Authorised Representative Obligations for Non-EU Manufacturers

The AR is not just a postal address

One of the most persistent misunderstandings about the Authorised Representative role is that it is administrative — a contact point for Competent Authorities, a name on the Declaration of Conformity. That framing undersells the legal reality significantly. Under Article 11 of MDR, the AR has real obligations and can face real enforcement consequences. If a non-EU manufacturer has not thought carefully about how the AR relationship is structured, both parties are exposed.

The AR must be established in an EU Member State. They act on the manufacturer's behalf with respect to the manufacturer's obligations under MDR — but they cannot transfer liability they do not have the information and authority to discharge. This is where most problems originate: the manufacturer appoints an AR, sends them the DoC, and assumes the relationship is done. The AR, meanwhile, does not have access to the technical documentation, has no visibility into complaints or field events, and is not looped in on design changes. When a Competent Authority comes asking questions, the AR has nothing to provide.

What the AR is legally responsible for

Under Article 11(3), the AR is the manufacturer's registered contact for the purpose of:

• Registering the manufacturer and the devices in EUDAMED
• Verifying that the EU DoC and technical documentation have been drawn up and are kept up to date
• Reporting serious incidents and field safety corrective actions to Competent Authorities and EUDAMED
• Cooperating with Competent Authorities on any action taken in relation to the manufacturer's devices, including providing technical documentation on request

This last point is where liability becomes concrete. If a Competent Authority requests technical documentation and the AR cannot provide it — because the manufacturer has not shared it — the AR is in breach of their obligation. Competent Authorities have the power to take action against the AR directly.

The AR is also the point of contact on labelling and packaging. The AR's name and address must appear on the device label (or the outer packaging). This means the AR's identity is publicly associated with the device on every unit sold in the EU.

Where non-EU manufacturers leave gaps

The information gap. The most common structural problem is that the manufacturer does not give the AR systematic access to the documents they need. This includes: the complete technical documentation (not just the DoC), serious incident reports and vigilance data, complaint records, post-market surveillance data, any design changes, and NB correspondence. An AR who is kept at arm's length cannot discharge their obligations — and if something goes wrong, they may not have the information they need to respond.

The response gap. Competent Authorities can move quickly when there is a safety concern. The AR needs to be able to respond within 24–48 hours in serious situations. If the AR is a small service company handling hundreds of clients, or if the manufacturer is in a significantly different time zone with no escalation protocol, that speed of response may not be achievable. Non-EU manufacturers should think about this before selecting an AR based purely on cost.

The change notification gap. When the manufacturer makes a significant change to the device — revised design, new intended use, changed manufacturing process — the AR needs to know before the change reaches the market, not after. Without a structured change notification process, the AR's knowledge of the device can become stale, which means their EUDAMED registration data may be inaccurate.

The contract gap. Many AR contracts are thin. They confirm the role, list the fee, and say the manufacturer will indemnify the AR. A robust AR contract should also define: what documentation the manufacturer must provide and when, how changes are communicated, the response protocol for Competent Authority inquiries, how the relationship terminates, and what happens to the EUDAMED registration if the relationship ends. An AR that terminates the relationship without a compliant handover can leave the manufacturer unable to sell in the EU until a new AR is in place and EUDAMED is updated.

What a well-functioning AR arrangement looks like

A good AR relationship is not passive. The AR should receive:

• Technical documentation package at certification and after each update
• Copies of all serious incident reports and FSCAs at the time they are filed
• Change notifications before significant changes are implemented
• Annual (at minimum) updates on the PMS status and any new regulatory developments that affect the device

The manufacturer should have a named contact at the AR, not a general inbox, and should have a defined escalation path for urgent situations. For manufacturers with multiple devices or a high regulatory risk profile, some larger AR providers offer active account management — check whether your volume justifies this.

The AR's own PRRC (Person Responsible for Regulatory Compliance) needs to be familiar with the manufacturer's devices — not just hold a file of documents. In a Competent Authority inspection, the AR may be asked questions about the device's clinical evidence, risk classification rationale, or post-market data. An AR who cannot answer those questions adequately is a liability, not a safeguard.

Changing your AR

If the relationship with an AR ends — for any reason — the transition needs to be managed carefully. The departing AR's information needs to be removed from EUDAMED, the new AR needs to be registered, the DoC needs to be reissued with the new AR's details, and the labelling on all device packaging needs to be updated before devices with the old AR's name on them can continue to be placed on the market.

This process takes time and coordination. Non-EU manufacturers should not change AR providers without thinking through the transition timeline and its implications for supply chain and stock already in the EU distribution system.