PathAI

Machine learning on whole slide images is the entire company. The AIM product line consists of validated algorithms for quantitative biomarker assessment across commercially significant oncology targets, and the company reports having launched more than 20 AI products. The AISight platform is the delivery layer those models run inside, but the models are what customers and, evidently, acquirers are buying.

Positioned as quantitative assessment supporting pathologist interpretation rather than autonomous diagnosis, with the cleared platform used for primary diagnosis by a pathologist working inside it. The biopharma application is the more interesting oversight case: when a qualified tool scores liver biopsies as a trial endpoint, the algorithm's output becomes regulatory evidence rather than a suggestion a clinician can override, which is a materially different accountability structure that buyers and sponsors should understand as such.

The regulatory record forced and documented an unusual level of scrutiny. FDA qualification of the MASH tool as a Drug Development Tool required the agency to review the algorithm sufficiently to permit its use as a trial endpoint, which is a deeper examination than device clearance.

The 2025 AISight Dx clearance included a Predetermined Change Control Plan, meaning model updates follow a pre agreed path rather than arriving silently, which is the same disciplined mechanism Qure AI holds in imaging. Peer reviewed publication history extends to a first manuscript in Hepatology.

The privacy notice is better than the lane norm on the parts it covers and one clause undoes much of it. On the good side, the notice commits to data minimisation, stating that only the minimum information required to perform the services is requested and retained only as long as necessary, and security is described at control level rather than by assertion, covering encryption in transit, firewalls, access control lists, logging and monitoring, network isolation and host hardening.

A dedicated section addresses protected health information and routes its handling to business associate agreements. The notice is also candid in a way this index specifically credits, acknowledging plainly that complete deletion is not always possible and that residual data may remain on backup media, rather than implying deletion is absolute, which is true of every vendor here and admitted by almost none.

Three things hold it at C. No retention period or deletion schedule is stated for clinical images specifically, only a general principle. The permission to share de identified information derived from personal information with third parties is granted for any purpose and is unbounded, which is exactly where secondary use of material derived from customer cases would sit and nothing narrows it.

And the notice governs platforms and business interactions rather than slide images processed clinically, which are pushed to unpublished customer agreements. Ask for image retention and deletion terms, and a written limit on de identified derivatives.

Evidence sits across regulatory, commercial, and academic axes simultaneously. FDA and EMA qualification of AIM-MASH as the first AI powered pathology Drug Development Tool means two regulators independently accepted the algorithm as fit for endpoint assessment in registrational MASH studies.

Commercial validation is substantial: a national reference laboratory acquired the diagnostics lab business and licensed the platform for its own pathology operations, and Roche entered a merger agreement valuing the company at up to roughly 1.05 billion dollars after a partnership dating to 2021. The company also built its own CAP and CLIA certified laboratory to support end to end trial work.

Better than the lane norm on the parts that are published, and the gaps are specific rather than wholesale. The privacy notice commits to data minimisation, stating that PathAI requests only the minimum information required to perform the applicable services and retains it only for as long as necessary to provide them or for compatible purposes.

Security is described at control level rather than by assertion: encryption of communications in transit, firewalls, access control lists, logging and monitoring, network isolation and host hardening. A dedicated section addresses protected health information and routes its handling to business associate agreements.

The notice is also candid in a way this index credits, acknowledging plainly that complete deletion is not always possible and that residual data may remain on backup media, rather than implying deletion is absolute. Three things hold it at B. No retention period or deletion schedule is stated for clinical images specifically, only a general minimisation principle.

The permission to share de identified information derived from personal information with third parties is granted for any purpose and is unbounded, which is where any secondary use of material derived from customer cases would sit and nothing narrows it. And the notice governs the company's platforms and business interactions rather than setting out terms for slide images processed clinically, which are pushed to customer agreements that are not published. Ask for retention and deletion terms covering images, and for a written limit on what de identified derivatives may be used for.

The best stated business associate position in this lane, and the only record in it that names the instrument. PathAI's privacy notice carries a dedicated Protected Health Information section which states that use of its platforms may involve providing access to PHI as defined by HIPAA, that certain affiliated entities are required to comply with applicable federal and state healthcare privacy and security rules including HIPAA and equivalents in other countries, and that in those cases processing of PHI is governed by customer agreements, terms of use and business associate agreements as applicable.

Naming the business associate agreement as the governing instrument is the step almost every vendor in this index omits, and it tells a buyer where the obligations actually live rather than leaving them to assume. The notice also instructs that PHI should only be submitted through the platform as permitted or required for its use, which is a scoping instruction rather than a disclaimer.

A privacy officer is named with a postal address, email and telephone number, and an EU data protection representative is appointed with contact points across all 27 member states plus the United Kingdom, Norway and Iceland, which is an unusually complete Article 27 arrangement. Held at B rather than A because naming an instrument is not publishing one.

No business associate agreement or template is available, no data processing agreement is published, no subprocessor list was located, and the language is hedged throughout by referring to certain affiliated entities and to what applies as applicable, so a buyer cannot tell from the notice alone which PathAI entity would be their counterparty. Ask for the business associate agreement itself, and establish which entity signs it.

A real certification stated openly, paired with the most substantial vulnerability disclosure programme in this lane. PathAI holds ISO 27001 certification for its information security management system, and states it on the product page rather than burying it, alongside ISO 13485 and Medical Device Single Audit Program certification of its quality system. Those quality credentials are noted but not counted here, since they are not information security standards.

What lifts this above a single certification is the published vulnerability disclosure policy, which is unusually complete for this category. It applies to all systems and technologies PathAI owns or operates, accepts reports from any source, and makes five explicit commitments: to respond promptly, to work with researchers to validate and remediate, to protect the confidentiality of protected health information and personal information during the process, to acknowledge researchers, and critically to take no legal action against those reporting in good faith under the policy.

That safe harbour is the provision that makes a disclosure programme function, and many published policies omit it. A named security team receives reports through a web form. The policy also treats machine learning models and training datasets as protected assets and prohibits reverse engineering or extraction of them, which is worth noting as the opposite posture to the open weights approach taken elsewhere in this lane. Held at B because the assurance layer stops at one certification. No SOC 2 of either type was located, no trust centre exists, no certificate is published with its scope or expiry, no penetration testing statement was found, and no subprocessor list is available.

Among the strongest regulatory positions in pathology AI, and notable for spanning two distinct regimes. On the device side, AISight Dx holds FDA 510(k) clearance and CE marking for primary diagnosis, with a 2025 clearance of the evolved platform incorporating a Predetermined Change Control Plan.

On the drug development side, AIM-MASH received both FDA and EMA qualification as the first AI powered pathology Drug Development Tool, permitting sponsors to use it for endpoint assessment in registrational MASH studies, which is a different and in some respects higher bar than clearance. A dermatology product received Breakthrough Device Designation in March 2026, which expedites review and is not authorization.

Model change is governed by a plan a regulator has reviewed, which is a different and stronger mechanism than a published policy. The 2025 FDA clearance of the evolved AISight Dx platform for primary diagnosis was granted with a Predetermined Change Control Plan, allowing specified future enhancements without new submissions.

A change control plan agreed in advance with a regulator means the boundaries within which the deployed software may change have been reviewed by someone other than the vendor, and that the buyer can in principle establish what those boundaries are. Only two other products in this index hold one.

Separately, AIM-MASH AI Assist has received qualification from both the EMA and the FDA, described as the first AI powered pathology tool to achieve it, which is a regulator level assessment of a specific model rather than of the company's processes. Quality management is certified under ISO 13485 with Medical Device Single Audit Program coverage. What is absent is the fairness half, and it is absent entirely.

No performance breakdown across patient groups was located for any product, there is no published bias or fairness position, and no AI management system certification such as ISO 42001 was found. That gap is conspicuous against a portfolio spanning breast, lung, liver, gastrointestinal, dermatological and urological applications, and against a company that also supplies real world data and companion diagnostic development services to pharmaceutical partners.

Publishing subgroup performance for the cleared platform and for the qualified biomarker tools would move this materially, and the change control plan would make it easier to keep such figures current.

One regulatory route here is a higher bar than the clearances that dominate this index, and it is worth naming as a distinct third path. Qualification of the liver disease tool as a drug development tool required the agency to review the algorithm sufficiently to permit its use as a trial endpoint, which is a deeper examination than device clearance: a cleared device must be shown safe and effective for a clinical claim, while a qualified endpoint tool must be trusted enough that its output can decide whether a drug worked.

Everything downstream of that decision, including regulatory submissions and the fate of a development programme, rests on the measurement. A later clearance also included a predetermined change control plan, so model updates follow a pre agreed path rather than arriving silently, which addresses the drift problem this index credits elsewhere. Peer reviewed publication history extends to a first manuscript in a specialty journal.

Held below the top grade because nothing attaches commercially: no warranty, indemnity or remediation commitment was located, and qualification for one endpoint in one disease does not transfer to the rest of the catalogue. Ask which specific tools carry qualification and which do not, what the change control plan permits, and how sites are notified when a model updates mid study.

Integration targets the laboratory stack correctly, with connectivity to existing laboratory information systems and anatomic pathology workflows, whole slide image management covering storage, retrieval, and viewing, and both cloud and on premise deployment options for hospital and reference laboratory settings. The company also launched a global network of digital anatomic pathology laboratories. The acquirer's stated rationale centers on owning this image management layer, which is a fair read of where the platform's durable value sits. No named LIS integrations were enumerated.

Both cloud and on premise deployment are offered for hospital and reference laboratory settings, which is genuine flexibility and matters for laboratories with data locality constraints or large slide volumes. Specific tenancy and residency terms are not published, and deployment decisions may change under the acquiring organization.

No pricing is published for any part of the portfolio. No licence fee, no per case or per slide rate, no tier structure and no worked example was located for the AISight platform, for PathAI's own algorithm products, or for the partner algorithms distributed through it. Commercial engagement runs through a demo request or a dedicated enquiry address. The absence is compounded by the breadth of the offering, because a laboratory is not buying one thing.

The platform is licensed separately from the algorithms; PathAI's own algorithms and partner algorithms from several other manufacturers sit alongside each other in the same menu; and the company additionally sells biopharma services, clinical trial operations, real world data and companion diagnostic development. Nothing published explains how these are packaged or whether platform access is a precondition for algorithm access.

That matters more than usual for a host platform, because a buyer choosing between running an algorithm on this platform or on a competing one cannot compare the total cost of either route. One partial credit: the regulatory position of each component is published clearly, with the platform cleared and most algorithms marked research use only in the United States, so a buyer at least knows which items are clinically deployable before entering a pricing conversation.

Ask for the charging basis for platform and algorithms separately, whether partner algorithms are billed by PathAI or by their manufacturers, and what a laboratory pays if it runs no algorithms at all.

Two distinct customer bases with real depth in each: clinical diagnostic laboratories using the cleared platform for primary diagnosis, and biopharmaceutical sponsors using the interpretation modules and trial services for translational research and endpoint assessment. Clinical depth concentrates in oncology biomarkers with significant investment in liver disease through the MASH work, plus a dermatology product in development. This is a laboratory and research product with no provider clinical workflow surface.