Authorised Representative Under MDR: Obligations, Liability, and How to Choose One

Why this relationship matters more than it looks

If your company is based outside the EU and you want to place a medical device on the EU market, you must designate an EU-based Authorised Representative before you can do anything else. The AR is not a mailbox or a local address for correspondence — under MDR they carry real legal accountability, and regulators have started treating them that way. Getting the AR relationship right means understanding exactly what the agreement must cover, what the AR is actually responsible for, and what you need to maintain on your side to keep the relationship functional and legally valid.

Under MDR Article 11, manufacturers established outside the EU must designate a single Authorised Representative who is established in the EU. The AR must be designated by explicit mandate — a written agreement that specifies what the AR is empowered and obligated to do on the manufacturer's behalf. The AR must be registered in EUDAMED and must appear in the Declaration of Conformity. If you change your AR, that change must be reflected in the EUDAMED record, the DoC, and the device labelling — all three, not just one.

The AR's obligations under MDR are set out in Article 11(3). They are extensive and should not be taken lightly by either party:

• The AR must register the manufacturer and the devices in EUDAMED on the manufacturer's behalf, or verify that this registration has been completed. This includes maintaining the registration — keeping it current, not just doing it once.
• The AR must verify that the Declaration of Conformity has been drawn up and that technical documentation has been drawn up and, where required, reviewed by a Notified Body.
• The AR must keep a copy of the technical documentation, the Declaration of Conformity, and the relevant NB certificate, and make these available to competent authorities upon request.
• The AR must cooperate with competent authorities on any preventive or corrective measures, including field safety corrective actions (FSCAs). This means the AR needs to be reachable, responsive, and capable of actually acting — not just nominally available.
• The AR must inform the manufacturer immediately if there is reason to believe the device does not conform to MDR requirements.
• If the manufacturer fails to fulfill their MDR obligations, the AR can be held liable — including financially — by competent authorities. Article 11(5) makes clear that the AR's liability is not theoretical.

That last point is the one that changes the nature of the relationship. Many non-EU manufacturers approach the AR relationship as an administrative formality. Many AR service providers on the market operate as such. But a reputable AR who understands their MDR exposure will — and should — want to review your technical documentation, understand your compliance status, and have a structured process for receiving safety information and field safety updates. If an AR is willing to sign without any of this, that should be a signal about their actual capacity to fulfill their MDR obligations.

For non-EU manufacturers, the practical requirements from the AR's perspective translate into obligations on your side. The AR cannot maintain the EUDAMED registration without timely input from you on device changes, certificate renewals, and registration updates. The AR cannot cooperate with a competent authority investigating a serious incident without access to your documentation and rapid communication from your team. The AR agreement should specify: how information flows between you, what your response timelines are for safety communications, how device changes or certificate changes get communicated to the AR before they take effect, and what happens if the agreement is terminated — including the transition obligations to ensure continuous representation.

One area that catches manufacturers off guard: the EUDAMED registration obligation cannot be delegated back to the manufacturer as a practical matter. The AR is the registered economic operator in the EU. Even if your internal team does the data entry work, the AR is the accountable party for the accuracy and currency of the EUDAMED record. AR agreements that simply say "the manufacturer will handle EUDAMED" without specifying the AR's oversight role create accountability gaps that can become problems when a competent authority asks why the EUDAMED record is out of date.

Changing your AR after CE marking is also more involved than most manufacturers expect. EUDAMED must be updated, the Declaration of Conformity must be revised (with a new date and signature), and if the AR's name or address appears in the device labelling or IFU, those must be updated before the newly labelled devices are placed on the market. The outgoing AR must also maintain confidentiality of the manufacturer's technical information post-termination. All of this should be covered in the original mandate agreement — not negotiated when the relationship is already ending.