Medical & Healthcare — AR Assessment Protocol

Foreword. This Assessment Protocol determines the Medical & Healthcare Application Rating (AR) letter for a robot model in a declared clinical application class. It scores a pool of criteria — the nine sector criteria of Clause 6 (MED-1…MED-9, 100 points) plus the named intrinsic criteria of Clause 5, each scored once under its own standard and counted here — and expresses the earned points as a percentage of the applicable pool, which maps to a letter C < B < A < AA < AAA (AAA best) by the bands of VRS-GEN-006 §4. Every criterion is bounded by an evidence tier — Unverified, Verified, Certified — so the best attainable letter rises with substantiation, not assertion. This edition supersedes the re-weighted-mean model of the 0.x drafts: no weighting, no separate grade bands, no separate modifiers — the tier limits fall out of the per-criterion ceilings of Clause 6. VRS rates above the medical-device regulatory floor: regulatory clearance is scored evidence (MED-1), and a rating is an opinion on the robot, not on the lawfulness of any deployment. A Medical & Healthcare AR is an opinion above the compliance floor, not a certification, and nothing here implies that any real robot holds a Veyrum rating (ratings are not published). Requirements use “shall”; recommendations use “should”.

1 Scope

1.1 This Protocol defines, for the Medical & Healthcare sector Application Rating: the determination method (Clause 4); the contributing intrinsic criteria drawn into the pool (Clause 5); the nine sector criteria MED-1…MED-9 with their point ladders and tier ceilings (Clause 6); the letter bands, pool ceilings and class applicability (Clause 7); the evidence admissible at each tier (Clause 8); underwriting and credit use (Clause 9); result recording (Clause 10); and the assessor checklist (Clause 11). A worked example is at Annex A.

1.2 The AR shall be issued per application class. The clinical application classes are surgical, rehabilitation/therapy, hospital logistics/service and care/assistive (clinical), per VRS-MED-001 §4. Patient-contact criteria (MED-3) apply to the contact classes (surgical, rehabilitation, care). Sector applicability, the clinical hazard taxonomy and the anchor regime are defined in VRS-MED-001 and are not restated here.

1.3 The AR shall be assessed at one of three tiers — Unverified, Verified, Certified. Each criterion states the maximum points reachable at each tier (Clause 6); the AR tier is the tier whose evidence bar the assessed evidence meets and shall not exceed the model’s Intrinsic Rating tier (VRS-GEN-006 §7). The underlying point aggregation and the letter bands are defined in VRS-GEN-005/006 and are not restated here.

2 Normative references

• VRS-MED-001, Medical & Healthcare — Sector Standard — applicability, clinical application classes, patient-contact hazard groups and the medical-device anchor regime.
• VRS-GEN-005, Intrinsic Rating — Methodology — point aggregation, tiers, cold-start parity and the company-wide fallback rule (§6).
• VRS-GEN-006, Application Rating — Scheme — the letter bands, the applicable-pool percentage and the tier rule.
• VRS-GEN-009, Robot Risk Passport and Registry Schema — the record that carries the AR result.
• VRS-GEN-012, Evidence Grades and Data Requirements — evidence kinds and the tier evidence bars.
• VRS-GEN-101 … VRS-GEN-106, IR Category Standards — the intrinsic criteria contributed under Clause 5.
• IEC 80601-2-77:2019 (+AMD1:2023) — robotically assisted surgical equipment — surgical-class anchor.
• IEC 80601-2-78:2019 (+AMD1:2024) — robots for rehabilitation, assessment, compensation or alleviation.
• IEC 60601-1 family — general basic safety and essential performance of medical electrical equipment.
• ISO 14971:2019 — application of risk management to medical devices.
• ISO 13485:2016 — medical-device quality management systems.
• IEC 62304:2006 — medical-device software life-cycle processes.
• IEC 62443-3-3:2013 — system security requirements and security levels for the connected clinical system.
• Regulation (EU) 2017/745 (Medical Device Regulation) — EU clearance pathway.
• ISO 14224:2016 — reliability and maintenance data.
• Data twin: VRS-MED-501 (generated from this Protocol, never hand-edited).

3 Terms and definitions

Terms per VRS-GEN-001 (aligned to ISO 8373:2021) and VRS-MED-001. Locally:

• pool — the set of criteria whose points determine the AR letter: the nine sector criteria of Clause 6 together with the contributing intrinsic criteria of Clause 5.
• applicable pool — the pool for a given application class after criteria not applicable to that class are removed from both the earned points and the pool range (Clause 4; VRS-GEN-006 §6).
• contributor — an intrinsic criterion scored once under its own IR category standard and counted again in the sector pool at the same points (Clause 5).
• tier — the evidence stringency at which a criterion is assessed: Unverified (public evidence only), Verified (manufacturer evidence pack examined), Certified (behaviour witnessed).
• ceiling — the maximum points a criterion awards at a given tier; points earned are capped at the ceiling of the assessed tier.
• evidence bar — the minimum evidence a criterion requires before any points are awarded; below it the criterion scores 0.
• company-wide fallback — the substitute points a criterion allows from manufacturer-wide evidence when model-specific evidence is unavailable (VRS-GEN-005 §6).
• clinical exposure — the count of procedures or therapy sessions and the units in clinical service, recorded for the field-record criteria (MED-8, MED-9) and for underwriting, not as a scoring input.

4 Method of assessment

4.1 The Medical & Healthcare AR shall be determined as a percentage of the applicable pool and mapped to a letter by the bands of VRS-GEN-006 §4 (Clause 7.1). The pool is the nine sector criteria of Clause 6 (MED-1…MED-9, 100 points) together with the contributing intrinsic criteria of Clause 5, each scored once under its own standard and counted here at the same points. For an application class the assessor shall add the points earned across the applicable criteria and divide by the sum of the point ranges of those same criteria; a criterion not applicable to the class (Clause 6 Applicability row; VRS-GEN-006 §6) shall be removed from both the earned points and the pool range. No weighting is applied — each criterion’s point range sizes its own importance — and no separate modifiers operate on the letter: the tier limits follow from the per-criterion ceilings of Clause 6 (Clause 7.2; VRS-GEN-006 §8).

4.2 Evidence shall be attributable to the declared clinical application class of the assessed envelope — surgical, rehabilitation/therapy, hospital logistics/service, or care/assistive (clinical) (Clause 1.2; VRS-MED-001 §4) — and to operation under clinical governance (hygiene, electromagnetic compatibility, patient-safety reporting); the AR letter covers only the assessed classes and conditions.

4.3 Letters shall be issued per application class where evidence diverges materially between classes; the displayed sector letter shall be the lowest issued class letter. A class for which no letter can be issued shall be displayed as not covered, and the assessed envelope shall contract to the classes the evidence covers.

4.4 Evidence obtained outside a declared application class and its clinical setting — uncontrolled deployments, off-label use or non-clinical bench demonstrations — shall be inadmissible as support for that class (VRS-MED-001 Annex B.1); the letter shall not be extended to procedures never observed under clinical governance.

5 Contributing IR criteria

5.1 The sector pool consists of the sector criteria of Clause 6 and the following intrinsic criteria, scored once under their own standards and counted again here at the same points:

5.2 No other intrinsic criterion contributes. Points, ceilings and applicability of a contributing criterion are those of its own standard; where a contributing criterion is not applicable to the assessed application class it is removed from the pool for that class (VRS-GEN-006 §6).

6 Sector criteria

6.0 Summary. Points and tier ceilings per criterion; totals reproduce by addition.

6.1 MED-1 Regulatory clearance and standing (0–16)

6.2 MED-2 Electrical / ME-equipment safety (IEC 60601 family) (0–10)

6.3 MED-3 Patient-contact force / motion limits (0–14)

6.4 MED-4 Mid-procedure failure behaviour and recovery (0–12)

6.5 MED-5 Sterilisation / hygiene compatibility (0–8)

6.6 MED-6 PHI, connectivity and remote access (0–12)

6.7 MED-7 Service under validated configuration (0–8)

6.8 MED-8 Adverse-event and malfunction record (0–12)

6.9 MED-9 Recall and field-safety-corrective-action conduct (0–8)

7 Letter bands, tier ceilings and class applicability

7.1 Bands (VRS-GEN-006 §4). AAA ≥ 90 % · AA ≥ 75 % · A ≥ 60 % · B ≥ 45 % · C below 45 % of the applicable pool.

7.2 Pool ceilings. Sector criteria alone: Unverified 70/100 (70 %) · Verified 85/100 (85 %) · Certified 100. With the contributing criteria of Clause 5 the pool ceilings are as recorded in VRS-MED-501; in both forms the best attainable letter is A at Unverified, AA at Verified and AAA at Certified (VRS-GEN-006 §8).

7.3 Application classes. surgical · rehabilitation/therapy · hospital logistics/service · care/assistive (clinical). MED-3 applies to contact classes (surgical, rehabilitation, care)… A criterion whose Applicability row excludes the assessed class is removed from both the numerator and the denominator; the letter is issued per class and the displayed letter is the lowest (Clause 4).

7.4 No modifiers, caps or gates operate on the letter other than the ceilings of Clause 6 and the tier rule of VRS-GEN-006 §7.

8 Evidence by tier

8.1 Unverified. The assessor works only from evidence obtainable without the manufacturer’s cooperation: public clearance databases (FDA, EUDAMED, TGA), public certificates (UL/TÜV/CB scheme), 510(k) summary performance testing, instructions-for-use, public security documentation and MDS2 forms, and — for the field-record criteria (MED-8, MED-9) — the MAUDE and EUDAMED adverse-event databases, the FDA recall database and field-safety-notice registers. Each criterion’s Unverified ceiling (Clause 6) is the most an honest reading of such evidence shall earn; the AR tier is Unverified.

8.2 Verified. The assessor additionally examines a manufacturer evidence pack and shall accept, by mapping, the conformity artefacts the manufacturer already holds: the IEC 80601-2-77:2019 (+AMD1:2023) or IEC 80601-2-78:2019 (+AMD1:2024) essential-performance file with the IEC 60601-1 family general-safety evidence and the ISO 14971:2019 risk-management file (MED-1…MED-3); the fault-response validation and service records (MED-4); the reprocessing validation (MED-5); the IEC 62443-3-3:2013 security-level statement, IEC 62304:2006 software life-cycle documentation, SBOM, threat model and PHI data-flow declaration (MED-6); the ISO 13485:2016 service and validated-configuration change-control records (MED-7); and the complaint-handling and field-safety-corrective-action / CAPA records (MED-8, MED-9). Adoption is therefore a mapping, not new testing. Verified ceilings apply only to criteria whose pack items are present and examined; the AR tier is Verified.

8.3 Certified. The assessor witnesses the declared behaviour on the robot and its own console: the alarm states and emergency stop (MED-2); the patient-contact force and motion limits on a phantom with fault injection to hold (MED-3); an induced mid-procedure fault with controlled hold and timed manual recovery (MED-4); the reprocessing of declared components (MED-5); and the access controls, remote-service gating and logging on the console (MED-6). The documentary criteria (MED-1, MED-7, MED-8, MED-9) carry their Certified points from the Verified evidence. The AR tier is Certified.

8.4 Evidence bar. Each criterion states an evidence bar (Clause 6). Where the bar is not met the criterion shall score 0 — no evidence is 0 points, never a removal from the pool. A manufacturer self-declaration shall not earn points above the rung its independent corroboration supports.

8.5 Adverse-event registry search. For MED-8 a recorded search of the adverse-event registries (MAUDE-class and EUDAMED), with its coverage and any null result stated, shall be made before the criterion earns points; an unrecorded search shall not earn them.

8.6 Company-wide fallback. Where a criterion offers a company-wide fallback (MED-7, MED-8, MED-9) and model-specific evidence is unavailable, manufacturer-wide records shall earn the stated fallback points (VRS-GEN-005 §6); the substitution shall be recorded per Clause 10.

8.7 AR tier. The AR tier is the lowest tier among the criteria that determined the letter, and shall not exceed the model’s Intrinsic Rating tier (VRS-GEN-006 §7).

9 Underwriting and credit use

9.1 The letter is an opinion above the compliance floor, not a certification, and shall not be published or imply that any real robot holds a Veyrum rating. A rating is an opinion on the robot, not on the lawfulness of any deployment: absence of a regulatory clearance scores 0 on MED-1 (Clause 6.1) and lowers the letter, but does not by itself withhold a rating.

9.2 The per-class letters and the recorded clinical setting are the underwriting hooks: the letter informs rate relativity, and the covered classes inform coverage scope, so that operation outside the assessed envelope is an exclusion or a condition rather than an implied covered risk. Three loss drivers shall be surfaced separately so an underwriter can weight them independently of the letter: the patient-contact bodily-injury severity driver (MED-3, the sector-defining third-party injury risk); the correlated cyber / PHI accumulation driver (MED-6, recording whether the connected clinical system holds an IEC 62443-3-3:2013 security-level statement, so that a per-fleet or per-network accumulation limit can be set for PHI exposure or remote access across a hospital fleet); and the recall / field-safety-corrective- action driver (MED-9, because a single defective cleared model across many hospitals is one loss event with many claims). The MED-7 service posture informs the operator’s coverage conditions.

9.3 For credit, the reliability, serviceability and support drivers shall be readable from the recorded per-criterion points to inform LTV, residual curves and end-of-support assumptions: MED-7 and the intrinsic reliability, serviceability and support criteria drawn into the pool (Clause 5) inform the obsolescence assumption. A withdrawn or narrowed clearance shall be treated as a residual-value cliff: a model whose cleared indications lapse has no lawful clinical market and shall be assumed to depreciate to salvage unless a retained clearance in another major market is evidenced.

10 Result recording

The rating record shall carry, per VRS-GEN-009: the displayed sector letter and the per-class letters with the class each was issued for; the per-criterion points earned across the sector criteria (Clause 6) and the contributing intrinsic criteria (Clause 5); the not-applicable set removed for each class and the resulting applicable-pool range; the contributing intrinsic criteria used; the AR tier; the edition (VRS 2026); the VRS-MED-501 data-twin version; the regulatory pathway and clearance identifiers relied on (VRS-MED-001 Annex B.4); the adverse-event registry search record including any null result (VRS-MED-001 Annex B.2); the recorded clinical exposure (procedures or therapy sessions and units in clinical service); and the connected-system PHI / remote-access posture with its IEC 62443-3-3:2013 security level (MED-6). Recording flows to the Passport per VRS-GEN-009; no patient-identifiable information shall be stored (VRS-GEN-012 §5.2).

11 Assessor checklist

An assessor with this Protocol and the evidence shall reach the same result by executing the following in order; no step admits an unrecorded judgement call, and any deviation shall be recorded with its basis:

• [ ] Application class(es) confirmed (surgical / rehabilitation/therapy / hospital logistics/service / care/assistive) (Clause 1.2; VRS-MED-001 §4).
• [ ] Assessment tier fixed (Clause 8); the not-applicable set recorded per class and the applicable-pool range computed (Clause 4).
• [ ] Contributing intrinsic criteria drawn from their source standards at their own points and tiers (Clause 5).
• [ ] MED-1 regulatory clearance and standing scored; device class and intended use declared (evidence bar); absence scores 0, not a withheld rating (Clause 9.1).
• [ ] MED-2 electrical / ME-equipment safety scored.
• [ ] MED-3 patient-contact force / motion limits scored (contact classes only: surgical, rehabilitation, care).
• [ ] MED-4 mid-procedure failure behaviour and recovery scored.
• [ ] MED-5 sterilisation / hygiene compatibility scored.
• [ ] MED-6 PHI, connectivity and remote access scored; connectivity declared (evidence bar).
• [ ] MED-7 service under validated configuration scored; company-wide fallback recorded if used.
• [ ] MED-8 adverse-event and malfunction record scored; registry search recorded per Clause 8.5; company-wide fallback recorded if used.
• [ ] MED-9 recall and field-safety-corrective-action conduct scored; company-wide fallback recorded if used.
• [ ] Points added and divided by the applicable-pool range; letter read from the bands (Clause 7.1).
• [ ] Letters issued per class; the lowest displayed (Clause 4.3); each award held at its assessed-tier ceiling (Clause 6).
• [ ] Result recorded to the passport: per-criterion points, not-applicable set, contributors, tier, edition, twin version (Clause 10).

Annex A (informative) — Worked example

FICTIONAL EXAMPLE — not a real product; illustrates mechanics only.

A fictional robotically assisted surgical system, model code MED-RS-01, is assessed for the surgical application class at the Verified tier: a manufacturer evidence pack is examined and no behaviour is witnessed. All nine sector criteria apply to the surgical class (a contact class), and the twenty-one contributing intrinsic criteria of Clause 5 are drawn from their source standards at their own Verified points.

Sector criteria (Verified tier).

Contributing intrinsic criteria (Verified tier). Drawn at their own points, the twenty-one criteria of Clause 5 have a combined range of 171 points and a Verified ceiling of 145; this model earns 138 of them (each at its Verified ceiling except the primary protective function SF-4, earning 9 of 11; the field safety record SF-9, earning 9 of 12; and the restoration-time criterion SV-4, earning 6 of 8).

Letter. The applicable pool for the surgical class is the sector range 100 plus the contributor range 171 = 271 points. Points earned = 83 (sector) + 138 (contributors) = 221. As a percentage of the pool, 221 ÷ 271 = 81.5 %, which falls in the AA band (≥ 75 %, below AAA’s 90 %). The result is Medical & Healthcare AR: AA (VRS 2026) — Verified.

Tier ceiling by construction. At the Verified tier the pool’s own ceiling is (85 + 145) ÷ 271 = 230 ÷ 271 = 84.9 %, so AA is the best letter attainable without a witnessed demonstration (Clause 7.2); AAA would require Certified-tier evidence. No separate modifier is applied — the ceiling does the work.

Loss-driver read. MED-3 feeds the patient-contact bodily-injury severity driver; MED-6 records the connected-system IEC 62443-3-3:2013 security level for the correlated PHI / cyber accumulation limit; MED-9 records recall / field-safety-corrective-action conduct for the correlated device-fleet driver (Clause 9.2).

Clearance variant. Had MED-RS-01 held no evidenced regulatory clearance for the surgical class, MED-1 would score 0 rather than 14, and the letter would fall out of the reduced total — the model is still rated (there is no clearance gate), and the missing clearance is surfaced to the underwriter as a residual-value cliff (Clause 9.3). Numbers illustrate mechanics only.

Bibliography

The full MED anchor regime is verified in VRS-MED-001; the following are the specific anchors this Protocol’s criteria and evidence tiers (Clauses 6 and 8) rest on, dated at point of use:

• IEC 80601-2-77:2019 (edition 1.0) + AMD1:2023 — Medical electrical equipment — Part 2-77: basic safety and essential performance of robotically assisted surgical equipment (RASE/RASS); FDA recognized-consensus standard (iso.org 68473 / 83340; webstore.iec.ch/publication/89957).
• IEC 80601-2-78:2019 (edition 1.0) + AMD1:2024 — Medical electrical equipment — Part 2-78: medical robots for rehabilitation, assessment, compensation or alleviation; IEC/DIS 80601-2-78 replacement in progress (iso.org 68474 / 83341 / 90453; webstore.iec.ch/publication/93014).
• ISO 14971:2019 (edition 3) — Medical devices — Application of risk management to medical devices (iso.org 72704).
• IEC 62304:2006 (edition 1) — Medical device software — Software life-cycle processes (iso.org 38421).
• ISO 13485:2016 (edition 3) — Medical devices — Quality management systems — Requirements for regulatory purposes (iso.org 59752).
• Regulation (EU) 2017/745 (Medical Device Regulation), in force 25 May 2017, applicable 26 May 2021 — eur-lex.europa.eu CELEX 32017R0745.
• ISO 14224:2016 — Collection and exchange of reliability and maintenance data for equipment (iso.org 64076).
• IEC 62443-3-3:2013 — System security requirements and security levels SL 1–4 (webstore.iec.ch/publication/7033).
• ISO 8373:2021 — Robotics — Vocabulary (iso.org/standard/75539.html) — robot-term basis.
• VRS-MED-501 — machine-readable data twin of this Protocol (Clause 5/6/7 values).

Change history