Maintenance and medical device vigilance: the duties of a defibrillator operator

Under medical device law, the operator is the individual or legal entity that uses the device or makes it available. For an automated external defibrillator, this is usually a French public-access building (ERP, etablissement recevant du public), a company or a local authority. It is not the supplier, the installer or the maintenance contractor: legal responsibility remains attached to the organisation that owns or holds the device, even when servicing is entrusted to a third party.

This operator status begins the moment the device is installed. Public-access buildings in categories 1 to 3 have been required to be equipped since 1 January 2020, category 4 buildings since 2021 and certain category 5 buildings since 2022. Many managers remember the duty to install equipment but overlook the maintenance duty that follows on from it, even though the second is what makes the first worthwhile.

Article L. 5212-1 of the Code de la sante publique requires the operator of a covered medical device to ensure that its performance is maintained and that it is properly serviced. It also governs the certificate of conformity required when a second-hand device is resold. Ordonnance no. 2022-582 of 20 April 2022 (French government order) rewrote this article to align national law with Regulation (EU) 2017/745, with definitions and the vigilance regime now referring to the European framework, while the ANSM remains the competent authority in France.

In practical terms this means three things. First, follow the servicing recommendations set out in the manufacturer's instructions for use, which are the reference point during an inspection. Second, appoint an internal member of staff responsible for monitoring the device, with a named deputy for holiday periods. Third, keep a written record of every intervention. A defibrillator serviced without traceability is, in an inspector's eyes, the same as a defibrillator that has never been serviced.

Decret no. 2026-299 of 17 April 2026 on medical devices (French implementing decree), published in the Journal officiel of 21 April 2026, completes the alignment of the Code de la sante publique with Regulation (EU) 2017/745. The operator's maintenance and quality control duties are reorganised in articles R. 5212-14 to R. 5212-26. National law retains its own concepts of operator, maintenance and quality control, while the technical definitions refer to the European text. The list of devices subject to the maintenance and quality control requirement is now published by the ANSM.

The decree sets out what the operator must keep: an up-to-date inventory of its devices, an organised maintenance and quality control arrangement, and a log of operations retained for five years. For an organisation with one or two defibrillators, a binder or a shared file is enough, provided it is genuinely filled in and survives the departure of whoever was keeping it.

If your maintenance contracts quote outdated regulatory references, have them updated: the renumbering introduced by the decree makes some contractual wording obsolete without changing the nature of the service itself.

An automated external defibrillator runs its own self-tests at intervals set by the manufacturer and reports its status through a visual or audible indicator. That indicator is the operator's first maintenance tool, and the cheapest one. A visual check folded into an existing walk-round, the fire safety inspection for instance, makes it possible to spot a faulty device before anyone needs it. Note the date and the result of every check.

Consumables are the other point to watch. Electrode pads usually expire after two to five years and batteries after three to five years, for a device with a service life of eight to ten years or more. These dates are printed on the items themselves. Transfer them to a shared calendar with an alert two months ahead, because a DAE (AED) with expired pads remains a device that fails the requirement to maintain performance. After every real-life use, the pads must be replaced immediately. Our article on the service life of a defibrillator sets out these replacement cycles in detail.

Article L. 5212-2 of the Code de la sante publique sets up the medical device vigilance system: any healthcare professional or professional user who becomes aware of a serious incident involving a medical device must report it without delay to the Agence nationale de securite du medicament et des produits de sante (the French medicines and health products safety agency). Ordonnance no. 2022-582 of 20 April 2022 brought this vigilance regime into line with the European framework.

In practice, a serious incident covers a malfunction or a degradation in the device's performance during a rescue attempt. Three reflexes are essential. Set the device aside and do not return it to service until the cause has been identified. Keep the items used, including the electrode pads, along with the recorded data. Write up a factual note straight away giving the date, the time, the people present and the behaviour observed, then send the report to the ANSM and inform your maintenance provider. The reverse flow matters too: vigilance alerts and recalls issued by the agency must be acted upon for the devices you have installed.

Article L. 5212-1 provides for penalties where the maintenance and performance duties are breached. Beyond the risk of a penalty, a lack of traceability leaves the organisation exposed on the day a device fails during a cardiac arrest: without a log, it becomes extremely difficult to demonstrate that servicing was actually carried out.

The resale of a second-hand medical device is also conditional on a certificate being drawn up beforehand, together with a file containing, among other things, the maintenance information and the quality control reports. Passing an old defibrillator on to a charity or another organisation therefore requires its history to have been kept, which is a second reason to maintain the log properly.

For many organisations, the simplest answer is to outsource the monitoring. Rental from 50 euros excl. VAT per month includes maintenance and replacement of consumables, which shifts the operational burden without shifting legal responsibility: the operator still has to check that the services are delivered and documented. If you buy outright, the five-year warranty covers the hardware, but tracking the deadlines is still yours to organise. Our articles comparing rental and purchase, along with our buying guide, will help you decide according to your organisation's profile.