Author: Tomasz Jan Gomoła · ORCID 0009-0001-5222-6154 Affiliation: DeepSensi Medical OS — Cognitive Infrastructure Division, DeepSensi PBC, Dover, DE, USA Version: 3.0 — July 2026 Status: Prepared for submission — medRxiv preprint; IEEE / NEJM AI companion Licensing: The Gomola Framework and the DeepSensi Standard (DSS) certification levels are offered on a royalty-free, open-specification basis. Any organization may implement and certify against this framework without licensing fees.
Recommended citation: Gomoła, T.J. (2026). "The Gomola Framework: A Quantitative Safety Certification Standard for Clinical AI Systems." DSS-001. DeepSensi Medical OS.
The deployment of Large Language Models (LLMs) in clinical decision support has outpaced the development of safety standards addressing their dominant failure mode: hallucination — the generation of plausible but factually incorrect medical assertions. Existing medical software standards (IEC 62304, FDA AI/ML SaMD guidance) address lifecycle management but provide no quantitative framework for bounding hallucination probability. Aviation (DO-178C) and nuclear engineering (IEC 61508) employ graded quantitative reliability targets; no equivalent exists for clinical AI.
This paper introduces the Gomola Framework, operationalized as the DeepSensi Standard (DSS) — a quantitative safety certification standard for clinical AI. The framework defines four certification levels (DSS Bronze through DSS Platinum) organized around five foundational pillars: Multi-Specialist Cognitive Diversity, Evidence Integrity Verification, Deterministic Safety Verification, Transparent Uncertainty, and Immutable Accountability. Certification is deliberately two-dimensional: an architectural dimension (pillar requirements per level) and a probabilistic dimension (per-assertion hallucination bound established by Fault Tree Analysis per IEC 61025, interpreted against IEC 61508 demand-mode targets with explicitly stated caveats). The standard is vendor-neutral, technology-agnostic, and royalty-free. A companion paper [1] provides the mathematical validation; the reference implementation (DeepSensi Medical OS) implements the complete DSS Platinum architectural requirement set, with a conservatively certified probability bound of 3.23 × 10⁻⁶ (worst case) / 1.69 × 10⁻⁷ (nominal).
Keywords: Clinical AI Safety Standard, Hallucination Mitigation, Safety Certification, Gomola Framework, DeepSensi Standard, LLM Reliability, Medical AI Regulation
LLM hallucination is qualitatively different from conventional software defects: indistinguishable from correct output without independent verification; non-deterministic; unbounded in failure space; with clinical consequences ranging from unnecessary follow-up to death.
| Framework | Scope | Hallucination coverage |
|---|---|---|
| IEC 62304:2006 | Medical device software lifecycle | None — assumes deterministic behavior |
| FDA AI/ML SaMD (2021) | SaMD change management | No quantitative bound |
| EU AI Act (2024) | Risk classification | "High-risk" (Annex III); no quantitative reliability target for generative output |
| ISO 14971:2019 | Risk management process | No LLM-specific failure modes |
| IEC 61508:2010 | Functional safety (SIL) | Quantitative targets exist, designed for E/E/PE hardware |
| DO-178C | Airborne software | DAL levels; no LLM provisions |
The Gomola Framework fills this gap with the first quantitative certification standard designed specifically for LLM hallucination in clinical AI.
The companion paper WP-001 [1] provides the formal FTA validation and the empirical NEJM CPC results; WP-002 [12] provides the benchmark-integrity audit and the Auto-CSA evaluation protocol. This paper defines the standard: pillars, levels, lexicon, assessment methodology, governance.
The framework is open. Some implementation details of the reference implementation are proprietary; this does not affect adoptability — any organization may meet DSS criteria with any technology stack. Detailed documentation is available to regulators and qualified auditors under NDA.
A compliant system must satisfy all five pillars at the target certification level.
No single analytical perspective is sufficient for clinical decision-making. Multiple independent analytical agents representing diverse medical specializations, operating in structured adversarial configurations. Rationale: single-model systems inherit the blind spots of their training distribution; MCD is the computational analogue of the interdisciplinary consilium. Example: chest pain + fatigue + anxiety — a single model anchors on cardiac disease; independent cardiology, endocrinology, psychiatry, and pulmonology perspectives surface thyroid dysfunction mimicking cardiac symptoms.
A cited source is not the same as a trustworthy source. Required: source provenance (retraction/supersession tracing), funding-bias detection, temporal relevance, population matching, cross-jurisdictional norm comparison. A 2004 manufacturer-funded trial is not equivalent to a 2024 independent meta-analysis; the distinction must be surfaced, not hidden.
Critical safety checks must not rely on AI judgment. Required: logical contradiction detection, drug-interaction verification against curated databases (no AI recall), physiological plausibility checks, cross-vendor verification of critical conclusions. Probabilistic models fail at scale by construction; deterministic barriers provide a reliability floor independent of model quality.
A system that cannot say "I don't know" is not safe for clinical use. Required: uncertainty quantification across agents, blind-spot detection at specialty boundaries, a structured non-answer protocol (LIMBO: core disagreement + working hypothesis + specific resolving diagnostics), and meta-cognitive self-assessment before output. This converts the failure mode from silent hallucination to explicit uncertainty declaration.
Every clinical AI decision must be permanently recorded, tamper-proof, and auditable. Required: immutability (including against the operator), traceability, attribution (AI vs. physician vs. deterministic rule — the Liability Partition Record), and third-party verifiability. Directly supports EU AI Act Articles 14, 15, 17 [10].
(Certification is two-dimensional. The tables below state the architectural requirements per level; the probabilistic requirement is the per-assertion bound P(hallucination), demonstrated via the §6 methodology. A system's certificate reports both dimensions, e.g., "DSS Platinum architecture; certified bound 3.2 × 10⁻⁶ worst-case." This prevents the categorical error of inferring a probability claim from an architecture claim or vice versa.)
| Pillar | Requirement |
|---|---|
| I MCD | ≥ 3 independent analytical perspectives per case |
| II EIV | Citation existence verification; basic provenance |
| III DSV | ≥ 3 barriers, ≥ 1 deterministic |
| IV TU | Basic confidence scoring with threshold flagging |
| V IA | Event logging (mutable permitted) |
Suitable for: health information platforms, wellness applications, preliminary screening.
| Pillar | Requirement |
|---|---|
| I MCD | ≥ 8 perspectives with adversarial triads |
| II EIV | Full Evidence Integrity Score (EIS) incl. funding-bias detection |
| III DSV | ≥ 6 barriers, ≥ 3 deterministic |
| IV TU | Formal structured non-answer protocol with diagnostic probes |
| V IA | Cryptographic hash chain (immutable) |
Suitable for: primary-care decision support, telemedicine, second-opinion services.
| Pillar | Requirement |
|---|---|
| I MCD | ≥ 18 perspectives with full consilium deliberation |
| II EIV | Full EIS + norm genealogy + cross-continental comparison + population matching |
| III DSV | ≥ 8 barriers, majority deterministic, incl. cross-vendor verification |
| IV TU | Full meta-cognitive self-awareness with adaptive analysis depth |
| V IA | Immutable hash chain with external anchoring |
| + | Physician-in-the-loop with real-time intervention |
Suitable for: hospital departments, specialist clinics, research institutions, regulatory submissions. Informative note: at Gold and above, standards-based EHR ingestion (HL7 v2 / FHIR R4 / DICOM) is recommended so that Pillar II/III verification operates on primary clinical payloads rather than transcriptions; this note is informative, not normative, preserving technology-agnosticism.
| Pillar | Requirement |
|---|---|
| I MCD | Full multi-specialist swarm with autonomous persona engine |
| II EIV | Complete multi-layer EIS with all integrity dimensions |
| III DSV | ≥ 10 barriers with continuous adversarial red-team testing |
| IV TU | Full LIMBO protocol with structured non-answer and probes |
| V IA | Immutable chain + blockchain anchoring + liability partitioning |
| + | Physician-in-the-loop (Sentinel), edge/offline & air-gapped capability, multi-regulatory alignment (EU AI Act, HIPAA, GDPR, ISO 14971) |
Suitable for: national health systems, military medical operations, sovereign deployments.
The reference implementation (DeepSensi Medical OS) implements the complete DSS Platinum architectural requirement set (all five pillars at Platinum, including LIMBO, blockchain-anchored audit with liability partitioning, Sentinel physician-in-the-loop, and air-gapped edge operation). Its certified probabilistic bound, established conservatively in [1], is 3.23 × 10⁻⁶ worst-case / 1.6875 × 10⁻⁷ nominal — i.e., the Silver probability tier under worst-case assumptions, meeting the Gold threshold under standards-typical common-cause parameters (β ≤ 0.059). The Platinum probability tier (< 10⁻⁹) is a target under empirical calibration, not a present claim. (We consider stating this distinction plainly to be the standard working as intended: a standard that flatters its own author is not a standard.) This reflects the governing principle of the DSS and the Gomola Framework: the Standard certifies conservative, worst-case floors — not best-case ceilings. Every certified figure is a bound the architecture is engineered to hold, and to exceed under real-world conditions — never a peak it happens to reach.
Empirical validation of the reference implementation. On a consolidated cohort of N = 301 NEJM Clinicopathological Conference cases (2014–2023), evaluated under the Auto-CSA protocol [WP-002] with an independent cross-vendor adjudication panel — the Standard's own independence requirement, applied to its reference implementation — the frozen-configuration system achieved 80.0% top-1 and 88.0% top-3 accuracy; after safety-first calibration of the consensus logic using the Standard's mechanisms (cross-vendor consilium arbitration, input-grounding feedback loops, and the deterministic EBM Safe Override), cumulative accuracy on the cohort rose to 86.0% top-1 (95% CI 82.1–89.9) and 93.7% top-3 (95% CI 91.0–96.4) — reported explicitly as a development-cohort result — with the missed-critical rate reduced from 4.6% to 0.0% (staged; see WP-002 §7) and a median core deliberation time of 14.3 s. These results validate the deployability and clinical performance of a full Platinum-architecture system; the per-assertion hallucination bound itself is established analytically in [1], since no accuracy study of this size can empirically verify probabilities of order 10⁻⁷–10⁻⁹.
| Term | Definition |
|---|---|
| DSS Verified | Output that has passed all five pillars of the DeepSensi Standard at the specified certification level |
| DSS Score | Composite quality metric (0–100) reflecting the degree to which an analysis meets the standard; a weighted sum of orthogonal quality dimensions |
| Evidence Integrity Score (EIS) | Per-source trustworthiness rating incorporating bias, recency, population matching, and methodology quality |
| Multi-Specialist Cognitive Diversity (MCD) | The minimum number of independent analytical perspectives required for clinical verification at a given DSS level |
| Deterministic Safety Barrier (DSB) | A verification check that operates without any AI involvement — pure logic, guaranteed reliability |
| Transparent Uncertainty Protocol (TUP) | Formal process for producing structured non-answer responses with diagnostic probes when consensus cannot be reached |
| LIMBO Protocol | The highest-level structured non-answer procedure, activated when inter-agent consensus entropy exceeds the defined threshold; required for DSS Platinum |
| Immutable Reasoning Chain (IRC) | Cryptographically sealed record of the complete diagnostic reasoning process from intake through final report |
| Liability Partition Record (LPR) | Audit entry that precisely attributes each clinical decision to AI, physician, or automated rule |
| Cross-Vendor Verification (CVV) | Independent verification of AI conclusions by a model from a different vendor family, ensuring no shared-backbone common-cause failure |
| Adversarial Red-Team Score (ARTS) | Measure of how well the system withstands continuous adversarial testing by dedicated opposing agents |
| Cognitive Entropy | Information-theoretic measurement of specialist agreement/disagreement, used to detect convergence or trigger uncertainty protocols |
| Clinical Confidence Calibration (CCC) | Alignment between reported confidence level and actual evidence quality; miscalibration triggers automatic flagging |
| EBM Safe Override | Deterministic final-stage rule layer that intercepts unsafe synthesized output and forces LIMBO activation (WP-002 §5) |
| Auto-CSA | Automated Clinical Safety Audit — dynamic, safety-first evaluation protocol with generative trajectories, adversarial bias injection, and explicit uncertainty scoring (WP-002 §6) |
| Common-Cause Failure (CCF) | Simultaneous failure of multiple verification barriers arising from a shared root cause; addressed through cross-vendor diversity per IEC 61025 |
| Verification Barrier | An independent verification mechanism that must be passed for output to be released; barriers combine via AND-gate logic in the fault tree model |
| Defense-in-Depth | The principle that no single barrier is trusted to prevent failure; multiple independent barriers are arranged in series (IAEA SSR-2/1) |
IEC 61508 defines targets in demand mode (PFDavg) and continuous mode (PFH). Per-assertion clinical verification is a demand-mode function: each assertion is one discrete demand; risk exists only when demands occur. All SIL equivalences below therefore use demand-mode bands, refer to the numerical target only (full SIL certification additionally requires systematic capability and lifecycle evidence), and are accompanied by the disclosure that cumulative expected failures scale with assertion volume.
| DSS level | P(hallucination) bound | IEC 61508 demand-mode equivalence | DO-178C reference point* |
|---|---|---|---|
| Bronze | < 10⁻³ | Meets SIL 3 numerical target (PFD < 10⁻³) | — |
| Silver | < 10⁻⁵ | Meets SIL 4 numerical target (PFD < 10⁻⁴) at/below band floor | ≈ DAL C |
| Gold | < 10⁻⁷ | 100× beyond the SIL 4 band floor — beyond scale resolution | ≈ DAL B |
| Platinum | < 10⁻⁹ | 10,000× beyond the SIL 4 band floor | ≈ DAL A |
* DAL targets are per flight hour; units are not directly commensurable with per-assertion probabilities — reference points only.
(The demand-mode threshold mapping above deliberately discloses SIL-scale saturation above Silver rather than forcing every tier onto the SIL ladder; DAL values are per flight hour and serve as reference points, not equivalences.)
| EU AI Act requirement | DSS provision |
|---|---|
| Art. 9 Risk management | Formal FTA-based quantification at all levels |
| Art. 10 Data governance | Pillar II: provenance + bias detection |
| Art. 14 Human oversight | Gold/Platinum: physician-in-the-loop |
| Art. 15 Accuracy & robustness | Quantitative per-level probability thresholds |
| Art. 17 Quality management | Pillar V: immutable audit, 100% pipeline coverage |
| Annex III high-risk | The quantitative demonstration framework |
Raw clinical LLM 15–25% → below Bronze · RAG 5–10% → below Bronze · RAG + fact-check 2–5% → approaching Bronze · RAG + multi-source 0.5–2% → Bronze · Multi-layer adversarial architectures → Silver and above.
FTA foundation. Top Event: "an undetected hallucinated medical assertion reaches the final clinical output." With independent barriers, P(TE) = Π p(Bᵢ) (IEC 61025 [5]).
Independence. Applicants must demonstrate ≥3 of 4 pillars: inter-tier architectural separation; cross-vendor model diversity; intra-tier methodological heterogeneity; configurable reasoning parameters.
CCF adjustment. P(TE_adj) = P(TE) + β·max(P(Tierᵢ)); β per IEC 61508-6 Table B.5 (0.01–0.05 diverse redundancy; 0.1–0.2 identical redundancy). Applicants must justify their β.
Worst-case bound. The CCF-adjusted value is multiplied by documented degradation factors (API unavailability, novel hallucination types, implementation defects, residual correlation). The worst-case bound determines the certified probability tier.
Empirical program: certification at Gold and above additionally requires (i) per-barrier failure-rate calibration against labeled corpora, (ii) continuous red-team attack-rate reporting, and (iii) a public adversarial challenge mechanism. A worked example, including empirical NEJM CPC validation, is provided in [1].
Bronze/Silver — self-assessment: documented barriers + independence justification; per-barrier probability estimates with evidence; FTA computation; five-pillar compliance; published DSS Self-Assessment Report.
Gold/Platinum — third-party audit: architecture and independence review; empirical validation of per-barrier estimates; black-box testing of deterministic barriers; cryptographic verification of audit-trail integrity; formal DSS Compliance Certificate.
Continuous monitoring: Bronze — annual self-assessment; Silver — + incident reporting; Gold — continuous barrier telemetry + annual third-party audit; Platinum — real-time telemetry + continuous adversarial red team + annual audit.
Recertification: 24 months; requires barrier performance ≥ documented estimates, no new CCF paths, and incorporation of newly identified hallucination patterns.
Semantic versioning (MAJOR.MINOR.PATCH; MAJOR may alter thresholds and requires recertification). Roadmap: 2026 publication + reference implementation; 2027 industry adoption aligned with the EU AI Act deadline; 2028 third-party certification bodies; 2029+ IEEE/ISO submission. Licensing: open, royalty-free; sole requirement is academic attribution (Gomoła, 2026).
Copyright © 2026 Tomasz Jan Gomoła. "DeepSensi Standard", "DSS Verified", "DSS Bronze/Silver/Gold/Platinum" and associated terminology are trademarks of DeepSensi PBC. The framework is open and royalty-free; the reference implementation is proprietary.