Oxipit

The most AI central product in this index by a clear margin, because the AI does not assist a clinician, it replaces one for a defined slice of work. ChestLink identifies chest X-rays with no abnormality and produces finalized patient reports with no radiologist intervention at all.

The broader CXR Suite detects 75 findings, which the company states covers roughly 90 percent of abnormalities radiologists encounter daily, plus a quality module that continuously re checks AI negative studies.

This vendor defines the far end of the autonomy axis and should be read carefully rather than simply admired. For high confidence normal studies there is no human in the loop by design: the report is finalized and issued autonomously.

The safeguards are threshold based rather than review based, with the company reporting a 99 percent sensitivity metric translating to zero clinically relevant errors during piloting, more than 500,000 real world images processed in supervised operation for over a year before certification, an audit log for operational oversight, and a separate quality module re examining AI negative cases.

The grade is B rather than A because the entire safety case rests on the confidence threshold holding in each deployment's case mix, which is a materially different risk posture than clinician review and demands local validation.

The regulatory bar itself forced disclosure most vendors never face, and the company published the operational specifics. Pre certification evaluation ran in supervised reporting across multiple pilot sites for more than a year on over 500,000 real world chest X ray images, with a stated 99 percent sensitivity threshold. The system is described as accounting for patient age, clinical context, and variation in radiologist subjectivity, and it produces an audit trail. Scope is quantified concretely at 75 detectable findings. For an autonomous product this level of published operating detail is the minimum acceptable, and unusually the company meets it.

One distinction belongs at the top of this record because it is easy to accept an audit log as an answer here and it is not one. The company describes an audit log covering its autonomous reporting decisions, and that is a clinical safety and accountability mechanism: it records which studies the system judged normal and reported without a radiologist, which is exactly what a department needs to review its own exposure. It is genuinely valuable, and it is not a data stewardship disclosure.

Knowing that a decision was logged tells a buyer nothing about how long the image was kept, who could see it, or whether it trained anything. No retention period, de identification statement, training policy or deletion term was located, and no model, hosting arrangement or sub processor list was named. The stewardship question carries unusual weight for this product because of what it does.

This is the only regulatory authorised autonomous reporting application in the index, issuing finalised reports on studies no clinician reviews, so the studies it processes are the ones with the least human contact anywhere in the imaging pipeline, and the record of what the model saw is in some cases the only record of the examination having been assessed at all. The quality module that re checks studies called negative is a real safeguard and belongs in the same conversation. Ask what is retained on an autonomously reported study, for how long, and whether such studies inform model development.

Operational evidence is substantial and independent selection decisions add weight. The company reports autonomous handling of 15 to 40 percent of daily reporting workflow depending on institution type, validated across 500,000 plus images pre certification. Two European diagnostic groups selected the suite following structured multi vendor evaluations, one assessing three leading vendors across more than 700 real world cases. Deployment extends into low resource settings.

What is missing is peer reviewed outcome evidence quantifying missed pathology rates in live autonomous operation, which is the study the category most needs and which the vendor best positioned to run has not published.

Converted from Not Rated. The prior note draws a distinction that deserves keeping, because it is easy to accept an audit log as an answer here and it is not one.

The company describes an audit log covering its autonomous reporting decisions. That is a clinical safety and accountability mechanism: it records which studies the system judged normal and reported without a radiologist, which is exactly what a department needs to review its own exposure. It is genuinely valuable and it is not a data stewardship disclosure. Knowing that a decision was logged tells a buyer nothing about how long the image was kept, who could see it, or whether it trained anything.

No retention period, de identification statement, model training policy or deletion term was located.

The stewardship question carries unusual weight for this product because of what it does. This is the only regulatory approved autonomous reporting application in the index, issuing finalised reports on studies no clinician reviews. The studies it processes are therefore the studies with the least human contact anywhere in the imaging pipeline, and the record of what the model saw is in some cases the only record of the examination having been assessed at all.

The quality module that re checks studies the system called negative is a real safeguard and belongs in the same conversation.

Ask what is retained on an autonomously reported study, for how long, and whether such studies inform model development.

Converted from Not Rated. The scoping in the prior note is correct and unusually precise, and the vendor does not overclaim.

The health privacy rule is not the operative regime for current deployments. The company is European, and its autonomous reporting product holds Class IIb certification under the European medical device regulation. That product is not available for autonomous use in the United States, because no regulator there has authorised a device to issue a final diagnostic report with no clinician involvement. So the deployments that exist sit under the European data protection regulation rather than under the United States health privacy rule.

Stating that plainly rather than asserting health privacy compliance is the right behaviour and it earns the grade. Vendors in adjacent positions routinely claim the rule applies to them as a trust signal whether or not it does, and this index has recorded the resulting imprecision repeatedly.

Held at B rather than A because the European position is identified rather than documented. No data processing agreement, no controller and processor role statement, no transfer mechanism and no subprocessor terms were retrieved, and those are the instruments that regime requires.

One forward looking item belongs here. The non autonomous parts of the suite, detection across a wide finding set and the quality module, are a different regulatory proposition and could reach the United States market separately, at which point the analysis above changes entirely.

Ask for the data processing agreement, and which products are sold into which jurisdictions today.

Converted from Not Rated, and the acquisition raises a question this axis has to answer carefully.

No SOC 2 of either type, no ISO 27001 and no trust centre was located for this company.

The complicating fact is ownership. The company was acquired by a major imaging information technology vendor in a transaction completed April 2026, and that acquirer operates in a market segment where security certification is standard and very likely holds its own. The temptation is to read the parent's posture across to the subsidiary, and this index does not permit that.

The reasoning is the same one applied to certification non transfer elsewhere in this chain, including the case of a parent group's platform and data assets. A certification has a defined scope: named systems, named locations, named processes, assessed at a point in time. An acquired product is inside that scope only if it has been brought inside it, which requires the systems to be migrated or the assessment to be re performed with the new scope. Neither happens automatically on closing, and integration typically takes longer than the first renewal cycle.

So the buyer question is precise rather than general: is this product in scope of the parent's certification today, and if not, when.

The holding remains significant regardless. This is the only regulatory approved autonomous reporting product in the index, which means it writes final reports on studies no clinician sees.

Ask whether the product is within the parent's certified scope, and for the certificate showing it.

A genuinely unusual regulatory position that buyers must read precisely. ChestLink holds CE Class IIb certification, the first regulatory approval anywhere permitting an AI medical imaging application to perform diagnostic reporting autonomously, opening deployment across 32 European countries. Class IIb reflects the elevated validation standard required to let software complete a diagnostic task independently.

Critically, the company states plainly that autonomous operation is CE marked and available in Europe and is not available for autonomous use in the United States. A US buyer therefore cannot deploy the capability that defines this vendor. Recent CE certified extensions cover chest CT and musculoskeletal X-ray.

No formal governance program was located, but two disclosed design elements do governance work: the system explicitly accounts for patient age and clinical context in its confidence determination, and a separate quality module continuously re checks AI negative studies, which is a standing false negative control rather than a one time validation.

What is absent, and matters more here than for any assistive product in the index, is published subgroup analysis showing the confidence threshold holds across demographics, equipment, and disease prevalence, since an autonomous system's errors are never seen by a clinician.

The regulatory bar forced a level of disclosure most vendors never face, and the company published the operational specifics rather than the headline. Pre certification evaluation ran in supervised reporting across multiple pilot sites for more than a year on over five hundred thousand real world chest images, with a stated sensitivity threshold, and the scope is quantified concretely at seventy five detectable findings.

Prospective supervised operation before authorisation is a different kind of evidence from a retrospective study: the system ran on live studies while a radiologist still reported them, so every disagreement was observable at the time rather than reconstructed afterwards, and a year at that volume surfaces failure modes a curated test set never would.

Enumerating the findings the system can detect is equally important for an autonomous product, because it defines by omission what will not be detected, and a normal report from a system with a bounded finding list means normal for those findings only. The system is also described as accounting for patient age, clinical context and variation in radiologist subjectivity, and it produces an audit trail.

Held below the top grade because no warranty, indemnity or remediation commitment attaches, and because the stated threshold is a design target rather than a measured deployment outcome. Ask for post authorisation performance in live autonomous operation, and the miss rate on findings outside the enumerated list.

Integrates directly into PACS workflow, with the company emphasizing minimal IT requirements and stated scalability from 5,000 to more than 500,000 radiographs per year. Deployments have run through third party AI orchestration platforms, and following the acquisition the product is available through the acquirer's AI marketplace, which gives customers of that imaging IT vendor a procurement path without separate integration. A web dashboard provides triage oversight and performance metrics.

Converted from Not Rated. No hosting, region, tenancy or residency terms were located, and the acquisition changes what the answer will eventually be.

The product is described as requiring minimal information technology footprint and integrating with the existing archive, which suggests deployment flexibility and possibly a local inference option, but nothing states which architectures are offered. That inference should not be treated as a disclosure.

Two structural factors matter more than usual here.

The first is the acquisition. The company is now part of a major imaging information technology vendor and is distributed through that organisation's artificial intelligence marketplace. Products absorbed into a larger platform typically migrate onto the parent's infrastructure over time, so the hosting answer a buyer receives today may not describe where the software runs in two years. That is worth asking about directly rather than discovering at renewal.

The second is jurisdiction. Deployments sit under the European data protection regulation, which imposes real transfer and localisation constraints, and the acquirer is also European. That is a coherent position and none of its specifics are published.

The autonomous product adds a residency wrinkle worth naming: where a study is reported with no clinician involvement, the processing location is also the location where the only assessment of that examination occurred.

Ask which architecture is offered, in which region, and what the migration plan is post acquisition.

Converted from Not Rated. No price is published, and the prior note is right that the most consequential commercial fact here is not price but ownership.

The company was acquired by a major imaging information technology and cybersecurity vendor in a transaction completed April 2026, and the product is now distributed through that organisation's artificial intelligence marketplace. Procurement, contracting, roadmap and support all run through the parent. That is a material commercial disclosure and it is public, which is why this grades above the usual no pricing floor: a buyer knows who it is actually dealing with, which is more than most records in this pass reveal.

The practical consequences are worth setting out. Buying through a platform marketplace usually means one contract and one support relationship covering several algorithms, which lowers administrative friction and raises concentration. A department already running that vendor's archive is buying an extension rather than adding a supplier. A department running a competitor's archive should establish whether the product remains available to it at all, since acquisitions of algorithm vendors by platform vendors have historically narrowed third party availability over time. This index has flagged the same pattern in pathology, where consolidation raised the question of whether an open platform survives ownership by a company with its own pipeline.

No rate, unit, term or marketplace pricing structure is published.

Ask whether availability is guaranteed to non parent archive customers, and for the pricing unit within the marketplace.

Chest X-ray is the core and the only modality where the autonomous capability exists, with CE certified extensions into chest CT and musculoskeletal X-ray announced for 2026. Settings span hospital and outpatient diagnostic imaging in Europe, with the company citing deployments in resource limited health systems where radiologist scarcity is most acute, which is arguably where autonomous reporting has its strongest justification. United States buyers should treat this as a detection and triage product only.