Medical & Healthcare Sector Standard

Foreword. This is the sector standard for the Medical & Healthcare (MED) application sector — the first use of the clinical-evidence module (Annex A). The defining condition is regulated patient contact: the robot operates on, with, or around patients inside a medical-device regulatory regime, so the consequence of failure is patient harm and the evidence is produced under clinical governance. It instantiates the universal sector template (VRS-GEN-002 §6.4). A Medical & Healthcare Application Rating expresses, as a letter C < B < A < AA < AAA (AAA best), how suitable and safe a robot model is for clinical use — above the medical-device compliance floor: regulatory clearance is scored evidence, never the rating, and a robot fully compliant with the anchor regime of Clause 2 may still receive any letter. The sector’s defining exposure is the patient in contact with the machine, and — through shared clinical networks and update planes — the hospital fleet that can fail or be breached together; the rating is built so that an insurer or lender can read frequency, severity, exposure, recoverability, residual value, obsolescence and correlated-cyber risk from evidence a manufacturer already produces for IEC / ISO / regulatory conformity (Clauses 7–8). Anchors were verified against issuing-body pages on 2026-09-14 (Bibliography); numeric thresholds are not set here — they live inside the criterion rungs of VRS-MED-201 and its data twin (VRS-MED-501). A Medical & Healthcare AR is an opinion above the compliance floor, not a certification, and no display implies that a real robot holds a Veyrum rating (VRS-GEN-006 §10). Requirements use “shall”; recommendations use “should”.

1 Scope

This Standard defines the requirements for issuing a Medical & Healthcare AR for robots operating in surgical, clinical, and care settings: robotically assisted surgical systems, rehabilitation and assessment medical robots, clinical logistics robots operating in patient areas, and care-support robots in clinical settings. Its clauses cover applicability (Clause 4), the sector hazard taxonomy (Clause 5), the sector Application Rating (Clause 6), evidence requirements (Clause 7), the loss-driver mapping for insurance and finance fitness (Clause 8), protocol references (Clause 9), and a worked applicability example (Clause 10).

The boundary with adjacent sectors follows the exclusion pattern of IEC 80601-2-78:2019: external limb prosthetics and human-attached assistive devices are rated under VRS-ASW-001; personal-care robots operating outside clinical governance under VRS-SVC-001 or VRS-DOM-001; electric wheelchairs and diagnostic imaging equipment are out of VRS scope entirely (ISO 7176 and IEC 60601-2-33 regimes respectively). The scoring mathematics themselves are excluded (VRS-GEN-005/006; the sector’s scoring content lives in VRS-MED-201).

2 Normative references

The documents below constitute requirements of this Standard where cited (dated at assessment unless stated; referencing rules per VRS-GEN-002 §7.3).

• VRS-GEN-001, Vocabulary; VRS-GEN-005, IR Methodology; VRS-GEN-006, AR Scheme; VRS-GEN-007, Sector Classification; VRS-GEN-009, Passport & Registry Schema; VRS-GEN-012, Evidence & Data Requirements (evidence grades).
• VRS-MED-201, Medical & Healthcare AR Assessment Protocol (scoring; dated at assessment); its machine-readable data twin is VRS-MED-501.
• VRS-GEN-008, Application of Ratings (issued-rating lifecycle). Cold-start parity and the company-wide fallback are defined in VRS-GEN-005 §6; the letter bands in VRS-GEN-006 §4.
• Anchor regimes (verified 2026-09-14) — anchors and evidence lanes, not conformity floors VRS re-certifies (VRS-GEN-001 §3.5.1, §3.6.3–3.6.4); the ISO 8373:2021 term basis is cross-referenced in Clause 3:
  • IEC 80601-2-77:2019 + AMD1:2023 — basic safety and essential performance of robotically assisted surgical equipment (RASE) and systems (RASS). FDA recognized-consensus standard. H1 anchor for the surgical class.
  • IEC 80601-2-78:2019 + AMD1:2024 — medical robots for rehabilitation, assessment, compensation or alleviation. FDA recognized; a DIS replacement (IEC/DIS 80601-2-78) is in progress — re-date on publication. H1 anchor for the rehabilitation/therapy class, and the source of the sector boundary (Clause 1).
  • IEC 60601-1:2005 + AMD1:2012 + AMD2:2020 (Edition 3.2) — medical electrical equipment, general requirements for basic safety and essential performance. Base ME-equipment anchor for all classes.
  • ISO 14971:2019 — application of risk management to medical devices. Hazard-analysis evidence lane for H1.
  • IEC 62304:2006 + AMD1:2015 — medical device software life-cycle processes (Edition 2 expected 2026; re-date on publication). Software-integrity evidence lane for H1/H2.
  • ISO 13485:2016 — medical-device quality management systems (incorporated by reference into the FDA QMSR, 21 CFR 820). QMS evidence lane for H5/H6.
  • ISO 14224:2016 — collection and exchange of reliability and maintenance data. Reliability and serviceability evidence lane (op-hours, repair time) for H2/H5.
  • IEC 62443-4-2:2019 — technical security requirements for IACS components (security levels SL-C against foundational requirements FR1–FR7). Clinical-network cyber evidence lane for H4.
  • Regulatory pathways — per-market floors recorded at assessment, not a fixed list: FDA device classification/clearance (510(k)/De Novo/PMA per device class; surgical-robot product codes exist) and EU MDR 2017/745 conformity. The pathway and clearance identifiers relied on are recorded per assessment (Annex A.4); no single regulatory pathway is assumed.

3 Terms and definitions

For the purposes of this Standard, the terms in VRS-GEN-001 (aligned to ISO 8373:2021) apply, together with the following local terms:

• clinical setting — a healthcare facility operating under clinical governance (hygiene, device interference control, and patient-safety incident reporting).
• application class — the declared category of clinical operation the robot is assessed for, at minimum one of surgical, rehabilitation/therapy, hospital logistics/service, care/assistive (clinical) (VRS-MED-201 §1.2); the contact classes (surgical, rehabilitation, care) are those in which the robot physically acts on or with a patient.
• essential performance — the performance whose loss or degradation would result in unacceptable risk, in the sense of the IEC 60601 / IEC 80601 anchor regime; the H1 evidence basis for contact classes.
• clinical procedures — the count of patient procedures or therapy sessions in which the assessed model participated; the H1 patient-harm frequency denominator (Clause 8).
• clinical op-hours — device operating hours accrued within a clinical setting under its governance; the H2/H3 availability and reliability denominator (Clause 8).
• units-in-clinical-service — the count of deployed units of the assessed model in clinical service; the recall / field-safety-corrective-action reach denominator (Clause 8), against which corrective-action effectiveness is measured in %.
• field safety corrective action (FSCA) — a manufacturer action to reduce a risk of death or serious deterioration associated with a device already on the market (recall, advisory notice, software update), reportable to the regulator and recorded in the vigilance registries (Annex A.2).
• clinical availability — the fraction of scheduled clinical use for which the model is fit for its intended function; a mid-procedure failure or therapy interruption is an availability loss with a patient consequence, not only an uptime metric.

4 Sector applicability

4.1 MED is an intended-use sector (VRS-GEN-007 §5.2): no capability gate applies. A model shall be treated as MED-applicable when (a) the manufacturer declares a clinical or medical use in its intended-use statement, or (b) an assessor records evidence of material clinical deployment (override with rationale, VRS-GEN-006 §5.2). Default: not-applicable.

4.2 The minimum capability for applicability is operation within a clinical setting under its governance — hygiene and sterilisation discipline, control of interference with other medical electrical equipment, and participation in the facility’s patient-safety incident reporting.

4.3 The assessed envelope shall state which application classes it covers — at minimum one of surgical, rehabilitation/therapy, hospital logistics/service, care/assistive (clinical) — as protocol applicability fields (VRS-GEN-007 §4.2). Patient-contact requirements apply to the contact classes (surgical, rehabilitation, care). Robot form is not a sector (VRS-GEN-001 §3.4.3): any form — manipulator, mobile platform, or exoskeleton — is rated under MED by this Standard when this clause holds.

4.4 The AR letter shall cover only the assessed classes; unassessed classes shall be displayed as not covered, so that a rating for a logistics deployment is never read as covering surgical contact. Per-application-class letters where evidence diverges materially, lowest-issued-letter display, and not-covered handling of unassessed classes follow VRS-GEN-006 §8.3 (the single home of that rule), as implemented for this sector in VRS-MED-201. Where a model is assessed for more than one class, the displayed sector letter shall be the lowest letter issued across the assessed classes.

5 Sector hazard taxonomy

The Medical & Healthcare AR shall weigh, at minimum, the following hazard groups. Each maps to the IR categories (VRS-GEN-005 §5) it draws evidence from and to its dominant loss driver; the sector emphasis (weights) is defined in VRS-MED-201, not here.

5.1 The hazard taxonomy shall be treated as the minimum coverage set: an assessment that omits a hazard group applicable to the declared application classes shall record the omission and its reason.

5.2 H1 (patient harm in contact) is the sector-defining loss driver and shall never be inferred from transferred evidence: the patient-safety case shall rest on the contact class’s own anchor-standard essential-performance evidence or instrumented clinical test data, not on analogy to another model or class.

5.3 Severity in this sector shall account for the clinical consequence of a failure to the patient, not only equipment damage: a mid-procedure failure of a surgical system can convert to a patient-harm event even where the robot itself is undamaged. The assessment shall record the clinical-consequence class alongside any equipment-damage severity so that the two are not conflated in the rating record.

6 Sector Application Rating

6.1 The Medical & Healthcare sector AR shall be determined per VRS-MED-201 from the pool defined there — the sector criteria MED-1…MED-9 together with the contributing intrinsic criteria — as a percentage of the applicable pool; letters (C < B < A < AA < AAA, AAA best) follow VRS-GEN-006 §4. The machine-readable data twin is VRS-MED-501.

6.2 The letter bands, the per-criterion tier ceilings, and the reserved-headroom AAA band (deliberately hard, anti-inflation) live in VRS-GEN-006 §4 and VRS-MED-201 §7 and are not restated here.

6.3 Regulatory clearance for the assessed patient contact class is scored by VRS-MED-201 §6.1 (criterion MED-1); absence of evidenced clearance scores zero on that criterion and is not a gate — a rating is an opinion on the robot, not on the lawfulness of any deployment, so an uncleared model is still rated and its missing clearance is surfaced to the underwriter (VRS-MED-201 §9).

6.4 Anchor-standard conformity — essential-performance evidence to the IEC 80601 part applicable to the class, on the IEC 60601 base — is scored by VRS-MED-201 §6.2 (criterion MED-2) on a point range; absence of evidenced conformity scores zero on that criterion and is not a ceiling on the letter — the rating rewards performance above the compliance floor without substituting for it.

7 Evidence requirements

7.1 Evidence shall be graded per VRS-GEN-012. Sector-relevant sources include: anchor-standard test and essential-performance evidence, regulatory clearance dossiers, adverse-event registry records, field safety corrective actions and recalls, clinical usage records (clinical procedures and clinical op-hours), and hospital biomedical-engineering service records.

7.2 For each hazard group, an existing conformity artefact should be mapped to the VRS evidence lane so that adoption costs a manufacturer a mapping rather than new testing:

7.3 Evidence shall be assessed at one of three tiers — Unverified, Verified, Certified — each criterion of VRS-MED-201 stating the points reachable at each tier (VRS-MED-201 §6, §8). Where a criterion’s evidence bar is not met the criterion shall score 0 (no evidence is zero points, not a discard from the pool); a model×class with no admissible clinical evidence shall be displayed as not covered for that class (VRS-GEN-006 §6). H1 patient-safety sufficiency shall rest on the contact class’s own anchor-standard essential-performance evidence or instrumented clinical test data, never on transferred evidence (5.2).

7.4 Models without sufficient model-specific clinical evidence shall be scored at the tier the available evidence supports and, where offered, from manufacturer-wide records under the company-wide fallback and cold-start parity of VRS-GEN-005 §6; the lower tier caps the attainable letter through the per-criterion ceilings (VRS-MED-201 §7). Where H1 patient-safety evidence rests on manufacturer declaration alone, without anchor-standard essential-performance evidence or instrumented clinical test data, the assessment shall hold the criterion at its Unverified rung and record the evidence gap. Uncontrolled “pilot” or observational evidence outside an approved study is inadmissible as the primary basis for H1 and shall earn no points beyond that Unverified rung (Annex A.1).

8 Loss-driver mapping (insurance and finance fitness)

8.1 Every quantity that feeds the MED rating shall be traceable to a loss driver and to a Robot Risk Passport field (VRS-GEN-009), so that an underwriter or lender can compute it from obtainable evidence. The mapping is:

8.2 A MED signal that lacks an exposure denominator shall not be scored as a frequency; it shall be recorded as a descriptive attribute or elevated as a design question (VRS-GEN-202). No loss statistic shall be invented to fill a missing denominator.

8.3 The rating output shall be expressed so that it can feed an underwriting decision (rate relativity, deductible, exclusion, condition) or a credit decision (loan-to-value, residual curve, covenant); the letter alone is insufficient, and the assessment tier and evidence-basis flags shall accompany it in the Passport record (VRS-GEN-006 §9.3, VRS-GEN-009).

8.4 Recall and FSCA overhang is the finance-risk driver most specific to this sector: an open recall or a short end-of-support horizon (recorded in months) can suppress residual value and resale even where the unit is functionally sound, because return-to-service depends on regulatory standing, not mechanical condition. The rating shall record recall/FSCA status and support horizon as separate passport attributes and shall not net them against serviceability (H5), so that a lender can weight recoverability and residual value independently.

8.5 Correlated and cyber-catastrophe accumulation (H4) shall be surfaced as a passport-recorded attribute: where many units of a model share one clinical-network interface or update plane, one intrusion or one defective update can degrade or expose the fleet at once, and a PHI breach does not diversify the way independent mechanical failures do. The attribute shall record whether that interface holds an IEC 62443-4-2:2019 SL-C evaluation, so an underwriter can set a per-fleet accumulation cap. This attribute is descriptive, not scored, until a fleet-loss denominator exists (VRS-GEN-202).

9 Protocol references

• VRS-MED-201 — Medical & Healthcare AR Assessment Protocol (scoring) — dated reference at assessment time; its data twin is VRS-MED-501.
• Medical Test Protocols (VRS-MED-1xx) are reserved; the first candidates are a surgical essential-performance verification protocol (drawing on IEC 80601-2-77 test methods) and a sterilisation/hygiene-integrity verification protocol, drawing on the anchor regimes’ test methods rather than duplicating them.

10 Worked example (informative) — applicability walkthrough

The following illustrates how an assessor applies Clauses 4–8 to a hypothetical model; it is not a real assessment and does not imply any robot holds a Veyrum rating (VRS-GEN-006 §10). The counts are illustrative.

Input. A manufacturer declares a robotically assisted surgical system, model code MED-SX-01, for one application class: surgical. It holds a market clearance for the surgical indication, an IEC 80601-2-77:2019+AMD1:2023 essential-performance test report, an IEC 60601-1:2005+AMD2:2020 basic-safety report, an ISO 14971:2019 risk-management file, an IEC 62443-4-2:2019 SL-2 evaluation of the clinical-network interface, and clinical usage records covering 4,000 clinical procedures over 12,000 clinical op-hours with 3 recorded device-related adverse events and 1 mid-procedure failure. A search of the public vigilance registries returns 1 open field safety corrective action (a software advisory) affecting 500 units-in-clinical-service.

Step 1 — applicability (Cl. 4). The intended-use declaration satisfies 4.1(a); MED is applicable. The envelope records the surgical class; rehabilitation/therapy, hospital logistics/service, and care/assistive (clinical) are displayed as not covered (4.4).

Step 2 — hazard coverage (Cl. 5). H1–H6 all apply to the surgical class. H1 rests on the IEC 80601-2-77 essential-performance report, satisfying 5.2 (no transferred evidence).

Step 3 — clearance and anchor conformity (Cl. 6). Evidenced clearance for the surgical class is scored by VRS-MED-201 §6.1 (MED-1) — present here, so it earns points rather than acting as a gate; had it been absent, MED-1 would score 0 and the model would still be rated (6.3). The IEC 80601-2-77 essential-performance evidence is scored by VRS-MED-201 §6.2 (MED-2) — present here, so MED-2 earns points rather than the letter being ceilinged (6.4).

Step 4 — evidence and reuse (Cl. 7.2). Each hazard maps to an existing artefact: H1→IEC 80601-2-77 report

• ISO 14971:2019 file; H2→IEC 60601-1 basic-safety report + ISO 14224:2016 records; H4→IEC 62443-4-2:2019 evaluation. Adoption is a mapping, not new testing.

Step 5 — evidence tier (Cl. 7.3–7.4). The manufacturer evidence pack (essential-performance report, basic-safety report, risk-management file, IEC 62443-4-2:2019 evaluation, clinical usage records) supports the Verified tier; no behaviour is witnessed, so each criterion is held at its Verified ceiling (VRS-MED-201 §7) and the Certified tier is not reached.

Step 6 — loss-driver read (Cl. 8). H1 patient-harm frequency is expressed as 3 events per 4,000 clinical procedures = 0.75 per 1,000 clinical procedures; H2 failure frequency as 1 per 12,000 clinical op-hours ≈ 0.08 per 1,000 clinical op-hours. The open FSCA reaches 500 units-in-clinical-service; corrective-action effectiveness will be tracked as the % of affected units updated. The model shares a clinical-network interface with an SL-2 (not SL-C) evaluation, so 8.5 records the accumulation attribute below the target level.

Output. The rating is computed by VRS-MED-201 (not in this document). The Passport record carries the per-class letter, the covered application class, the assessment tier, the H1/H2 frequencies with their denominators, the recall/FSCA overhang and support horizon (8.4), and the accumulation attribute (8.5). The numeric score and band boundary come from the criterion rungs and bands of VRS-MED-201 and are not asserted here.

Annex A (normative) — Clinical-evidence module (first use)

A.1 Evidence touching patients shall originate from regulated contexts — an approved clinical study, cleared clinical use, or manufacturer testing under its ISO 13485:2016 QMS. Uncontrolled “pilot” or observational evidence outside an approved study is inadmissible as the primary basis for H1 and shall earn no points on the patient-contact criterion beyond its Unverified rung (7.4).

A.2 Adverse-event history shall be searched in the major public vigilance registries for every assessment and recorded, including a null result: at minimum the FDA MAUDE database (medical device reports over the searchable 10-year window) and the EU EUDAMED vigilance module where the model is placed on those markets. The search date and query shall be recorded so the result is reproducible.

A.3 No patient-identifiable information shall enter the evidence store (VRS-GEN-012 §5.2 applies strictly); clinical evidence shall be recorded at the event level, de-identified.

A.4 The rating record shall state the regulatory pathway and the clearance identifiers it relied on, so that an assessor with the same evidence reaches the same result.

Bibliography

• ISO 8373:2021, Robotics — Vocabulary (iso.org/standard/75539.html) — robot-term basis (via GEN-001).
• IEC 80601-2-77:2019 + AMD1:2023, Medical electrical equipment — Part 2-77: robotically assisted surgical equipment/systems (iso.org/standard/83340; webstore.iec.ch/en/publication/89957; FDA recognized-consensus) — H1 surgical anchor.
• IEC 80601-2-78:2019 + AMD1:2024, Part 2-78: medical robots for rehabilitation, assessment, compensation or alleviation (iso.org/standard/90453; webstore.iec.ch/en/publication/93014; IEC/DIS 80601-2-78 replacement in progress) — H1 rehab anchor and sector-boundary source.
• IEC 60601-1:2005 + AMD1:2012 + AMD2:2020 (Edition 3.2), Medical electrical equipment — general requirements for basic safety and essential performance (webstore.iec.ch/en/publication/67497) — base ME anchor.
• ISO 14971:2019, Medical devices — Application of risk management to medical devices (iso.org/standard/72704.html) — H1 hazard-analysis lane.
• IEC 62304:2006 + AMD1:2015, Medical device software — Software life-cycle processes (webstore.iec.ch/en/publication/22790; Edition 2 expected 2026) — software-integrity lane.
• ISO 13485:2016, Medical devices — Quality management systems (iso.org/standard/59752.html; FDA QMSR, 21 CFR 820, incorporates it by reference) — QMS lane.
• ISO 14224:2016, Petroleum, petrochemical and natural gas industries — reliability and maintenance data collection — op-hours/repair-time reliability lane.
• IEC 62443-4-2:2019, technical security requirements for IACS components (SL-C; FR1–FR7) — H4 cyber lane.
• EU MDR 2017/745 — conformity regime (per-market floor; regime-level citation).
• FDA MAUDE — Manufacturer and User Facility Device Experience database, adverse-event MDRs, 10-year searchable window (accessdata.fda.gov / open.fda.gov/data/maude) — Annex A.2 registry.

Change history