This looks good as an overarching framework but will likely fall into the same bucket as a lot of regulation in cutting edge fields (if this ever becomes mandatory). These are only as good as the quality of the people doing the assessment.

I've worked with a lot of people in the medical world while developing SaMD (software as a medical device) in the past that had little to no idea about software. They can apply the principles in the abstract but will likely not dig deep enough to catch some very major issues.

In the medical world, things like post market surveillance and notification of adverse events help to at least create a public feedback loop here. I think we will need something similar in this space if we really want to see more than a surface level, checklist ticking exercise.