How small medical-device manufacturers organise regulatory compliance

A small medical-device manufacturer faces regulatory obligations that are largely comparable to a multinational's. The EU MDR — Regulation (EU) 2017/745 — sets no size-based simplified regime: the requirements are driven by the type of device and its risk, not by the manufacturer's resources. The real flexibility it grants the smallest firms is organisational — the option to use an external Person Responsible for Regulatory Compliance (PRRC) — and it opens the way to more modular compliance models, without ever moving the responsibility outside the manufacturer.

A sector dominated by SMEs

The European medical-device sector is, in the European Commission's own words, "characterised by the active role of small and medium-sized enterprises" (EC medical-devices sector overview). The data bears it out: as of June 2026, MD Atlas has indexed 25,807 manufacturers in EUDAMED — an indexed subset of the public data, not the complete database — of which roughly 80% carry five or fewer devices on the public record.

That reading needs nuance. EUDAMED is still incomplete in 2026: many manufacturers have not finished registering their portfolios, some portfolios are only partly visible, and the number of declared devices does not always reflect a company's real size. The trend is nonetheless clear — a large share of the ecosystem is made up of modestly sized players with limited in-house resources. MD Atlas tracks this data as it continues to fill in.

Obligations that barely shrink with the company

This is the central, often-underestimated point. Article 10 of Regulation (EU) 2017/745 — "General obligations of manufacturers" — applies to everyone, whatever the headcount. It requires, among much else, a risk-management system, technical documentation per Annexes II and III, an EU declaration of conformity and CE marking, registration of the manufacturer and its devices (Articles 29 and 31), a quality management system (Article 10(9)) and a post-market surveillance system (Article 10(10)). A five-person company placing a Class IIa device on the market must produce a level of regulatory evidence comparable to a far larger player's.

There is, however, a notion of proportionality: the quality system and post-market surveillance scale to the type of device and its risk, clinical requirements are modulated by risk and equivalence, and several MDCG guidances explicitly acknowledge the constraints SMEs face. This is not a structural carve-out — it is the same obligations, scaled.

The one explicit relief: an external PRRC

The MDR's single concession to small scale is Article 15(2), and it is precise:

"Micro and small enterprises within the meaning of Commission Recommendation 2003/361/EC shall not be required to have the person responsible for regulatory compliance within their organisation but shall have such person permanently and continuously at their disposal."

The thresholds come from Commission Recommendation 2003/361/EC: a micro enterprise has fewer than 10 staff (and ≤ €2 million turnover or balance-sheet total); a small enterprise has fewer than 50 (and ≤ €10 million). Below those lines, you may have an external PRRC — provided that person genuinely meets the Article 15(1) qualifications, is continuously available, and has a role genuinely embedded in the organisation. The EC's SME definition is the reference for where you sit.

One point must stay clear: the PRRC has a supervisory, verifying function, and legal responsibility for compliance stays entirely with the manufacturer — even when that function is outsourced. Outsourcing the PRRC therefore does not move the compliance work out of the company; it gives access to a qualified skill without carrying it on payroll.

Often-hybrid organisational models

In practice, SMEs rarely run a fully in-house or fully outsourced model. The most common setups are hybrid: an in-house quality / regulatory-affairs lead, a PRRC who may be internal or external, and specialists engaged as needed. The model combines in-house control with targeted expertise.

A single quality / regulatory-affairs consultant can hold the PRRC function for several manufacturers at once, working alongside each company's leadership and existing regulatory team. Around that function, a network of external specialists can cover the MDR/IVDR submissions, the ISO 13485 quality system, the clinical evaluation (CER) and post-market vigilance — each expertise drawn in when it is needed, rather than added as a permanent headcount.

Vetting expertise in a distributed model

The flip side of a partly external model is verifying competence: you are placing responsibility with people outside your walls. The public EUDAMED record helps you cross-check several facts. When a provider names past clients, you can search the registered actors for those manufacturers, confirm their SRN, review the devices they declared, and read the notified-body certificates behind the higher-risk ones.

Its limits matter just as much: EUDAMED does not identify the people who contributed to a file, draws no direct link between a consultant and a device, and does not reflect a provider's operational history. It lets you cross-reference information — not validate an individual's experience directly.

Structuring access to expertise

This is exactly where a specialist directory helps. EUDAMED is not an expert directory — but MD Atlas's QA/RA directory builds one on top of it, cross-matching professionals against the verifiable EUDAMED actors of record. Several external PRRCs are already listed there, along with many people who can support you in that role near you. Such a tool does not replace the manufacturer's own due diligence, but it reduces the uncertainty of choosing an external partner.

Conclusion

The MDR imposes demanding obligations that are largely independent of company size. For a small organisation the challenge is therefore not to shrink those requirements, but to find a viable way to meet them. The option of an external PRRC is a key flexibility, part of a broader shift toward hybrid models — limited in-house resources paired with targeted external expertise. The duties are not negotiable; how you organise them is open, and becomes a strategic lever for small manufacturers. For the legal text, Articles 10 and 15 of the MDR are the reference.