This website explains this concept of AFAP and something else called “As Low As Reasonably Practicable” (ALARP). The idea is that the device has as many of its risks either removed or mitigated as much as possible with 2 categories of exception. One is not necessarily reducing risk with additional or redundant alarms or controls. The other is that if there is really only 1 risk control that can fit/ makes sense/ etc. The article explains examples of both of these.

I think the documentation in the FMECA or whatever tool the company uses is what the FDA or governing body uses to determine if genuine thought and consideration for risks was taken. Then the mitigations are recorded and the governing bodies are responsible for reviewing. At the end of the day, the team that creates the risks/ mitigations documentation will be responsible and will have to deal with reprocussions if people end up hurt by the device.

http://medicaldeviceacademy.com/en-iso-149712012-deviation-3-risk-reduction/