Article 15 of the MDR requires a Person Responsible for Regulatory Compliance (PRRC) with specific qualifications. For a startup with three people and a limited budget, the question is immediate: do I need to hire a full-time regulatory professional, or are there other options?

The answer depends on your company size, your device complexity, and how you structure the role. Here are the practical options.

The Short Answer

If your startup qualifies as a micro or small enterprise under EU Recommendation 2003/361/EC, you do not need a full-time, in-house PRRC. You need someone "permanently and continuously at your disposal" — which can be an external professional under a contractual arrangement.

If your startup does not qualify (more than 50 employees or turnover exceeding EUR 10 million), the PRRC must be within your organization — meaning an employee or a person in a comparable position within your organizational structure .

What Counts as a Micro or Small Enterprise?

EU Recommendation 2003/361/EC defines:

Micro enterprise: Fewer than 10 employees AND annual turnover or annual balance sheet total not exceeding EUR 2 million.

Small enterprise: Fewer than 50 employees AND annual turnover or annual balance sheet total not exceeding EUR 10 million.

Most early-stage MedTech startups qualify as micro or small enterprises. If you have recently raised significant funding, check whether your balance sheet total has pushed you above the thresholds — venture capital on your balance sheet counts.

Also be aware that if your startup is part of a larger corporate group, the headcount and financial thresholds may be calculated at the group level, not the individual entity level. The Recommendation has specific rules for linked and partner enterprises .

Option 1: Founder as PRRC

If a co-founder meets the qualification requirements — either a relevant degree plus one year of device regulatory/QMS experience, or four years of such experience — they can serve as the PRRC.

When this works: - The founder has a relevant background (biomedical engineering, regulatory affairs, quality management in devices) - The startup is in early stages and the founder can dedicate sufficient time to PRRC duties alongside other responsibilities - The device is not extremely complex (a single product with well-understood requirements)

When this does not work: - The founder has no regulatory or quality background — the qualification requirements are specific and cannot be waived - The founder is so consumed by other duties (fundraising, product development, sales) that PRRC responsibilities get neglected - The device requires deep regulatory expertise that a generalist founder cannot provide

Cost: Zero direct cost, but significant opportunity cost if the founder's time is diverted from other critical activities.

Option 2: External PRRC (Contracted Professional)

For micro and small enterprises, the most common solution is contracting an external PRRC — a regulatory affairs professional who serves as your PRRC under a formal agreement.

How it works: - You identify a qualified regulatory affairs professional (freelance consultant, or an employee of a regulatory consultancy) - You sign a PRRC agreement defining scope, availability, responsibilities, and compensation - The PRRC conducts regular reviews of your regulatory compliance status - The PRRC is available for ad-hoc questions, decisions, and urgent matters - The PRRC's involvement is documented for audit purposes

What "permanently and continuously at your disposal" means in practice: - Regular scheduled interactions (monthly reviews at minimum, weekly during critical phases) - Guaranteed response times for urgent matters (same-day for serious incidents, 24-48 hours for routine questions) - Active involvement in key decisions (product release, change management, incident evaluation) - Not a rubber-stamp arrangement — the PRRC must actually review and oversee

Typical cost: EUR 500–3,000 per month depending on the PRRC's experience level, the scope of the engagement, the complexity of your device, and the frequency of interaction [Flag as estimate — costs vary widely].

Advantages: - Access to experienced professionals without a full-time salary - Flexibility to scale engagement up or down as needed - External perspective can catch issues that insiders overlook - Often faster to arrange than hiring a full-time employee

Risks: - The external PRRC may not understand your internal processes as deeply as an in-house person - Multiple clients may dilute their availability during peak periods - The contractual arrangement must genuinely satisfy "permanently and continuously" — a consultant you speak to once a quarter does not qualify - If the external PRRC terminates the arrangement, you need a replacement immediately

Option 3: Part-Time Hire

If your budget allows and the external PRRC arrangement does not provide sufficient integration, a part-time regulatory affairs hire can serve as your PRRC.

How it works: - Hire a qualified regulatory affairs professional on a part-time basis (e.g., 2–3 days per week) - The person is formally part of your organization, with defined reporting lines - They split their time between PRRC duties and other regulatory/quality tasks - As your startup grows, the role can expand to full-time

Cost: EUR 3,000–6,000 per month for part-time engagement (depending on experience and location) [Flag as estimate].

Advantages: - Better integration than an external PRRC - Deeper understanding of your product and processes - Can contribute to other regulatory and quality tasks - Clear employment relationship simplifies the "within their organisation" question for companies above the micro/small threshold

Risks: - Higher cost than an external PRRC - Part-time availability means they are not always present for urgent matters - Finding the right person — someone with the right qualifications who is willing to work part-time — can take time

Option 4: Full-Time Regulatory Affairs Hire

For startups approaching or exceeding the micro/small enterprise thresholds, or for complex devices requiring intensive regulatory oversight, a full-time regulatory affairs professional serving as PRRC is the most robust option.

When this is justified: - Your device is Class IIb or Class III with complex regulatory requirements - You have multiple devices or a device portfolio - You are preparing for initial certification and need dedicated regulatory capacity - You have the budget to support a full-time hire

Cost: EUR 50,000–100,000+ per year for a qualified regulatory affairs professional, depending on experience and location [Flag as estimate].

How to Evaluate an External PRRC

If you go the external route, evaluate candidates on:

1. Qualification verification. Review their diploma/degree and CV against Article 15 requirements. Ask for specific examples of their regulatory or QMS experience with medical devices. Do not take claims at face value — as Tibor says, "We have a dedicated expert" is one of the most dangerous sentences in MedTech.

2. Device category expertise. A PRRC experienced with Class III implantable devices may not be the right fit for a software medical device startup, and vice versa. Look for relevant experience in your device category.

3. Availability commitment. Get written commitments on response times and minimum availability. "Permanently and continuously at your disposal" must be contractually defined, not assumed.

4. References. Ask for references from other companies where they serve (or have served) as PRRC. Ask those references about responsiveness, depth of involvement, and value added.

5. Audit experience. Has the candidate been a PRRC during a Notified Body audit? Can they describe what the auditor checked regarding their PRRC role and how they demonstrated compliance?

What Documentation Do You Need?

For your PRRC arrangement, document:

  • PRRC appointment letter — formal designation of the person as PRRC, signed by management
  • Qualification evidence — copies of diplomas, CV, and evidence of relevant experience
  • PRRC agreement (if external) — contractual terms defining scope, availability, responsibilities, and termination provisions
  • Activity records — records of PRRC reviews, decisions, and oversight activities (meeting minutes, review reports, sign-off records)
  • Organizational chart — showing the PRRC's position and reporting lines

This documentation will be reviewed during your Notified Body audit. Having it ready, organized, and complete avoids a common but entirely preventable non-conformity finding.

The Bottom Line

The PRRC requirement is not a burden for startups that plan for it. Micro and small enterprises have genuine flexibility under Article 15(2), and the external PRRC model is well-established and widely accepted by Notified Bodies.

The key is to make the arrangement genuine. An external PRRC who actually reviews your compliance status, who is actually available when you need them, and who actually has the authority to influence your decisions is an asset. A PRRC in name only — someone whose signature appears on documents but who has no real involvement — is a risk.

Choose your PRRC based on competence and commitment, not just cost. And get the arrangement in place before your Notified Body audit, not during it.

Next: MDR Transition Periods Explained: What Still Applies and What Has Changed by 2026.