in accordance with the regulation and that instructions for use are provided in the language(s) required by the Member State
Storage Conditions	Ensure that, while a device is under their responsibility, storage or transport conditions do not jeopardise compliance
Complaint Register	Keep a register of complaints, non-conforming devices, recalls, and withdrawals, and keep the manufacturer and AR informed
Document Retention	Keep a copy of the EU declaration of conformity and ensure technical documentation can be made available to competent authorities for 10 years (15 years for implantables)

Distributor Obligations (Article 14)

Distributors, while having lighter obligations than manufacturers or importers, still bear responsibility for verifying basic compliance before making devices available on the market.

Distributor Verification Requirements

CE Marking: Verify the device bears the CE marking
EU Declaration: Verify the EU declaration of conformity has been drawn up
Labelling Completeness: Verify the device is accompanied by required information and instructions in the appropriate language(s)
Importer Identification: Where applicable, verify the importer has complied with labelling requirements
UDI: Verify the device has been assigned a UDI (where applicable)
Storage Conditions: Ensure storage and transport do not jeopardise device compliance
Cooperation: Cooperate with manufacturers, importers, and authorities on corrective actions

When Distributors Become Manufacturers

A distributor (or importer) is considered a manufacturer and must assume manufacturer obligations when they:

Place a device on the market under their own name, registered trade name, or trademark
Change the intended purpose of a device already placed on the market
Modify a device already placed on the market in a way that may affect its compliance

Exception: Relabelling or repackaging for distribution in a Member State does not constitute modification if performed in a manner that does not affect the original condition of the device and is agreed with the manufacturer.

Healthcare Institution Obligations

While healthcare institutions are not classified as economic operators, the MDR introduces specific obligations for hospitals and healthcare facilities that manufacture or modify devices for in-house use. This is a significant change from the MDD, which did not explicitly address in-house manufacturing.

Article 5(5): In-House Manufacturing Exemption

Healthcare institutions may manufacture, modify, or use devices in-house without meeting the full manufacturer obligations, provided ALL of the following conditions are met:

1. No Suitable Commercial Alternative

The target patient group's specific needs cannot be met, or cannot be met at the appropriate level of performance, by an equivalent device available on the market.

2. No External Transfer

The devices are not transferred to another legal entity (even within the same healthcare system).

3. Industrial Scale Prohibition

Manufacturing and use are not carried out on an industrial scale.

4. Quality Management

Manufacture occurs under an appropriate quality management system.

5. Documentation

The healthcare institution draws up documentation including device description, intended purpose, design rationale, risk management, and clinical data justification.

6. Declaration

A declaration is made publicly available that includes the name and address of the manufacturing healthcare institution, details identifying the devices, and a statement that they meet the general safety and performance requirements.

7. Experience Review

The healthcare institution reviews experience gained from clinical use and takes all necessary corrective actions.

Competent Authority Powers

Member States may require healthcare institutions to submit further information about in-house manufactured devices. They may also restrict or prohibit such manufacture if they determine that conditions for the exemption are not met. Healthcare institutions should maintain dialogue with their national competent authority regarding in-house manufacturing activities.

Reprocessing of Single-Use Devices (Article 17)

The MDR explicitly addresses the reprocessing of single-use medical devices for the first time in EU legislation. This is particularly relevant for healthcare institutions seeking to reduce costs or environmental impact through device reprocessing.

Key Provisions

Member State Discretion

Reprocessing of single-use devices is only permitted where Member States allow it under national law. Some Member States prohibit reprocessing entirely.

Manufacturer Obligations

Any entity that reprocesses a single-use device is considered the manufacturer of the reprocessed device and must meet all manufacturer obligations under the MDR.

Labelling

The reprocessed device must be labelled with the name of the reprocessing entity, indicate it is a reprocessed device, and show the number of reprocessing cycles.

Healthcare Institution Exception

Member States may allow healthcare institutions to reprocess single-use devices in-house, provided equivalent safety and performance standards are met and the reprocessing is carried out under a notified quality management system.

Member State	Reprocessing Permitted?	Notes
Germany	Yes	Under strict conditions, established practice
France	No	Prohibited by national legislation
Ireland	Limited	Generally not permitted with some exceptions
Netherlands	Yes	Under regulatory oversight
Spain	No	Prohibited by national legislation

Note: National positions may change. Always verify current national requirements with your competent authority.

Vigilance and Incident Reporting

Healthcare workers play a critical role in the post-market surveillance system by reporting incidents and safety concerns. The MDR strengthens vigilance requirements and establishes clearer reporting pathways.

What Must Be Reported

A serious incident is any incident that directly or indirectly led, might have led, or might lead to any of the following:

Death of a patient, user, or other person
Temporary or permanent serious deterioration of a patient's, user's, or other person's state of health
A serious public health threat

Manufacturer Reporting Timelines

2 days: Serious public health threat
10 days: Death or unanticipated serious deterioration
15 days: Other serious incidents

Healthcare Worker Role

Report incidents promptly to manufacturer and/or competent authority
Preserve device and packaging when possible
Document clinical circumstances
Cooperate with manufacturer investigations

EUDAMED Vigilance Module

The EUDAMED vigilance module enables electronic reporting and tracking of incidents across the EU. Healthcare professionals can access published Field Safety Notices and Field Safety Corrective Actions through the public portion of EUDAMED, enabling proactive safety monitoring.

Notified Bodies

Notified Bodies are independent conformity assessment bodies designated by Member States to assess whether devices meet the requirements of the MDR. Their role has been strengthened under the new regulation.

Key Notified Body Functions

Conformity Assessment

Evaluate technical documentation, quality management systems, and clinical evidence for devices requiring third-party assessment (Class IIa, IIb, III, and certain Class I devices).

Certificate Issuance

Issue EU Technical Documentation Assessment Certificates, EU Quality Management System Certificates, and EU certificates of conformity.

Surveillance

Conduct periodic surveillance audits (at least annually) and unannounced audits of manufacturers.

Product Testing

May conduct or require testing of devices to verify ongoing conformity, particularly following complaints or incidents.

Healthcare Implications

Healthcare procurement teams should verify that devices bear valid Notified Body numbers and that certificates remain current. The NANDO (New Approach Notified and Designated Organisations) database and EUDAMED provide tools for verifying Notified Body designation and certificate status.

Competent Authorities

Each Member State designates one or more competent authorities responsible for implementing the MDR within their territory. These authorities have broad powers to ensure device safety and market surveillance.

Country	Competent Authority
Germany	Federal Institute for Drugs and Medical Devices (BfArM)
France	National Agency for Medicines and Health Products Safety (ANSM)
Ireland	Health Products Regulatory Authority (HPRA)
Netherlands	Health and Youth Care Inspectorate (IGJ)
Italy	Ministry of Health (Ministero della Salute)
Spain	Spanish Agency of Medicines and Medical Devices (AEMPS)

Competent Authority Powers

Conduct market surveillance and inspections
Request documentation and samples from economic operators
Restrict, suspend, or withdraw devices from the market
Require economic operators to take corrective actions
Designate and monitor Notified Bodies
Investigate incidents and coordinate with other Member State authorities

Case Study: Hospital 3D Printing and In-House Manufacturing

Situation: A university hospital in Belgium had established a 3D printing laboratory to produce patient-specific surgical guides for maxillofacial surgery. Under the MDD, this activity operated in a regulatory grey area with limited oversight.

MDR Impact: Article 5(5) now explicitly applies to such activities. The hospital needed to demonstrate:

No commercially available device could meet the patient-specific requirements
Manufacturing occurs under an appropriate QMS
Devices are not transferred to other hospitals
Production is not at industrial scale
Documentation meeting MDR requirements is maintained

Actions Taken:

Implemented ISO 13485-aligned quality management system in the printing lab
Developed documented procedures for each type of device produced
Established clinical evaluation protocols for patient outcomes
Created a risk management process for each device category
Published a declaration as required by Article 5(5)(f)
Engaged with the national competent authority (FAMHP) for guidance

Lesson: Hospitals with in-house manufacturing activities must formalise their quality systems and documentation to meet MDR requirements. Early engagement with the national competent authority is advisable.

Case Study: Distributor Due Diligence Failure

Situation: A medical device distributor in Portugal had been supplying surgical instruments to hospitals throughout the country. Following the MDR transition, one of their suppliers—a manufacturer based in Turkey—failed to maintain a valid Authorised Representative in the EU after their previous AR terminated the mandate.

Consequence: The devices were no longer legally placed on the EU market. The distributor, unaware of the AR change, continued distribution and only discovered the issue during a competent authority inspection.

Regulatory Response:

The competent authority (INFARMED) issued a warning to the distributor
Affected devices were recalled from hospital customers
The distributor was required to implement verification procedures
Hospitals were notified of the non-compliant devices in their inventory

Lesson for Healthcare Procurement: Request evidence of AR designation for devices from third-country manufacturers. Monitor EUDAMED for changes in manufacturer registration status. Include MDR compliance verification in supplier qualification procedures.

Case Study: Incident Reporting and Corrective Action

Situation: A community hospital in Austria experienced a device failure involving an infusion pump that delivered an overdose of medication to a patient. The patient required extended hospitalisation but made a full recovery.

Immediate Actions:

The biomedical engineering team quarantined the device
The hospital reported the incident to the manufacturer within 24 hours
The hospital's risk management team documented the clinical circumstances
The incident was also reported to BASG (Austrian competent authority)

Manufacturer Response:

The manufacturer investigated and identified a software fault affecting a specific batch
A Field Safety Notice was issued to all affected customers across Europe
A Field Safety Corrective Action required a software update on all affected devices
The manufacturer reported to all relevant competent authorities via EUDAMED

Lessons:

Prompt reporting enables faster identification of systematic issues
Device preservation is critical for root cause investigation
Good documentation supports effective corrective action
EUDAMED vigilance module facilitates EU-wide coordination

Responsibility Summary by Role

Role	Primary Responsibilities	Key MDR Articles
Manufacturer	Design, production, conformity assessment, QMS, technical documentation, UDI, PMS, vigilance	Article 10, Annexes I-XV
Authorised Representative	Act on behalf of non-EU manufacturers, verify documentation, cooperate with authorities	Article 11
Importer	Verify CE marking and documentation, add labelling, maintain complaint register	Article 13
Distributor	Verify CE marking and labelling, maintain storage conditions, cooperate on corrective actions	Article 14
Healthcare Institution	In-house manufacturing (if applicable), incident reporting, device tracking, vigilance cooperation	Article 5(5), Chapter VII
Notified Body	Conformity assessment, certificate issuance, surveillance audits	Articles 35-50
Competent Authority	Market surveillance, Notified Body designation, enforcement, incident investigation	Articles 93-100

Key Takeaways for Healthcare Workers

All economic operators now have clearly defined legal obligations under MDR—verify your suppliers' compliance throughout the supply chain.

In-house manufacturing activities now require formal quality systems and documentation to meet Article 5(5) requirements.

Reprocessing of single-use devices is only permitted where national legislation allows it—check your country's position.

Incident reporting is a critical healthcare worker responsibility—report promptly to support EU-wide safety coordination.

Use EUDAMED and NANDO to verify device registration, certificate validity, and Notified Body designation.

Devices from third-country manufacturers require an Authorised Representative—include AR verification in procurement procedures.

Previous: Device Classification Next: Clinical Evaluation