Hazard analysis, verification testing, autonomy classification, and the regulatory pathway for certifying an increasingly autonomous surgical robot as safe
Before a single hazard is analyzed or a single test is run, regulators and sponsors must agree on a foundational question: how autonomous is this system, really? In 2017, Yang, Cambias, Cleary, and colleagues published a landmark framework in Science Robotics defining six discrete levels of surgical robot autonomy (Level 0 through Level 5), explicitly designed to give regulators, clinicians, and manufacturers a shared vocabulary for a spectrum that had previously been described only in vague marketing terms like "smart" or "AI-assisted."
The Yang et al. taxonomy defines each level by exactly where decision-making authority sits between the human surgeon and the machine:
• Level 0 — No Autonomy: pure teleoperation. The da Vinci Surgical System is the canonical example — every motion of the instrument tip is a direct, scaled mapping of the surgeon's hand movement at the console. The robot has zero independent judgment; it is a sophisticated motion-transmission device.
• Level 1 — Robot Assistance: the system provides continuous mechanical assistance (tremor filtering, motion scaling, virtual fixtures/no-fly zones) but the surgeon still directs every movement in real time.
• Level 2 — Task Autonomy: the robot autonomously executes a specific, bounded sub-task under direct human supervision — for example, autonomous suturing of a defined anastomosis segment, with the surgeon supervising and able to halt instantly.
• Level 3 — Conditional Autonomy: the system autonomously completes a defined surgical task and only asks for human input when it encounters a scenario outside its trained/validated envelope. The human is "on-demand," not continuously watching every motion.
• Level 4 — High Autonomy: the robot performs an entire surgical procedure (or a large multi-step segment) under high-level human supervision, with the human present but not directing individual actions — analogous to a surgical resident operating with an attending observing.
• Level 5 — Full Autonomy: the system makes all decisions and executes the entire procedure without any human intervention. No surgical robot has achieved regulatory clearance at this level as of the mid-2020s, and most bioethicists and regulators treat it as a long-term aspirational category rather than a near-term submission target.
The Smart Tissue Autonomous Robot (STAR), developed at Johns Hopkins, demonstrated autonomous soft-tissue suturing (intestinal anastomosis) in live animal trials with outcomes that in some metrics outperformed expert human surgeons — widely cited as the first credible research-grade demonstration of Level 3 conditional autonomy in soft tissue, though STAR remains a research platform, not an FDA-cleared clinical product.
The autonomy level assigned at this first stage cascades through every subsequent regulatory decision. A Level 0–1 device can often piggyback on existing 510(k) predicate devices, because its fundamental mode of operation — a surgeon's hand controlling every motion — is not meaningfully different from decades of cleared teleoperated systems. But once a device crosses into Level 2 and beyond, the FDA's risk calculus changes qualitatively: the software itself is now making clinically consequential decisions (where to cut, how much force to apply, when a suture is complete) without a human directly commanding that specific action.
This is precisely the boundary the FDA's guidance on AI/ML-based Software as a Medical Device (SaMD) is built around, and it is why the classification step is never purely academic — it determines whether a manufacturer files a comparatively fast 510(k), a De Novo request establishing an entirely new device classification, or a full Premarket Approval (PMA) application with mandatory pivotal clinical trials. Misclassifying a device's autonomy level (intentionally or not) is one of the most common reasons a submission is later flagged for additional scrutiny or a Refuse-to-Accept decision.
Once the autonomy level is fixed, the sponsor must exhaustively enumerate everything that could go wrong. Failure Mode and Effects Analysis (FMEA), conducted under the international risk-management standard ISO 14971, is the structured method for identifying every plausible failure mode of an autonomous surgical robot — from a dropped camera frame to a corrupted force-sensor reading — and scoring each one so that engineering effort is directed at the failures that matter most.
FMEA proceeds failure mode by failure mode through every subsystem — perception (endoscopic cameras, force/torque sensors, tissue classifiers), decision-making (path planning, task-completion logic), and actuation (robotic arm motors, end-effector grippers). For each identified failure mode, a cross-functional team of engineers, clinicians, and quality/regulatory staff scores three independent dimensions on a 1–10 scale:
• Severity (S): the clinical consequence if the failure occurs and reaches the patient unmitigated — a 10 might represent an unrecoverable vascular injury; a 2 might represent a brief, inconsequential delay.
• Occurrence (O): how frequently the failure is expected to occur, based on component reliability data, software testing history, and analogous device field data.
• Detectability (D): how likely existing design controls are to catch the failure before it causes harm — a 10 means the failure is essentially undetectable until harm occurs; a 1 means it is caught with near-certainty by an independent safety interlock.
Multiplying the three scores yields the Risk Priority Number (RPN), ranging from 1 to 1,000. Failure modes with the highest RPNs — not necessarily the most severe in isolation, but the worst combination of severe, frequent, and hard-to-detect — are prioritized for design mitigation: redundant sensors, independent safety interlocks, hardware force limiters, or software sanity-checking layers. After each mitigation is implemented, the failure mode is re-scored, and the residual RPN is tracked until it falls below the sponsor's pre-defined acceptability threshold, typically in the single digits to low tens for anything touching the autonomous control loop.
Traditional surgical device FMEA focused overwhelmingly on mechanical and electrical failure modes — a motor stalling, a cable fraying, a power supply browning out. Autonomous systems introduce entire new hazard categories that classical medical device risk management was never built to catalogue:
• Sensor dropout or degradation: a stereo-endoscopic camera losing depth accuracy in blood-obscured fields, or a force-torque sensor drifting out of calibration mid-procedure.
• Actuator faults under autonomous command: a joint motor executing a commanded trajectory with reduced torque, producing under- or over-shoot the autonomous controller does not immediately detect.
• Software exceptions and edge-case failures: a tissue-classification neural network encountering anatomy outside its training distribution (unusual anatomy, prior surgical scarring, an unexpected bleed) and producing a confidently wrong classification rather than a graceful "I don't know."
• Latency and synchronization faults: autonomous decision loops that assume a fixed sensor-to-actuator latency budget, which can be violated under real-world computational load.
• Human-override interaction hazards: a surgeon attempting to intervene during an autonomous task and the handback transition itself introducing a brief control gap.
Because several of these failure modes are software-driven and probabilistic rather than purely mechanical and deterministic, occurrence and detectability scoring increasingly draws on statistical characterization of machine-learning model behavior — confusion matrices, out-of-distribution detection rates — rather than classical component mean-time-between-failure data.
Hazard analysis identifies what could fail; verification and validation (V&V) testing proves, empirically and at scale, how often it actually does. For an autonomous surgical robot, this means moving from tabletop bench testing through cadaveric trials to live animal-model studies, accumulating enough trials to statistically bound the probability of rare but catastrophic failure — and to confirm that every fail-safe trigger fires reliably when the system's autonomous behavior drifts outside its validated envelope.
V&V for an autonomous surgical robot follows a testing pyramid of increasing fidelity and decreasing volume, mirroring software engineering practice but adapted to a physical, safety-critical medical device:
1. Bench and simulation testing (base of the pyramid, highest volume): synthetic tissue phantoms, digital twins, and Monte Carlo simulation of sensor noise and actuator faults allow tens of thousands of trials to be run cheaply and rapidly. This tier is where statistical boundary-condition testing happens — deliberately injecting corrupted sensor frames, delayed actuator responses, and out-of-distribution visual inputs to confirm the autonomous controller detects the anomaly and hands control back safely rather than continuing to act on bad information.
2. Cadaveric testing (middle tier): human cadaveric tissue provides realistic anatomical geometry, tissue mechanical properties, and surgical workflow fidelity that synthetic phantoms cannot fully replicate, at the cost of far lower trial volume — typically dozens to low hundreds of procedures.
3. Live animal-model (GLP) studies (top of the pyramid, lowest volume, highest fidelity): Good Laboratory Practice-compliant survival and non-survival animal studies (typically porcine, given anatomical similarity to humans for many soft-tissue procedures) validate that the autonomous system performs safely in a living physiological environment — with active bleeding, tissue motion from respiration, and immune/healing response over survival-study follow-up periods. These studies are the most expensive and lowest-throughput tier, but they are the tier regulators weight most heavily, because they are the closest available proxy to human clinical use before first-in-human trials.
A central statistical challenge in autonomous surgical robot validation is that the failure rates regulators care about most — catastrophic, irreversible harm — are, by design, extremely rare, which makes them extremely hard to bound with confidence from a finite number of trials. The commonly cited "rule of three" states that if zero failures are observed in n trials, the upper bound of the true failure rate (at roughly 95% confidence) is approximately 3/n. To claim with reasonable confidence that a catastrophic failure mode occurs less often than 1 in 10,000 procedures, a sponsor needs on the order of 30,000 clean trials targeting that specific failure mode — a volume achievable only through the simulation and bench tiers, since no cadaveric or animal program can realistically run tens of thousands of physical trials.
This is why the testing pyramid's tiers are not merely a cost-management convenience but a statistical necessity: simulation supplies the sample size needed for rare-event confidence bounds, while cadaveric and animal studies supply the realism needed to validate that the simulation itself is a trustworthy model of real surgical conditions in the first place. A validation program that is statistically powered but never confirmed against physical tissue, or physically realistic but too small to bound rare-event rates, both fail to satisfy what regulators expect to see in a V&V dossier for a high-autonomy device.
With hazard mitigations in place and V&V data in hand, the sponsor must choose and execute a regulatory submission pathway. For autonomous surgical robots, the traditional 510(k) route — clearance by demonstrating "substantial equivalence" to an already-marketed predicate device — generally breaks down, because autonomous decision-making has no adequate predicate to compare against. That leaves the De Novo classification request or the far more demanding Premarket Approval (PMA) pathway, both of which require a clinical evidence package and detailed algorithm transparency documentation that 510(k) submissions never had to produce.
The 510(k) pathway, which clears the overwhelming majority of medical devices in the United States, rests on a single legal question: is the new device "substantially equivalent" to a legally marketed predicate in terms of intended use and technological characteristics? This framework works well for incremental hardware iterations — a new generation of teleoperated robotic arm with better ergonomics is substantially equivalent to its predecessor. It works far less well the moment a device's core technological characteristic is a machine-learning system making autonomous clinical decisions, because there is frequently no predicate device that made comparable autonomous decisions in the first place — the very feature under review is often novel by definition.
The FDA's discussion papers and guidance on AI/ML-based Software as a Medical Device (SaMD), building on the IMDRF (International Medical Device Regulators Forum) SaMD risk framework, explicitly recognize this gap. Where a device does have a reasonable predicate for its non-autonomous functions but introduces genuinely new autonomous capability, the De Novo pathway — which creates a new device classification for novel low-to-moderate-risk devices lacking a predicate — is frequently the appropriate route. Where the autonomous function carries high enough risk (a Level 4–5 device operating with minimal human oversight during active tissue manipulation), the FDA is more likely to require the full PMA pathway reserved for Class III devices, with its mandatory well-controlled pivotal clinical trials.
The clearest available precedent for autonomous-decision medical devices is IDx-DR (now marketed as LumineticsCore), authorized by the FDA in 2018 via the De Novo pathway as the first autonomous AI diagnostic system permitted to render a clinical screening decision — detecting more-than-mild diabetic retinopathy — without a clinician reviewing or confirming the image interpretation. Its pivotal trial, conducted across primary care sites, reported a sensitivity of 87.4% and specificity of 90.5% against the disease reference standard, numbers that became the benchmark against which subsequent autonomous-AI device submissions are informally measured.
While IDx-DR is a diagnostic rather than a surgical device, its authorization established the template FDA reviewers now expect for any device making autonomous clinical determinations: a fully specified intended-use population, a locked (non-adaptive) algorithm at time of authorization, and — critically for surgical robots — detailed algorithm transparency documentation. For an autonomous surgical system, this documentation package typically includes model architecture descriptions, training and validation dataset provenance and demographic composition, performance stratified across anatomical and patient subgroups, an explicit statement of the system's operational design domain (the conditions under which autonomous operation is validated versus where it must hand control back to the surgeon), and — increasingly, per FDA's 2023 guidance on Predetermined Change Control Plans (PCCPs) — a pre-specified protocol for how the algorithm may be updated post-approval without triggering a brand-new submission.
Regulatory certification is not an endpoint; for an autonomous surgical robot it is the start of an ongoing obligation. Approved systems require continuous real-world performance monitoring, formal adverse-event reporting, and — because software changes constantly in ways hardware never did — a defined revalidation protocol every time the underlying algorithm is updated. Post-market surveillance is where the gap between a device's pivotal-trial performance and its performance across the full diversity of real clinical practice becomes visible.
Unlike a mechanical implant whose physical properties are fixed at the moment of manufacture, an autonomous surgical robot's software — and the machine-learning models embedded in its perception and decision layers — can continue to evolve after clearance, through routine updates, retraining on new data, or bug fixes. The FDA's 2021 AI/ML-Based SaMD Action Plan and subsequent 2023 guidance on Predetermined Change Control Plans (PCCPs) formalize how this evolution can happen without requiring an entirely new premarket submission for every minor update: a sponsor pre-specifies, at the time of original authorization, the types of modifications anticipated (for example, retraining on an expanded dataset to improve performance on underrepresented anatomy), the methodology for implementing and validating each modification, and the impact assessment that will be performed before deployment.
Critically, every PCCP-covered update still requires its own internal revalidation cycle — confirming that the updated model has not silently degraded performance on cases the original model handled correctly, a failure mode informally known as "regression drift." For a high-autonomy surgical system, sponsors typically commit to running each software revision through a defined subset of the original V&V test suite before field deployment, and to comparing real-world field performance metrics against the original pivotal-validation benchmark on a recurring basis — flagging any statistically significant divergence for regulatory disclosure.
Once in clinical use, any death, serious injury, or device malfunction that could contribute to death or serious injury involving the autonomous system must be reported through the FDA's Medical Device Reporting (MDR) regulation, populating the publicly searchable MAUDE database. For a novel, high-autonomy device, the FDA also holds Section 522 authority to compel the manufacturer to conduct a formal post-market surveillance study as a condition of continued marketing — used specifically when a device's failure could have serious health consequences, when it is expected to have significant use in pediatric populations, or when it is intended to be implanted for more than a year, criteria a high-autonomy surgical platform can plausibly meet on the first count alone.
The fundamental purpose of this entire final stage is closing the loop between the statistically bounded, controlled-environment performance demonstrated during V&V testing and the messier, more heterogeneous reality of distributed clinical use across many hospitals, patient populations, and surgical teams with varying levels of experience supervising an autonomous system — the same gap that motivated the entire certification pipeline in the first place.
The FDA's 2018 De Novo authorization of IDx-DR — the first FDA-authorized autonomous AI device permitted to render a clinical determination without physician confirmation — remains the regulatory template most often cited for higher-autonomy surgical robotics. Its companion post-market surveillance protocol tracks real-world sensitivity and specificity against the original 87.4%/90.5% pivotal-trial benchmark, the exact continuous validation-versus-real-world comparison an autonomous surgical robot's Level 4–5 approval would require — at a dramatically higher stakes bar, given that a missed diagnostic flag and an uncorrected autonomous incision carry very different consequences.