Creyos

The asset is a validated task battery and a large normative sample, not a model. A patient performs twelve short tasks, each task maps to a named cognitive domain, and the resulting scores are compared against a normative database the company states holds more than 85,000 participants. That is psychometrics done well, and the comparison to norms is the product.

Machine learning is claimed, but only in boilerplate: company material says it applies machine learning to digital cognitive assessment and leverages machine learning techniques, without naming what is learned, from what, or which output depends on it. Two retrieval passes located no mechanism description.

This is the moat is the dataset precedent in its purest form, the same call applied to Neurotrack in this same lane, and this grade describes the mechanism and says nothing about whether the product works, which is graded separately and considerably higher. Publishing what the models actually do, particularly inside the newer screening output that combines task scores into a single result, would move this grade immediately.

A clinician orders the assessment, the patient performs it, and the clinician reads a report and decides. Nothing is diagnosed autonomously and the company consistently describes the product as a decision support tool rather than a test that returns an answer. One oversight question is specific to this delivery model and is not addressed anywhere: assessments can be completed remotely at home through a secure link, unsupervised.

Unsupervised cognitive testing carries validity risks a supervised administration does not, since nobody can confirm whether the patient was distracted, assisted, using an unfamiliar input device or attempting the task more than once, and the normative comparison assumes standard administration. No published material describes how invalid or assisted attempts are detected or flagged.

Unusually inspectable, for the same structural reason that rules engines beat machine learning products on this axis. The twelve tasks are published instruments described in the peer reviewed literature across three decades, each task states the cognitive domain it measures, and the company points to more than 400 studies that have used them.

A clinician who asks why a score came out as it did can read the task and the construct it targets, which is not available for any learned model in this index. The tension worth naming is that the science is transparent and the artificial intelligence is not: the machine learning claim carries no description at all, and the screening output that combines multiple task scores into a single impairment signal is not documented. So the older half of the product is more transparent than most of this index and the newer half is less.

Nothing identifies any party in the chain: no model or model family, no foundation model provider, no hosting arrangement and no sub processor list was located in two passes, and two passes located no published statement on retention, deletion or data minimisation. One question is specific to this business and bears on both privacy and scientific integrity at once, which is unusual enough to state plainly.

The normative database is the commercial asset, it is described as growing, and nothing published says whether results from clinical patients flow into it. If they do, patients are contributing to a proprietary dataset as a byproduct of receiving care, and the comparison population is quietly shifting from a research cohort toward whoever happens to be tested in clinics, which changes what a percentile means over time without anyone being told.

That is a training data question and a validity question in the same breath, and it is the sort of thing that becomes very hard to unwind once a corpus exists. If clinical results do not enter the norms, the company should say so, because it is a straightforwardly favourable answer that costs nothing to give. Ask that, ask for a retention schedule, and ask for a sub processor list.

A large and genuinely independent research base, and a distinction a buyer must hold onto. The instrument level evidence is exceptional: the tasks have been used in more than 400 peer reviewed studies by investigators with no commercial relationship to the company, and independent validation exists inside the Prospective Imaging Study of Aging, where the platform was compared against comprehensive in person cognitive assessment in 141 participants and task performance was related to cortical sulcal width from structural magnetic resonance imaging.

Two studies featured at the 2026 Alzheimer's Association International Conference. But instrument validation and product validation are different claims. That these tasks measure cognition validly is well established; that this screener detects dementia in primary care better than existing practice rests on far less.

The headline screening validation reported perfect sensitivity across 14 patients with clinically diagnosed Alzheimer's disease and 86 percent specificity in case matched controls, and a sensitivity figure computed on 14 patients carries a confidence interval wide enough that it should not be read as a performance claim. Held at B because the research base is real and the product specific evidence has not caught up with it.

Two passes located no published statement on retention, deletion or data minimisation. One question is specific to this business and is worth putting to the company directly, because the answer bears on both privacy and scientific integrity: the normative database is the commercial asset, it grows, and nothing published says whether results from clinical patients flow into it.

If they do, patients are contributing to a proprietary dataset as a byproduct of care, and the comparison population is quietly shifting from a research cohort toward whoever happens to be tested in clinics. If they do not, the company should say so, because it is a straightforwardly favourable answer.

Graded on published posture with the scope stated. Two retrieval passes located no HIPAA statement, no Business Associate Agreement terms and no privacy or legal page from the company. This is a Canadian company selling into United States health systems, so two regimes are in play at once: HIPAA for its American customers and Canadian federal and provincial health privacy law, including Ontario's personal health information legislation, at home. Neither is addressed in anything located.

Business Associate Agreements certainly exist contractually, since the company states use by large North American health systems. This is the axis most likely to move on a further pass or a direct request.

Two retrieval passes located no SOC 2, no HITRUST, no ISO 27001, no trust centre and no vulnerability disclosure policy. The contrast inside this index's own behavioural health work is worth repeating here, because it inverts the expectation buyers bring: the least expensive tools in that lane published the clearest attestations while the enterprise products published none. Scale of customer is not a predictor of published security posture, and it should not be treated as one during procurement.

The company describes the platform as registered with the FDA. Registration is establishment listing, which means notifying the agency that a company and its device exist; it involves no review of safety, effectiveness or clinical performance. Clearance means the agency reviewed a submission. The two are routinely conflated and this index has graded the distinction before, most directly on Neurotrack.

What makes this instance sharper is that the confusion has already propagated outward: a clinic publishing its own list of assessment tools describes Creyos as FDA cleared, alongside genuinely cleared devices, in material patients read. The company states the weaker and accurate term; a downstream user upgraded it. That is the failure mode a registration claim invites, and it is an argument for stating the status with its meaning attached rather than as a two word credential.

The bias question here is not about a model, it is about the normative sample, and that makes it more consequential rather than less. Norms decide what counts as impaired: a patient is flagged because their score sits far enough below the reference population, so the demographic composition of those 85,000 participants determines who gets flagged and who does not. Nothing published describes that composition by age, education, language, or ethnicity.

Education and language effects on computerised cognitive tasks are large and well documented, and the tasks are delivered online in English. This index already holds the benchmark for exactly this question in exactly this lane: Cognivue's validation study was designed to test performance across age, education, sex, race and ethnicity strata, and quantified the skew in its own sample. Creyos holds a normative database far larger than that study and has not published the equivalent analysis. No model card, bias testing methodology or drift concept was located either.

The validated part of this product and the marketed part are different parts, and that is the assessment. Twelve published cognitive instruments described in the peer reviewed literature across three decades sit at the base, each stating the domain it measures, with more than four hundred studies having used them.

That is external validation of an unusually durable kind, and it means a clinician who asks why an individual task score came out as it did can read the task and the construct it targets, which is available for almost no learned model in this index. Contestability at that level is real. What is not documented is the layer the product actually sells.

The screening output that combines multiple task scores into a single impairment signal has no published derivation, weighting or validation, and the machine learning claim carries no description at all. So the older half of the product is more transparent than most of this index and the newer half is less, and a buyer relying on the composite is relying on something the published literature does not cover.

That distinction matters clinically, because a combined impairment signal is what triggers referral, further investigation or a conversation with a family, and the consequences of a false positive in cognitive screening reach into driving, employment and legal capacity. Ask for the derivation and validation of the combined signal specifically, and for its false positive rate in the populations it is used on.

Delivered as a web platform: a clinician sends an assessment link, the patient completes it in clinic or at home, and a report returns to the clinician. That makes adoption easy and integration shallow, which is a reasonable trade for an assessment ordered occasionally rather than a tool used continuously. Two passes located no named record system integration, no interoperability standard and no documented path for results to land as structured data in the chart.

The 2026 care planning capability raises the stakes, since a care plan that lives only in the vendor's platform is a second place a clinician has to look, and cognitive care planning is billable work whose documentation generally needs to sit in the record.

A hosted web platform with no published hosting architecture, named region or residency commitment located in two passes. Residency is a live question rather than a formality for this vendor specifically, because it operates across a border in both directions: a Canadian company holding assessment results for United States health systems, and a Canadian customer base whose provincial health privacy rules carry their own expectations about where records are held. Buyers on either side of that border would reasonably ask where the data sits, and nothing published answers it.

No pricing, pricing mechanism or contracting model located. The absence is less forgivable here than in categories with no payment pathway, because this one has an established pathway: cognitive assessment and cognitive care planning carry their own procedure codes in the United States, so a practice can already compute the revenue side of the decision from public schedules. Every input to the economics is publicly computable except the one number the vendor holds. Publishing a per assessment price would let a primary care practice work out the whole case in an afternoon, which is a strong sales argument the company is declining to make.

Broad for this category, and breadth is a real differentiator here. The same task battery is applied to mild cognitive impairment and dementia screening, attention deficit assessment, concussion and traumatic brain injury including baseline and return to play decisions, and behavioural health measurement through digitised standard questionnaires, with a separate research offering used in academic and commercial studies.

Settings run from primary care to neurology, concussion clinics, sports medicine and research. Delivery works in clinic or remotely on a desktop or tablet with ordinary touch or mouse input, requiring no proprietary hardware, which removes the capital barrier that limits several competitors. Geography is principally North America.

Held at B rather than A because the breadth comes from one instrument being pointed at many questions rather than from validated indication specific products, and the strength of evidence differs considerably between those uses.