Failure modes in soft-tissue surgical robots: an adjudicated FDA recall cohort, 2005-2026

FDA recall records document corrections and removals; however, product naming, administrative root-cause descriptors, and the functional mechanisms underlying failure are not interchangeable. Accordingly, the affected assets, functional loci, failure modes, and requested actions were characterized in recalls involving soft-tissue surgical robotic systems. A retrospective cohort was constructed from the US Food and Drug Administration (FDA) Medical Device Recall Database and openFDA through 17 July 2026. Eligible product records were deduplicated by FDA product-record identifier and grouped by recall-event identifier. Every event underwent full-text narrative adjudication on two separate axes: the asset explicitly listed in the recalled product and the functional locus implicated by the product, recall-reason, and corrective-action text. A prespecified evidence hierarchy assigned one of eight primary failure modes; verbatim FDA root-cause descriptors were retained separately. Analyses were descriptive. Of 281 candidate product records, 274 were eligible and represented 120 unique recall events. Listed assets were instruments/accessories in 56 events (46.7%), core systems in 52 (43.3%), labeling/instructions for use in eight (6.7%), and multiple layers in four (3.3%). Adjudicated functional loci were core system (50; 41.7%), instrument/accessory (44; 36.7%), labeling/operational (16; 13.3%), and cross-layer interface (10; 8.3%). Primary failure modes were mechanical/material integrity (48; 40.0%), labeling/IFU/regulatory (16; 13.3%), software/control logic (15; 12.5%), electrical/electronic/power (13; 10.8%), process/use/maintenance (12; 10.0%), sterility/packaging (nine; 7.5%), indeterminate/mixed (six; 5.0%), and cybersecurity configuration (one; 0.8%). The Versius Secure Boot event was the sole recall with an explicit cybersecurity mechanism. The median initiation-to-posting interval was 33 days (interquartile range 22-111; n = 91). Surgical-robot recalls span mechanical, electrical, software, informational, and security-control failures. Separating the recalled asset from the functional failure locus, and both from the FDA root-cause descriptor, prevents an error message or administrative software label from being treated as proof of a software defect. These US regulatory data describe corrective actions, not clinical incidence or comparative platform safety.