---
title: What Is a Manufacturer Under MDR Article 2(30)? Legal Obligations for Startup Founders
description: The MDR definition of 'manufacturer' in Article 2(30) carries extensive legal obligations — here is what it means for startup founders who outsource production or use contract manufacturers.
authors: Tibor Zechmeister, Felix Lenhard
category: MDR Fundamentals & Regulatory Strategy
primary_keyword: 
canonical_url: https://zechmeister-solutions.com/en/blog/manufacturer-mdr-article-2-30
source: zechmeister-solutions.com
license: All rights reserved. Content may be cited with attribution and a link to the canonical URL.
---

# What Is a Manufacturer Under MDR Article 2(30)? Legal Obligations for Startup Founders

*By Tibor Zechmeister (EU MDR Expert, Notified Body Lead Auditor) and Felix Lenhard.*

Under the MDR, the "manufacturer" is not just the company that physically builds the device. It is the entity that takes legal responsibility for the device. Article 2(30) defines the manufacturer as the natural or legal person who manufactures or fully refurbishes a device, or has a device designed, manufactured, or fully refurbished, and markets that device under its name or trademark .

For startup founders, this definition has profound implications — especially if you outsource design, manufacturing, or both.

## Why Does the Manufacturer Definition Matter?

Because the manufacturer bears virtually all obligations under the MDR. Article 10 lists the general obligations of manufacturers, and the list is extensive:

- Establish, document, implement, and maintain a quality management system (Article 10(9))
- Ensure devices are designed and manufactured in accordance with the MDR (Article 10(1))
- Prepare technical documentation (Article 10(4))
- Conduct conformity assessment (Article 10(2))
- Draw up the EU Declaration of Conformity (Article 10(6))
- Affix the CE marking (Article 10(6))
- Comply with UDI obligations (Article 10(10))
- Designate a Person Responsible for Regulatory Compliance (Article 15)
- Implement a post-market surveillance system (Article 10(10))
- Report serious incidents to competent authorities (Article 10(13))
- Keep the technical documentation available for competent authorities for at least 10 years after the last device is placed on the market (Article 10(8)) 

Every single one of these obligations falls on the manufacturer. Not on the contract manufacturer. Not on the distributor. Not on the design house. On you — the legal entity that markets the device under its name.

## What If You Outsource Manufacturing?

Many startups do not manufacture their own devices. They use contract manufacturers — third-party companies that produce the device according to the startup's specifications. Under the MDR, this does not change who the manufacturer is.

If you design a device and have it manufactured by a contract manufacturer, and you market that device under your startup's name, you are the manufacturer under Article 2(30). The contract manufacturer is your supplier. You bear the manufacturer obligations.

This means:
- **Your QMS must cover the contract manufacturer's activities.** Your quality management system must include processes for supplier management, incoming quality control, and oversight of outsourced processes. The contract manufacturer's quality is your quality.
- **You must have a quality agreement with the contract manufacturer.** This agreement defines responsibilities, quality requirements, change control procedures, and audit rights.
- **You must verify the contract manufacturer's output.** Whether through incoming inspection, process validation, or a combination, you must ensure that the manufactured devices meet your specifications.
- **You remain responsible for post-market surveillance.** If a device fails in the field, you are responsible — not the contract manufacturer.

Tibor has seen startups assume that using a contract manufacturer with their own ISO 13485 certificate transfers the regulatory burden. This is simply not possible. The contract manufacturer's QMS covers their own operations. Your QMS must cover the complete product lifecycle, including the outsourced manufacturing.

## What If You Outsource Design?

Some startups outsource device design to engineering consultancies or design houses. Under Article 2(30), if you "have a device designed" and market it under your name, you are the manufacturer. The design house is your supplier.

The same principles apply:
- Design control is your responsibility
- Design documentation must be in your technical file
- Design verification and validation are your obligations
- The design house must work within your QMS framework (or you must demonstrate control over their design process)

## What About White-Label and Private-Label Devices?

If you take an existing device made by another company and market it under your own name or trademark, you become the manufacturer under the MDR. This is the "private label" or "white label" scenario, and it carries the full set of manufacturer obligations.

You cannot simply rebrand another company's device and claim you are just a distributor. The moment your name or trademark goes on the device, you are the manufacturer. You need your own conformity assessment, your own technical documentation (or documented access to the original manufacturer's documentation with their cooperation), and your own QMS.

Article 16 of the MDR addresses specific scenarios where the obligations of Article 10 apply to someone other than the original manufacturer — including when a person changes the intended purpose of a device already placed on the market or makes changes to an already marketed device that are not foreseen by the original manufacturer .

## What Are the Financial Implications?

For a startup, being the manufacturer means:

**Insurance:** You need adequate product liability insurance. The MDR requires manufacturers to have measures in place to provide sufficient financial coverage for potential liability (Article 10(16)) .

**Documentation retention:** You must retain technical documentation for at least 10 years after the last device is placed on the market. This is a long-term infrastructure cost.

**Post-market surveillance infrastructure:** You must maintain an active PMS system for the entire time your device is on the market and for a period after the last device is in use.

**Recall capability:** You must have the ability to execute a recall if necessary. This requires traceability systems that can identify where every device unit is in the supply chain and with which end user.

**PRRC:** You must have at least one person with the qualifications specified in Article 15 responsible for regulatory compliance. This is either a hire or an outsourced arrangement with a qualified individual.

## The Legal Entity Question

A common startup question: which legal entity should be the manufacturer? If you have a holding company, an operating company, and perhaps a manufacturing subsidiary, the answer matters.

The manufacturer is the entity named on the label, the Declaration of Conformity, and the marketing materials. This entity must have the QMS, the technical documentation, and all manufacturer obligations. Choose the entity that:
- Is established in the EU (if possible — otherwise you need an authorized representative)
- Will be the long-term commercial entity for the device
- Has the organizational capability to fulfill manufacturer obligations
- Has the financial resources to support compliance, insurance, and potential liability

Changing the manufacturer entity after market launch is possible but creates significant regulatory and administrative work — you essentially need a new conformity assessment.

## What Manufacturers Must NOT Do

Article 10 also defines prohibitions and restrictions:

- A manufacturer must not place a device on the market unless a conformity assessment has been carried out (Article 10(2))
- A manufacturer must not affix the CE marking unless the conformity assessment has been successfully completed (Article 10(6))
- A manufacturer must not supply false or misleading information to Notified Bodies, competent authorities, or users (implicit throughout the regulation)
- A manufacturer must not place a device on the market if they become aware it does not conform to the MDR — they must take corrective action, including recall if necessary (Article 10(12)) 

## Practical Advice for Startup Founders

**Accept the manufacturer role fully.** Do not try to structure your business to avoid being the manufacturer while effectively functioning as one. The MDR definition is broad, and competent authorities look at substance over form.

**Build manufacturer obligations into your business plan from day one.** QMS, technical documentation, PMS, vigilance, PRRC, insurance, document retention — these are not surprises. They are the cost of being a medical device manufacturer.

**If you outsource, control your suppliers.** Your contract manufacturers, design houses, and critical suppliers are extensions of your operation. Manage them as such through quality agreements, audits, and ongoing oversight.

**Designate your PRRC early.** Article 15 is one of the most commonly overlooked requirements for startups. You need a qualified person in place before market entry. See [The Person Responsible for Regulatory Compliance (PRRC) Under MDR Article 15](/blog/023-prrc-mdr-article-15) for details.

The manufacturer role under MDR is comprehensive. It is also clearly defined. If you understand the obligations before you start, you can plan for them. If you discover them after you have already launched, catching up is far more expensive.

Next: [Authorized Representatives Under MDR: When You Need One and How to Choose](/blog/021-authorized-representatives).

---

*This post is part of the [MDR Fundamentals & Regulatory Strategy](https://zechmeister-solutions.com/en/blog/category/mdr-fundamentals) cluster in the [Subtract to Ship: MDR Blog](https://zechmeister-solutions.com/en/blog). For EU MDR certification consulting, see [zechmeister-solutions.com](https://zechmeister-solutions.com).*