Aiforia

Deep learning image analysis is the entire product. The Aiforia Clinical Suites are AI models plus a viewer, spanning breast, prostate, lung, colorectal, and gastric cancer plus lymph node metastasis detection, with no services or hardware layer. A separate Aiforia Create platform lets pathologists build their own models, which has produced a large body of third party research use models. The company sells the AI, not a workflow it happens to include.

Positioned throughout as pathologist support, not replacement. The clinical suites present findings for the pathologist to review and report, and the marketed benefit is time saved and consistency rather than autonomous sign out. Lymph node metastasis detection is framed as speeding navigation to relevant regions rather than making the call. This is an assistive tool with the human retaining the diagnosis, disclosed clearly and consistently.

Individual clinical models are described specifically, including the five model architecture behind breast cancer grading mapped to the Nottingham system components, and recent models are built on a foundation engine intended to hold up across variation in staining and scanning. Development partners are named by institution, University of Bern for lymph node metastasis for example. What is not published is training set size, demographic composition, or head to head benchmarking against competing pathology AI, so the transparency is descriptive rather than quantitative.

The architecture offers real customer control and the published instruments do not cover clinical data at all, which is the split on this record. Credited: the company states that customers determine what information is stored in the cloud and can opt for a private version, which is meaningful control over where patient material sits rather than a promise about how it will be handled, and its health privacy security controls have been independently tested.

Against that, the only privacy instrument published is a website policy, scoped by its own terms to visitors, newsletter recipients and marketing targets, and it does not address patient slide images at all, so a laboratory has no published document to read about the tissue it uploads. No retention period, no deletion position at contract end, and no statement on whether customer images inform the development of the vendor's own clinical models was located.

That last question carries unusual weight here because of what the platform is. Its central product lets laboratories build their own models on their own data, so the boundary between customer material and vendor model development is precisely the line a buyer needs drawn, and a platform designed around customer training is the one place where that line most needs to be written down. Ask for a processing agreement covering clinical images, a retention and deletion schedule, whether a customer built model is the customer's property, and a written statement on model training.

A real deployment record supports the claims: named clinical partners including AP-HP in Paris, Nantes University Hospital, Institut Curie, and a regional selection by the Lombardy health authorities in Italy for breast, lung, and prostate biopsy analysis. Academic work using the Aiforia Create platform appears in Nature and in Mayo Clinic and MSKCC studies, though most of that is research use rather than validation of the clinical suites. Vendor quoted efficiency figures such as up to 40 percent pathologist time saved on lymph node review are not independently verified here. Strong adoption signal, lighter published outcome evidence.

The architecture offers real customer control, and the published instruments do not cover clinical data at all, which is what holds this down. Credited: the company states that customers determine what information is stored in the cloud and can opt for a private version, which is meaningful control over where patient material sits, and its HIPAA Security Rule controls have been independently tested.

Against that, the only privacy instrument published is a website privacy policy, scoped by its own terms to visitors to the website, recipients of newsletters and marketing communications, and people targeted by direct marketing. It does not address patient slide images at all. A laboratory evaluating what happens to the tissue images it uploads therefore has no published document to read.

Nothing states a retention period, nothing states a deletion position at the end of a contract, and nothing states whether customer images inform the development of Aiforia's own clinical models. That last question carries unusual weight here, because the platform's central product lets laboratories build their own models on their own data, so the boundary between customer material and vendor model development is precisely the line a buyer needs drawn. Ask for a data processing agreement covering clinical images, a retention and deletion schedule, and a written statement on model training.

Stronger than the lane norm, and notable because the vendor is European rather than despite it. Aiforia states that it designed and implemented its security practices to comply with HIPAA, and that an independent audit firm evaluated and tested its controls for compliance with the HIPAA Security Rule, which is an external assessment rather than an assertion.

The company also describes its own position accurately and without inflation: HIPAA compliance is what allows it to host the cloud environment and maintain patient data on behalf of the customer, and it states plainly that this was a prerequisite to working with certain pathology laboratories in the United States. That is a precise description of the business associate function and an unusually honest account of why the work was done.

Two things hold it at B. The audited scope is the Security Rule, and the Privacy Rule is not addressed anywhere retrieved; these are different obligations covering different things, and a buyer should not read one as covering the other. And the business associate agreement itself is never named or described, so the contractual position Aiforia takes is unknown.

Elsewhere the company uses the looser formulation that it adheres to all applicable HIPAA policies and procedures, which is weaker than the audited claim and should not be treated as equivalent to it.

Three independent assessments, each named properly, which puts this alongside Ibex as the strongest security position in the lane. Aiforia holds ISO 27001 certification for its information security management system and SOC 2 Type II with the type specified, and separately states that an independent audit firm evaluated and tested its controls for compliance with the HIPAA Security Rule.

ISO 13485 is also held, but that is a medical device quality management standard rather than an information security one and is not counted here as security. What is absent is the disclosure layer rather than the assurance layer. There is no trust centre, no certificates are published, no penetration testing position is stated, no subprocessor list was located, and no control level detail is available without contacting the company.

That is the difference between this and the positions in this index that publish their certificates as documents a buyer can read before speaking to sales. A buyer should ask for the current certificates with their scope and expiry dates, the SOC 2 report and which trust services criteria it covers, the HIPAA Security Rule audit report, and the penetration testing cadence.

The regulatory footprint is real but European, not American. Aiforia obtained IVDR certification through notified body BSI Group in February 2025 and has since launched a series of CE-IVD marked clinical models under IVDR 2017/746 covering breast, prostate, gastric, and lymph node applications. IVDR is a rigorous framework with stricter clinical evidence requirements than the directive it replaced.

What is absent is any FDA clearance for the clinical suites, so a US buyer cannot deploy these diagnostically without a separate regulatory path. Graded C to reflect strong non US authorization with no US clinical clearance, the mirror image of vendors cleared by FDA but not CE marked.

No responsible AI statement, no bias or fairness position, no subgroup performance analysis and no AI management system certification were located. Aiforia holds IVDR certification through a notified body along with ISO 13485, and IVDR does carry stricter clinical evidence requirements than the directive it replaced, but a regulatory conformity route is not a published account of how a model performs across patient groups and is not treated as one here.

The absence is conspicuous for two specific reasons rather than as a general complaint. First, this is a European vendor selling clinical diagnostic AI into jurisdictions where the EU AI Act treats such systems as high risk and contemplates precisely this kind of documentation. Second, and more distinctive to this vendor, the platform's central product lets laboratories develop their own deep learning models on their own data.

A company that ships model building tools carries a governance surface that a single model vendor does not: who validates a customer built model, who monitors it once deployed, what happens when it is applied outside the population it was trained on, and who is accountable when it is wrong. Nothing retrieved addresses any of that. Publishing a subgroup performance breakdown for the certified clinical models, together with a statement of governance expectations for customer built ones, would move this materially.

The models are decomposed rather than presented as one system, and the decomposition maps onto criteria a pathologist already knows. Breast cancer grading is described as five models corresponding to the components of a recognised grading system, so a pathologist can see which sub task each model performs and can judge each against their own understanding of that criterion rather than being handed a composite grade.

That is a more useful disclosure than an aggregate accuracy figure would be, because grading disagreement between pathologists concentrates in particular components rather than spreading evenly, and a decomposed system lets a laboratory check the component it distrusts. Development partners are also named by institution, so a reader can identify who validated what.

Recent models are described as built on a foundation engine intended to hold up across variation in staining and scanning, which is the right target for this field. Held at C because the transparency is descriptive rather than quantitative. No training set size, demographic composition, per component accuracy or head to head benchmarking against competing products was located, and no warranty, indemnity or remediation commitment.

Demographic composition matters here for a specific reason: staining and tissue appearance vary with fixation and processing practice, which vary by institution and region, so a training set's geographic spread is a performance question rather than a fairness one alone. Ask for per component accuracy and the development population.

Delivered as cloud based whole slide image analysis, which places it in the laboratory information system and image management environment rather than the EHR. A sales and marketing partnership with Siemens Healthineers extends distribution reach. Specific LIS, scanner, and image management system integrations are not enumerated in the materials reviewed, so integration depth is asserted through partnerships rather than a published connector list.

Cloud based delivery is the described model, with a French subsidiary established partly to support local presence for European customers. Specific hosting, tenancy, and data residency terms are not published, which matters for pathology given whole slide images are large and jurisdiction sensitive under IVDR and GDPR.

No product pricing is published. As a company publicly traded on the Helsinki exchange, Aiforia discloses revenue and financial performance under listing requirements, giving a buyer more visibility into vendor stability than most private pathology AI competitors, but nothing on per case, per model, or platform licensing cost.

Focused on anatomic pathology across a widening set of tumor types, breast, prostate, lung, colorectal, gastric, plus lymph node metastasis across three primary cancers, with a distinct preclinical and research business through Aiforia Create alongside the clinical suites. That dual footprint, clinical diagnostics and research model building, is a differentiator, though the clinical side is concentrated in oncology histopathology rather than spanning general pathology.