Autonomize AI

The agents are the product. There is no system of record, no services organisation and no legacy platform beneath them, and the company positions explicitly against general purpose models retrofitted for healthcare, claiming healthcare specific understanding of medical context, terminology and operational nuance as the differentiator. Every commercial line, prior authorisation, payment integrity, care gaps, chart review, case management, is an agent built on the same orchestration layer.

Human oversight is stated as a design differentiator rather than assumed. The chief executive describes a human in the loop approach in which clinical teams retain full control while agents remove administrative work, and the platform names real time governance and explainability as capabilities. That framing is deliberate and better than the norm on the payer side. Held at B because none of it is specified anywhere a buyer can check.

No confidence threshold, no routing rule, no abstention behaviour, no error rate and no statement of which determinations require human sign off was located. One structural point matters more here than the missing parameters: with more than 160 agents, an oversight claim made at platform level says nothing about how any individual agent behaves, and the risk profile of a care gap summary and a coverage determination are not remotely the same. Ask for the oversight model agent by agent, starting with any agent that touches an adverse determination.

Explainability and real time governance are named as platform capabilities, which is more than most payer side vendors claim, but neither is described in any detail that a buyer could evaluate. No model or model family is named, no accuracy figure is published for any agent, no evaluation methodology or error taxonomy exists, and there is no model card. The published numbers are uniformly efficiency measures rather than correctness measures.

One claim sits closest to accuracy, an 80 percent reduction in manual errors, and it carries no baseline, no definition of what counts as an error and no measurement method, so it cannot be read as evidence about output quality.

A trust portal exists and documents a real compliance programme, which changes what a buyer can obtain rather than what the company has published. An audited control report available on request will describe controls over confidentiality and privacy, and a control report is not a stewardship position: it establishes that stated controls were tested, and says nothing about retention, training use or separation.

No retention period, position on whether customer data trains the agents, or de identification posture was located, including on the portal itself. The architecture is what makes those questions material rather than procedural. The platform ingests clinical notes, faxes, documents and claims across health plans, provider organisations and life sciences customers simultaneously, and is sold as a library of more than a hundred and sixty pre built agents.

Those three customer types have divergent and sometimes opposing interests in the same data: a payer, a provider and a pharmaceutical company each want different things from a record describing the same patient's treatment, and all three are tenants of one platform. Establish what separation exists between customer estates, whether anything learned from one customer's material informs agents serving another, and how long ingested source documents persist after processing. A multi tenant agent platform is precisely the architecture where the answer is not inferable from a compliance badge. Ask for all three in writing.

Substantial commercial traction with no published measure of correctness, which this index grades C. A 28 million dollar Series A, deployments described at Fortune 100 healthcare organisations and top 20 pharmaceutical companies, distribution through the Microsoft marketplaces, and a named executive endorsement from Lyric, itself an indexed vendor in this category, are all real signals about adoption. None of them is an organisation named as a customer, and none is a study.

Every reported outcome is an efficiency figure, 78 percent less time per case, 85 percent better case review efficiency, up to 55 percent staff time savings, prior authorisation collapsing from twenty or thirty minutes to seconds, and all are vendor reported without a stated baseline, denominator or method. Nothing published establishes whether the agents reach the right conclusions.

No retention period, no statement on whether customer data is used to train or improve the agents, and no de identification posture was located, including on the company's own trust portal.

That portal does document a real compliance programme, and its existence changes what a buyer can obtain rather than what the company has published. A SOC 2 Type 2 report available on request will describe controls over confidentiality and privacy, but a control report is not a stewardship position, and the specific questions on this axis stay open.

The scope makes them material rather than procedural. The platform ingests clinical notes, faxes, PDFs and claims across health plans, provider organisations and life sciences customers simultaneously, and is sold as a library of more than 160 pre built agents. Establish what separation exists between customer estates, whether anything learned from one customer's material informs agents serving another, and how long ingested source documents persist after processing. Ask for those in writing, because a multi tenant agent platform is precisely the architecture where the answer is not inferable from a compliance badge.

HIPAA compliance is claimed alongside SOC 2, with no business associate agreement terms published, which is the standard middle rung. Worth establishing separately for the life sciences line, since research and clinical trial work may run under different authorisations and agreements than the payer and provider work, and a single platform level compliance statement will not describe both.

Autonomize publishes a trust centre at trust.autonomize.ai and states SOC 2 Type 2 compliance with the type named, which is the distinction that decides the whole assurance question and which a number of vendors in this index leave ambiguous. The SOC 2 Type 2 report itself is stated to be uploaded to the trust portal for customer reference rather than only described, so a buyer can obtain the artefact through a normal request rather than a negotiation.

The portal also documents HIPAA compliance, annual security and privacy awareness training with the topics named, a multi factor authentication requirement in the password policy, cyber insurance carried specifically against security incidents, and breach notification governed by the master services agreement.

Held at B rather than A because no ISO 27001 or HITRUST certification is claimed, no scope statement or observation period was retrievable from the public portal, and no penetration testing cadence was located. For an A this index looks for either a broader certification stack or a published scope a buyer can read without asking. This grade replaces an earlier assessment that recorded no trust centre and no report type; both are stated and the earlier note was out of date.

No FDA clearance or device authorisation was located and none is expected, since the agents inform coverage, payment and administrative determinations rather than diagnosis or treatment. The regulatory exposure sits squarely in payer regulation and it is moving quickly: CMS interoperability and prior authorisation requirements that took effect in 2026 mandating electronic submission and faster turnaround, and a growing set of state laws restricting or conditioning AI involvement in coverage denials.

Graded C because the company states no position on any of it. The comparison worth making is with Cohere Health, which holds both URAC and NCQA utilization management accreditation. A plan working with an accredited partner can rely on that accreditation in its own delegation oversight. A plan buying agentic prior authorisation from an unaccredited vendor inherits the exposure instead, and that is not something a pricing negotiation surfaces.

The grade describes disclosure, and the credit is genuine. Naming real time governance as a platform capability rather than as a policy, alongside explainability and an explicit human in the loop stance, is more than most payer side vendors offer.

Three things hold it at C. First and most important, this index holds that on the payer side automating an approval is low risk while automating a denial is not, and nothing published states whether any agent can influence, prepare or generate an adverse determination, or what human review is mandatory on that path. The payment integrity line, which embeds review before improper claims are paid, sits on the same side of that question.

Second, a governance claim made at platform level across more than 160 agents does not describe the behaviour of any one of them, and the risk sits at agent level. Third, no fairness, subgroup or demographic performance disclosure of any kind was located, which matters in prior authorisation and care gap work where differential outcomes are well documented.

Explainability and real time governance are named as platform capabilities, which is more than most payer side vendors claim, and neither is described in any detail a buyer could evaluate. No model or model family is named, no accuracy figure is published for any of the more than one hundred and sixty agents, no evaluation methodology or error taxonomy exists, and no model card or warranty, indemnity or remediation commitment was located.

The published numbers are uniformly efficiency measures rather than correctness measures, and one of them deserves separating out because it sounds like an accuracy claim and is not. An eighty per cent reduction in manual errors is a statement about the humans the system replaced, not about the system's own error rate, and the two are independent: a process can eliminate most human transcription errors while introducing a smaller number of different errors nobody is checking for, and the net figure would still look good.

It also carries no baseline, no definition of what counts as an error and no measurement method. Naming explainability without describing it has the same problem, since a buyer cannot tell whether an agent shows the source passage, the rule applied, a confidence score or a post hoc rationalisation, and those differ entirely in what they let a reviewer catch. Ask what explainability shows, for per agent accuracy on the agents you would deploy, and the error definition behind the reduction claim.

Interoperability here means plan systems rather than EHRs, and the stated position is sensible but unnamed. The company says its copilots interface with a health plan's existing internal and third party prior authorisation and medical policy systems without requiring changes to the medical management platform, which is the right architectural promise for that buyer and lowers adoption friction. Ingestion is format agnostic across clinical notes, PDFs, faxes and claims.

Graded C because no medical management, utilisation management or EHR system is named anywhere, no integration standard is described, and the only concrete distribution surface located is the Microsoft marketplaces. Ask which specific platforms are in production today rather than which are theoretically supported.

Described as integrating with major cloud providers and distributed through the Microsoft marketplaces, which establishes cloud delivery. No region, residency commitment or explicit customer hosted option was located. One question is worth asking directly because the answer would materially change the data posture: whether marketplace availability means the platform can be deployed into the customer's own cloud tenancy, where clinical content would remain inside infrastructure the plan controls, or whether it is vendor hosted with the marketplace serving only as a procurement route. Those are very different postures and the public material does not distinguish them.

No price, tier or pricing mechanism was located on any retrieved surface.

Worth checking the Microsoft marketplace listings directly during evaluation, since marketplace distribution sometimes carries published or transactable pricing that a vendor's own site does not. If it does, that is a materially more transparent route than the standard enterprise negotiation.

Broad across buyer types and workflows rather than deep in a clinical specialty. Three distinct markets are served, health plans, provider organisations and life sciences companies, and the workflow coverage spans prior authorisation, payment integrity and pre payment review, benefit determination between medical and pharmacy, HEDIS care gap analysis, case management, chart review and clinical trial planning.

Within prior authorisation the company names specific service categories including inpatient, imaging, cardiology and durable medical equipment, which is more granularity than most competitors offer on that axis. Graded B rather than A because the breadth comes from many prebuilt agents on one orchestration layer rather than from instrument level depth in any single workflow.