Physical AI: A Gradient of Autonomy

Robotics follows the same logic of bounded competence that governs AI, and a gradient locates the physician within it.

Exhibit 4.2 sets out five levels, and pairs each with the physician role it implies.

L1, robot assistance. The machine amplifies the operator's own motions in real time, and da Vinci teleoperated surgery is the familiar case. The physician is operator, directing and verifying every action.

L2, task autonomy. The machine performs discrete, pre-defined sub-tasks on command, as in MAKO orthopedic milling or ARTAS hair restoration. The physician is delegator, setting the task and confirming the result.

One refinement belongs at this level, because the gradient's discrete steps conceal it. Shared autonomy blends control continuously between operator and machine within a single action. It does not allocate whole tasks to one or the other. The machine holds a tremor-free trajectory while the surgeon directs it, or constrains motion to a safe corridor the operator moves freely within.

It is not a rung between L1 and L2 so much as a mode that can be applied at either, and of the four autonomy types it is the most clinically consequential, since it is where most operative benefit is currently realized. The physician here is neither operator nor delegator in the pure sense, but a partner in a control loop whose division of labor shifts moment to moment.

L3, conditional or supervised autonomy. Coordinated systems act in complex settings under human oversight, and STAR autonomous soft-tissue suturing is the emerging preclinical example. The physician is supervisor and escalation point, intervening on exception.

L4, high autonomy. The system self-directs within a bounded domain whose limits a human sets, and closed-loop insulin delivery is the nearest clinical analogue today. The physician is boundary-setter, defining the envelope and monitoring for departures from it.

L5, full autonomy. Self-governing across the entire task, end to end. Not yet clinically deployed. The physician is system designer, setting goals, guardrails, and accountability.

A systematic review of robots cleared by the U.S. Food and Drug Administration between 2015 and 2023 found that the large majority operate at the lowest level of autonomy, under continuous human control, and that none in clinical deployment reached the highest.¹⁵ We are at the infancy of this technology, skewed heavily to the left of the gradient.

Four gatekeepers govern the rate of that shift, and only one of them is engineering. Demonstrated safety in the rare case, not just the common one, since the distribution of procedural difficulty has a long tail and it is the tail that decides whether autonomy is acceptable. Regulatory pathways matched to each gradation of autonomy instead of to the device as a whole, since a platform cleared at one level and moved to the next by a software update is not the device that was cleared.

Liability frameworks that specify who answers for an autonomous action, the least developed of the four. And operator trust, which is earned by predictability rather than by capability, and lost far faster than it is gained.

Two further constraints are rarely counted. The first is sensing. A machine cannot act autonomously on tissue it cannot characterize, so movement along the gradient is bounded by perception rather than control. The second is the economics of supervision. If supervised autonomy still requires an attending physician present throughout, it saves no scarce resource and will not scale, which makes the L3-to-L4 transition a workforce question disguised as an engineering one.

The general form of that constraint governs every automation decision in this report. Automation returns value only where it relaxes the binding constraint, and in medicine the binding constraint is almost always physician attention rather than physician capability. A system that performs a task superbly while still requiring someone to watch it perform the task has moved the work rather than removed it, and may have made it worse by replacing an engaged act with a vigilant one. The question to put to any proposed deployment is therefore whether a clinician's attention is afterward freed, redirected, or merely fragmented. Whether the machine can do the thing is the lesser question. A good deal of what is currently sold as labor-saving fails that test visibly in advance.

That constraint has an underappreciated corollary, and it runs in the opposite direction from the one usually drawn. Robotics coupled to AI analytics is moving toward a full-sensorium model: visual, tactile, and chemosensory input together, ambient conditions such as humidity, wavelengths outside the range of ordinary human vision, and sensory signals mathematically transformed into forms with no perceptual analogue at all.

Such systems will not merely imitate human perception. They will operate with a broader and in places simply different sensorium than any clinician possesses. The physician's task then acquires a new dimension: becoming an interpreter and validator of machine perception, and deciding when a machine-sensed reality is trustworthy enough to act on. Judging a claim about tissue that no human sense can check is a different epistemic act from confirming what one can see.

That act has to rest on something, and three bases are available. The first is calibration against outcome, since a machine-sensed claim can be checked in aggregate even when it cannot be checked case by case, against what was subsequently found at pathology, at reoperation, or at follow-up. The second is cross-modal agreement, where an inference drawn from one sensing channel is corroborated by an independent channel that fails differently.

The third is a characterized failure envelope, in which the conditions that degrade the sensor have been mapped and declared, so that trust is conditioned on circumstance and never granted wholesale. All three are statistical rather than perceptual, which is why the conformal methods described later in this chapter are not a technical aside. They are how a physician says, defensibly, that a machine's reading of a tissue plane may be acted upon.

The applications spread wider than surgery, and the breadth matters because autonomy advances unevenly across them. Alongside robotic-assisted surgery sit CyberKnife systems, robotic vascular navigation, rehabilitation robotics, exoskeletons, haptic guidance systems, and simulation-based procedural training environments, each with a different tolerance for autonomy. The governing distinction is between bounded procedural environments, such as orthopedics or vascular navigation, where anatomy is rigid and the task well specified, and variable soft-tissue environments, where deformation, bleeding, and unpredictable planes make full autonomy substantially harder. Next-generation systems will incorporate force feedback and adaptability approaching human capability. They will do so first where the environment holds still.

One application is among the nearest-term and highest-volume of them. AI agents coupled to robotic systems can move rehabilitation out of the institution and into the patient's home, which converts an expensive, appointment-bound, chronically under-delivered service into a continuous one. Rehabilitation is where the aging demographics of Chapter VIII bear hardest and where adherence, not technique, is the binding constraint. A system present in the house every day addresses that constraint.

A design question underlies all of this and bears directly on the human + humanoid meme this report has adopted. When a patient meets a robot that guides them through triage or administrative tasks, will they prefer something humanoid, or should form follow function? Human-like skin and facial expression may build trust, or may land in the uncanny valley and destroy it, and the evidence is not yet strong enough to settle the question in either direction.

Function-led alternatives already work well in practice: baby seal-shaped therapy robots for elderly patients; wheeled or four-legged forms for systems that must move through a ward. What matters is that humanoid names a relationship and not a silhouette, and designing for the silhouette is a choice that should be made deliberately, never by default.

A further consideration comes from the engineering tradition that has done most to make close human-robot contact safe. The Institute of Robotics and Mechatronics at the German Aerospace Center, where Julian Klodmann leads the surgical robotics research team and serves as scientific head of the MIRO Innovation Lab, established that safety in physical human-robot interaction comes from making the machine intrinsically compliant and force-aware, not from fencing it off. Torque sensing, impedance control, and collision detection are built into the arm itself, in a lineage that descends directly from robots built for space.¹⁶

Two projects, both attributable to Klodmann and to the division he leads, show what the approach yields. MiroSurge is a modular telesurgery platform for minimally invasive procedures, built from three lightweight MIRO arms mounted to the side rails of the operating table. Two carry instruments, the third a stereo endoscope, and the surgeon works from a console with stereo vision and two force-reflecting input devices, so that the operative field can be felt as well as seen.

The second is robot-assisted ultrasound diagnostics, pursued through the institute's MIRO Innovation Lab, in which a robotic arm guides sensors precisely to a region of interest and fuses ultrasound with other imaging modalities, allowing tissue to be examined with a consistency no hand-held probe achieves. The institute's stated goal is to give the surgeon treatment options that did not previously exist, not to replace the surgeon with a robot.

Two further lines of work are directly his. The first parameterizes haptic assistance from a digital twin of the procedure, so that a shared-control engine supplies context-aware virtual fixtures during training and shortens the novice surgeon's path to proficiency on MiroSurge. The second is the transfer of the MIRO lineage into industry, where the actuator modules developed by his group underpin Medtronic's Hugo robot-assisted surgery platform, which demonstrates that this engineering tradition reaches operating rooms and has not remained a laboratory argument.

The high-level point is that autonomy and safety are not the same axis. A compliant, force-aware machine under continuous human control may be safer at the point of contact than a rigid one at high autonomy, and reading the autonomy gradient as a risk gradient is a category error. The near-term frontier is supervised autonomy, and what decides its safety is what the machine can feel, not how much it can decide.