Aiforia

Deep learning image analysis is the entire product. The Aiforia Clinical Suites are AI models plus a viewer, spanning breast, prostate, lung, colorectal, and gastric cancer plus lymph node metastasis detection, with no services or hardware layer. A separate Aiforia Create platform lets pathologists build their own models, which has produced a large body of third party research use models. The company sells the AI, not a workflow it happens to include.

Built for pathologist confirmation, with the failure side unpublished. The clinical platform combines a worklist, an interactive viewer, the AI models and case-level reporting; the models mark the exact findings they detect with visual overlays on the slide, so the pathologist can confirm each at any magnification before reporting, and breast grading is split into models for its separate components so each can be checked on its own. The marketed benefit is time saved and consistency, not autonomous sign out, and the CE-IVD models are sold as diagnostic aids.

The part missing is what happens when a model is wrong: no published thresholds, known failure conditions (scanner, stain, tissue quality) or route for reporting a wrong result.

The review structure is described, with the failure handling missing.

Individual clinical models are described specifically, including the five model architecture behind breast cancer grading mapped to the Nottingham system components, and recent models are built on a foundation engine intended to hold up across variation in staining and scanning. Development partners are named by institution, University of Bern for lymph node metastasis for example. What is not published is training set size, demographic composition, or head to head benchmarking against competing pathology AI, so the transparency is descriptive rather than quantitative.

The model layer is Aiforia's own, and nothing else in the chain is named. Aiforia builds its clinical models itself, on what it describes as a foundation engine, and develops some with named academic partners (the University of Bern for lymph node metastasis, the Mayo Clinic for QuantCRC), so no outside model provider sits between a slide and a result. The clinical platform and Aiforia Create are cloud based and browser accessed, and the clinical page says customers can choose between deployment options. What the pages do not name is the cloud host, any subprocessor, or the terms that govern slide images once uploaded: the only privacy policy published covers website visitors, not the platform.

A structurally short chain with the model layer in house, and the host and every other party unnamed.

A real deployment record supports the claims: named clinical partners including AP-HP in Paris, Nantes University Hospital, Institut Curie, and a regional selection by the Lombardy health authorities in Italy for breast, lung, and prostate biopsy analysis. Academic work using the Aiforia Create platform appears in Nature and in Mayo Clinic and MSKCC studies, though most of that is research use rather than validation of the clinical suites. Vendor quoted efficiency figures such as up to 40 percent pathologist time saved on lymph node review are not independently verified here. Strong adoption signal, lighter published outcome evidence.

Security assurances are published; nothing says what happens to slide images. The company names ISO 27001 and SOC 2 Type II, states that its HIPAA Security Rule controls were independently tested, and says customers can choose between deployment options. The only privacy instrument published is the website privacy policy (updated 21 April 2023), which by its own terms covers website visitors, newsletter subscribers and marketing targets and does not address slide images or the clinical platform.

No retention period, deletion position at contract end, de-identification practice or statement on training use is published for customer images. That last point carries weight here because Aiforia Create lets laboratories build models on their own data, so the line between customer material and Aiforia's own model development is the one a buyer needs drawn. Safety engineering, meaning how a wrong model output is handled as a safety event, is not published.

General security assurances that do not answer retention, training use or de identification.

HIPAA compliance is stated and independently tested for the Security Rule, but no document reaching the service is published. The Quality and Security page states that Aiforia designed and implemented its security practices to comply with HIPAA and that an independent audit firm evaluated and tested its controls for compliance with the HIPAA Security Rule, which is an outside assessment rather than an assertion. The company has also described HIPAA compliance as what lets it host the cloud environment and maintain patient data on behalf of customers, which is the business associate function. What is missing is the document behind it: the only privacy policy published (updated 21 April 2023) is scoped by its own terms to website visitors, newsletter subscribers and people reached by marketing, and does not cover slide images or the clinical platform. No business associate agreement is named or published, and the Privacy Rule is not addressed.

A status stated without a service privacy document or agreement behind it.

Recognized certifications are named with their versions, and no artifact is published. The Quality and Security page lists ISO 27001:2022 for the information security management system, a SOC 2 Type II report, and a statement that an independent audit firm evaluated and tested the controls Aiforia identified for compliance with the HIPAA Security Rule, beside ISO 13485:2016 and IVDR certification, which are quality and regulatory credentials rather than security ones. The page describes what each standard requires but publishes no certificate, report, scope statement, audit period or expiry, no penetration testing position and no trust portal, so none of the artifacts can be read before contacting the company.

The certifications come named and versioned, and none of the documents behind them is public.

A European regulatory position stated precisely, with the United States position stated beside it. The clinical solutions page labels each model: the Breast Cancer Suite models, the prostate biopsy solution, the lung and gastric models named there and the Clinical Suite Viewer are CE-IVD marked for diagnostic use in EU and EEA countries under the IVDR, and research use only and for performance studies only in all other markets, which includes the United States. Some models, such as QuantCRC and the H. pylori model, are research use only in every market, and the page's regulatory note says only certain models are CE-IVD marked. The company lists IVDR certification and ISO 13485:2016 on its Quality and Security page; the notified body certification (BSI, February 2025) is the company's reported route. No FDA clearance is claimed for any product, and nothing in its published material markets a diagnostic use in the United States.

The marketing stays within the European regime it names, and there is no US clearance.

Robustness is asserted, and no evaluation by group is published. The company says its recent models are built on a foundation engine designed to perform across real world variation in sample quality, staining and scanning, which is the right target for pathology, but no results by scanner, stain protocol, site or patient group are published for any CE-IVD model, and no responsible AI statement or AI management system certification appears. IVDR certification and ISO 13485 are regulatory and quality credentials, not an account of how a model performs across groups. The platform also lets laboratories build their own models in Aiforia Create, which adds a governance question a single model vendor does not face: who validates a customer built model, who monitors it once deployed, and who is accountable when it is wrong. Nothing published addresses that.

Robustness claimed with no evaluation behind it.

Mechanisms let a pathologist check each result, and nothing stands behind the output. The clinical platform marks the exact findings the models detect with visual overlays on the slide, so a pathologist can confirm each one at any magnification, and breast grading is split into models for the separate grading components (mitotic count, tubule formation, nuclear pleomorphism), so a laboratory can check the component it distrusts. Results flow into case-level reporting that the pathologist signs.

The product pages describe accuracy only in words (high correlation with expert grading, outstanding sensitivity and precision for HER2) and publish no error rate with a method and denominator. No warranty, indemnity or remediation commitment attaches to a result, and no route is published for reporting a wrong output.

Review mechanisms with nothing attached to the output.

Integration is claimed with an API behind it and no system named. The clinical solutions page says Aiforia integrates into existing laboratory systems, with publicly available API specifications, and that customers choose among deployment options. A sales and marketing partnership with Siemens Healthineers extends distribution. The company names no laboratory information system, image management system or scanner integration, and no standard such as DICOM or HL7, so integration depth rests on the API and partnerships rather than a connector list. For a pathology product the laboratory information system and image management system, not the patient chart, are the correct surfaces.

What exists is an API and a distribution partnership, with no connected system named.

Cloud delivery with options mentioned and no location committed. The clinical platform and Aiforia Create are described as cloud based and browser accessed, and the clinical solutions page says customers can choose from different deployment options according to their needs, without saying what those options are. The company has described a private version as one choice, and it established a French subsidiary partly to support European customers. No hosting provider, region, residency commitment or tenant isolation model is published, which matters for whole slide images that are large and sensitive under the GDPR, and for a company marketing CE-IVD models to EU laboratories while holding HIPAA Security Rule attestations for US customers.

A hosted service with location implied rather than committed.

No product pricing is published. As a company publicly traded on the Helsinki exchange, Aiforia discloses revenue and financial performance under listing requirements, so its financial footing is public, but it discloses nothing on per case, per model or platform licensing cost.

Oncology histopathology across five tumor families, with the diagnostic scope set by market. The clinical suites cover breast (grading, ER, PR, HER2, Ki67 and more), lung (including PD-L1), prostate biopsy, gastric and colon, plus prognostic research models such as QuantCRC; each model is CE-IVD marked for diagnostic use in EU and EEA countries under the IVDR, or research use only, and all are research use only and for performance studies only in the United States and other markets. Named clinical users include Memorial Pathology, Fimlab and a public healthcare provider in the Veneto region, and models were developed with named institutions (the University of Bern, the Mayo Clinic). Aiforia Create serves preclinical and academic research separately. The site does not list the validated scanners and stains for each model.

Coverage is named, and validation stands behind part of it.