How Brain-Computer Interfaces Are Governed — and Where Decisions Must Connect

It seems like every day there's a news story about promising brain-computer interfaces (BCI). For instance, a cap for stroke rehabilitation that records electrical activity from the scalp while someone completes a computer-based exercise. When the system estimates that the person’s attention is fading, it adjusts the exercise within limits set by a therapist. The study results are encouraging.
The story tells you that the project received funding, underwent formal review, and was tested with patients. By the final paragraph, it can sound as though the hard part is over: the technology has demonstrated something useful and has survived serious scrutiny.

The news story often ends there, but the work to bring the benefit to the patients really just started.

Let’s explore why and how using a fictional BCI system called Relay. It is the fictional, deliberately ordinary BCI used in previous articles to show how responsibility changes as a project moves from an idea towards routine use and why the people most affected need to shape its purpose and measures before they harden.

Relay has received public research funding in Switzerland. Its clinical investigation was reviewed by a cantonal ethics committee and Swissmedic. The study generated evidence under a defined protocol. The manufacturer subsequently completed the conformity work required for the device’s intended purpose. Its files include risk management, usability work, and a record of how stroke survivors and therapists changed the study measures.

The study has answered a research question. Now comes the next, the big one: can Relay become a regular, supervised part of stroke rehabilitation? A first, bold hospital has to decide that. Patients would attend scheduled sessions in which trained staff fit the cap, calibrate the system to the individual, monitor the exercise, and decide when to pause or continue. The hospital would have to make room for that work in ordinary appointments, train enough therapists, maintain the equipment, manage software updates and failures, and ensure that care continues when Relay cannot be used.

The difference sounds small: supervised sessions already happened in the previous study, and now the supervised sessions would happen in the clinic. But institutionally, that’s a huge difference. A study relies on a dedicated research team, protected setup time, a fixed device version, selected participants, and a protocol designed around the experiment. A service has to reproduce the relevant conditions patient after patient, within routine staffing, budgets, IT systems, clinical accountability, and support arrangements. If it cannot, evidence that Relay worked in the study does not establish that the hospital can offer a dependable service or that the burden of making it work will fall fairly.

Relay’s team may already understand some of these realities. It may include clinicians, work closely with therapists, or have designed the study with routine care in mind. But sustained access to a deployment setting is a luxury many startup teams do not have. Some knowledge can only be gained by entering that setting: how appointments actually run, who absorbs calibration and support work, which IT and procurement constraints matter, and what happens when the system fails on an ordinary working day. The problem is therefore not only how governance decisions connect. It is also how a project learns from the field in which it hopes to become dependable.

The committee therefore does not face an unreviewed technology. It faces a technology that has been reviewed several times, from several legitimate perspectives. Yet none of the earlier decisions establishes whether this hospital can sustain individual calibration, train enough staff, integrate Relay into therapy, support it when the software changes, or justify the work transferred to patients and clinicians.

This does not mean that the earlier reviews were superficial. It means they were reviews of something more precise.

The familiar criticism is that governance has failed to keep pace with innovation. Sometimes it has. But Relay reveals a different problem. A mature governance landscape can contain many serious mechanisms and still leave gaps between them. The gap is not always an empty space where nobody reviewed the technology. It can be an interface between reviews that each worked within their proper limits.

The challenge is not an absence of governance. BCI projects already pass through multiple legitimate forms of review and oversight

Responsible BCI does not begin from nothing.

Research funders and peer reviewers decide which questions deserve support. Research ethics committees protect people involved in defined studies. Regulators and conformity assessment bodies apply legal requirements to investigation and market access. Standards turn accumulated technical practice into repeatable processes. Health technology assessment, procurement, and clinical governance examine value, evidence, cost, and the realities of operation. Risk and impact-assessment tools help organizations ask questions consistently. Participatory methods allow people affected by a technology to challenge the purpose, measures, burdens, and safeguards that formal review might otherwise take for granted.

These mechanisms are often discussed as though they were incomplete versions of one ideal review. They are better understood as different kinds of solution.

Some create legitimate authority to make a bounded decision. Some make technical or organizational judgment more consistent. Some reopen the frame by bringing in knowledge and consequences that institutions do not possess on their own.

The categories overlap. A regulator may require standardized risk processes. A funder may demand public engagement. A hospital may combine clinical governance, procurement, cybersecurity, and user consultation. Responsible-innovation frameworks may connect foresight, inclusion, safety, oversight, and stewardship. But overlap does not make the underlying functions interchangeable.

That distinction matters because each kind of mechanism can be improved in a different way — and because none should have to become all the others.

BCI governance mechanisms

A representative map of different mechanisms that govern evidence, authorization, operation, learning, and remedy

Formal reviews · Authorize, allocate + adopt

Funding + grant review

Question

Which inquiry deserves support?

Output

Award + review record

Publication + editorial governance

Question

Should these claims enter and influence the scientific record?

Output

Publication decision + reporting and evidence conditions

Regulation + conformity

Question

Does the device and intended use meet requirements?

Output

Submission + conformity record

Professional credentialing + facility accreditation

Question

Who may deliver and supervise the service?

Output

Competency + facility conditions

Research ethics + IRBs

Question

May this defined study involve people?

Output

Authorization + conditions

HTA + procurement + clinical governance

Question

Should this service be covered, bought, or operated here?

Output

Assessment + operating conditions

Sector + context-specific law

Question

What additional rights, duties, or prohibitions apply in this setting?

Output

Legal conditions + enforcement, accommodation, or liability

Standards + tools · Make practice reliable

Standards

Question

How should risk and usability work be performed consistently?

Output

Repeatable process + evidence records

Quality management + independent audit

Question

Can the organization reliably do what it claims?

Output

Audit findings + corrective actions

Cybersecurity review

Question

Can the system resist misuse and fail safely?

Output

Threat model + security controls

Risk + assurance + impact tools

Question

What must the organization examine and carry forward?

Output

Findings + controls + triggers

Data protection + privacy governance

Question

May neural and personal data be used this way?

Output

DPIA + access and retention conditions

Consent + autonomy safeguards

Question

Is participation and use genuinely voluntary, informed, and reversible?

Output

Consent conditions + withdrawal and change controls

Research integrity + evidence governance

Question

Can the resulting claims be trusted and corrected?

Output

Registration + monitoring + access conditions

Continuing oversight · Learn + remedy

Post-market surveillance + vigilance

Question

What is happening after deployment?

Output

Safety signal + corrective or stop trigger

Complaints + appeals + ombuds + remedy

Question

How can a person challenge or correct a harmful decision?

Output

Investigation + appeal + remediation

Participation + anticipation · Reframe + reassess

Co-design + affected-community methods

Question

What purpose, burden, safeguard, or measure should change?

Output

Changed frame + influence record

Foresight + scenario stress testing

Question

What changes if capabilities, scale, context, or actors change?

Output

Future conditions + triggers for reassessment

Mandates make decisions legitimate

Consider the reviews that can authorize or enable a concrete next step.

For a Swiss example, the Swiss National Science Foundation evaluates project funding through the scientific quality of the proposal and the qualifications of the researchers. Its current research-plan requirements identify scientific relevance, topicality, originality, feasibility, and the suitability of methods as central to the evaluation. For use-inspired research, the SNSF’s funding regulations also allow broader impact outside science to be considered.

That review does real governance work. Funding selects which uncertainty will receive time, people, equipment, and credibility. It can require better methods, clearer milestones, responsible data practices, or a more serious account of impact. Its decision remains a decision to support research. It is not permission to expose people to an experimental system or a judgment that a future service should be adopted.

Research ethics review answers another bounded question. In the United States, the Office for Human Research Protections describes institutional review boards, or IRBs, as reviewing studies for regulatory and ethical compliance and the protection of research participants. Terminology and procedure vary by jurisdiction. In Switzerland, research involving people is governed by the Human Research Act and associated ordinances. The Federal Office of Public Health states that such research requires authorization from a cantonal ethics committee, with the framework principally protecting the dignity, privacy, and health of participants while also supporting quality and transparency. For a pre-market Category C2 investigation of a non-CE-marked medical device, Swissmedic and the responsible ethics committee both review the investigation. Swissmedic’s current guidance requires the applications to be submitted in parallel and distinguishes the authorities’ responsibilities in the clinical-investigation process.

Neither decision is a rehearsal for the hospital’s eventual adoption decision. The reviews concern the submitted device, protocol, population, evidence, and safety arrangements. Their legitimacy comes partly from that boundary.

Market access is bounded too. Swissmedic explains that medical devices may be placed on the Swiss market or put into service only after the applicable conformity assessment procedure has been completed. This is not the same as an official Swissmedic authorization of the kind used for medicinal products; Swissmedic makes that distinction in its overview of medical-device regulation. Nor does conformity require a hospital to procure a device, a clinician to rely on it, or compulsory insurance to reimburse it.

Health technology assessment may ask a broader question without becoming a universal review. The Swiss Federal Office of Public Health describes HTA as a systematic evaluation supporting decisions about the efficacy, appropriateness, and cost-effectiveness of medical services under compulsory health insurance. Specific HTA protocols can also examine safety, budget impact, and ethical, legal, social, and organizational aspects. This breadth is valuable because it is organized around a defined coverage and policy question — not because it settles every possible use of the technology.

A mandated review becomes trustworthy by specifying who is deciding, which artefact is before them, what question they may answer, and what follows from their answer. Expanding every mandate until it covers the whole future of Relay would not remove fragmentation. It would replace several accountable decisions with an authority no institution legitimately holds.

Standards and tools make judgment repeatable

Another family of solutions works differently. Standards, checklists, risk matrices, impact assessments, templates, and software tools do not usually possess institutional authority of their own. Their strength is repeatability.

For medical devices, ISO 14971:2019 specifies a lifecycle process for identifying hazards, estimating and evaluating risks, controlling them, and monitoring whether those controls remain effective. The standard requires manufacturers to establish criteria for risk acceptability rather than supplying one universal acceptable level. IEC 62366–1 similarly specifies a usability-engineering process concerned with safety and use error.

These processes matter for a BCI whose performance depends on a person’s interaction with sensors, software, instructions, and support. They can expose hazards that an informal discussion misses, make design work auditable, and carry risk management into production and post-production activity.

They do not answer whether Relay’s intended benefit is the right benefit, whether a workplace use would be legitimate, whether a clinic has the capacity to operate the system, or whether a burden that is technically manageable is acceptable to the person carrying it. A safety-related usability process is not defective because it does not decide social desirability. It was built to make a particular kind of work systematic.

The same is true of less formal tools. A checklist can prevent a team from forgetting cybersecurity, consent, accessibility, or long-term support. A risk matrix can improve consistency under a shared method. An impact assessment can widen attention beyond immediate technical performance. A dashboard can make a large portfolio legible.

An investor or assurance team may use the same material to decide whether its own capital, support, or confidence is warranted. That is a consequential decision, but technical diligence does not inherit the authority of a research ethics committee, regulator, or hospital — or the standing and knowledge of an affected community.

Problems begin when comprehensiveness is mistaken for authority. A tool may contain questions about every stage and still be unable to decide who owns the answer, which institution may act on it, or whether evidence produced for one purpose is sufficient for another. Adding more fields does not resolve that problem.

Tools can nevertheless improve. They can state the decision they support rather than presenting a context-free verdict. They can keep evidence provenance, version, intended use, uncertainty, and affected perspectives visible. They can distinguish a missing answer from a negative finding and prevent unlike concerns from disappearing inside one total score. They can make conditions and review triggers easier to carry into the work that follows.

These improvements make a tool more useful inside a mandate. They do not give it a mandate of its own.

Participation changes what the mechanisms can see

Participatory and co-design methods solve a third kind of problem. They can change the question before an institution answers it.

Stroke survivors and therapists changed Relay’s study by showing that task performance alone concealed preparation, recalibration, fatigue, repeat-use tolerance, and support work. That contribution did not replace scientific, ethical, regulatory, or hospital judgment. It altered the object those institutions needed to judge.

This is more than a preference for good user research. Article 4(3) of the UN Convention on the Rights of Persons with Disabilities requires States Parties to closely consult with and actively involve persons with disabilities, through their representative organizations, in relevant decision-making. UNESCO’s 2025 Recommendation on the Ethics of Neurotechnology places participation, impact assessment, and monitoring across the whole neurotechnology lifecycle. The OECD’s responsible-neurotechnology work likewise combines safety, inclusivity, societal deliberation, oversight, stewardship, and anticipation of unintended use.

Participation can improve by becoming consequential. Institutions can show which outcome, use, safeguard, burden, or decision changed; preserve disagreement instead of reducing it to consensus; and make participation possible through accessible formats, time, compensation, and routes to challenge. They can invite people while the purpose and pathway remain open, not only after a protocol or product story has hardened.

Yet participation should not become a way to transfer institutional responsibility back to affected people. A stroke survivor can reveal that Relay’s calibration burden is unacceptable without becoming responsible for a funder’s award, an ethics committee’s authorization, a manufacturer’s risk controls, or a hospital’s staffing decision.

Participation gives the system knowledge and contestability that formal mandate alone cannot provide. The institution must still own what it decides.

Better local review makes the interfaces more important

Each family of solutions can improve without losing its identity.

A funder can state which claim it is supporting, which assumptions remain open, and which changes would alter the basis of the award. A research review can make participant burden, accessible involvement, support, stopping rules, and substantial modifications more visible. A manufacturer can connect intended purpose, risk controls, usability evidence, versions, and post-production signals. An assessor or hospital can judge the operating arrangement rather than the device alone. A participatory process can leave evidence of influence in the formal artefact instead of in a separate consultation summary.

These are not small reforms. They would prevent some gaps altogether.

The medical route is, in one sense, the comparatively structured case. Relay encounters identifiable moments of research-ethics review, conformity assessment, procurement, and clinical governance, each producing a decision and a record. A consumer BCI marketed for focus, relaxation, entertainment, or general wellness may not enter the same specialist sequence. In the United States, for example, the FDA’s current general-wellness policy explains that certain low-risk wellness products may not be actively regulated as medical devices, while some wellness software functions unrelated to diagnosis, cure, mitigation, prevention, or treatment fall outside the device definition. That does not make consumer BCIs unregulated: product safety, consumer protection, advertising, privacy, and data-protection rules may still apply. But those regimes do not necessarily create an equivalent chain of evidence review, adoption judgment, and continuing professional oversight. The UK Information Commissioner’s Office has likewise identified a need for regulatory cooperation and clarity as neurotechnology enters workplaces, homes, and wellbeing services. Here, the seams can be wider: responsibility is more dispersed, evidence thresholds may be less visible, and the consequential adoption decision may effectively be made by an individual, platform, or employer.

The more carefully each mechanism defines its boundary, the more clearly its interfaces matter. The next decision needs to know which evidence it can rely on, which conditions remain active, what has changed, whose perspective is missing, and which earlier assumption no longer holds. The previous institution may need to learn that a later use invalidated something it took for granted. Affected people may need a route to challenge a frame that has travelled intact through several formally correct reviews.

No individual mechanism can guarantee those relations while remaining inside its mandate.

The missing solution cannot be a super-reviewer

It is tempting to answer fragmentation by proposing one comprehensive body, one universal assessment, or one score that settles the whole case. That would make the system look coherent by erasing the reason its parts are distinct.

Research ethics, market access, funding, procurement, technical assurance, and participation do not represent bureaucratic duplicates waiting to be merged. They distribute authority because different decisions require different evidence, competence, accountability, and rights of challenge.

The residual problem is connection without absorption. Existing reviews need enough continuity to understand what came before and what changed, while retaining the freedom — and the obligation — to answer their own question. Affected people need to be able to alter the shared frame without being made responsible for every institutional decision. Tools need to carry context without pretending that context confers authority.

Project Relay is not under-reviewed. It has accumulated several valid but non-equivalent answers. If the hospital treats them as one general endorsement, it will claim more than any earlier institution decided. If it ignores them, it will repeat work and lose the history that makes its own judgment possible.

The next question is therefore not how to design a review that decides everything. It is what must connect across responsible decisions and what must remain separate so that each decision can still be trusted.