Rad AI

Generative AI is the product. The impression, the structured report, and the carried forward prior findings are all model outputs; without the model there is no product, only dictation software.

Structurally the clearest oversight model in the index, because the workflow itself enforces it: the AI drafts the impression and the radiologist reviews and signs every report before it leaves. The vendor also states the tool surfaces clinically significant errors in the radiologist's own dictation in about 5 percent of reports, which positions the model as a check on the human rather than a replacement for review.

More than most vendors in this category disclose, which is what separates this from a C. The company states plainly that it uses its own generative models trained specifically for radiology rather than general purpose models, and that it holds one of the largest proprietary radiology report datasets in the world. That answers the question this index puts to every generative vendor about whether the product is a thin layer over somebody else's model, and it answers it in the direction that removes an external model provider from the data chain.

Held off A because none of the evaluation apparatus is published. No architecture, no training data provenance beyond the assertion that the corpus is proprietary and large, no benchmark, no validation methodology and no error taxonomy. The headline figure that the tool catches clinically significant errors in about 5 percent of reports carries no definition of what counts as clinically significant, no denominator and no independent verification, so a buyer cannot tell whether it describes a meaningful safety function or a broad class of minor corrections. Ask for the definition and the denominator before treating that number as a safety claim.

A specific and domain appropriate control is published, and the same disclosure raises the question that holds this back. The company states it operates a de identification pipeline specialised to radiology reports, which is a named technical control aimed at the actual modality rather than a generic assurance, and it is the right control: free text reports carry identifiers in narrative, in referring physician names and in dictated asides rather than in labelled fields, so a general purpose redactor built for structured data would miss most of them.

Credit for building the harder thing. The inference is the finding. A de identification pipeline built and maintained at that level of specialisation is itself evidence of a systematic secondary use programme, because a company does not build one unless it is routinely processing customer reports for a purpose beyond returning the immediate output.

The control implies the practice, and the company separately states it holds one of the largest proprietary radiology report datasets in the world and trains its own models on it, while the product learns each radiologist's language preferences from their historical reports.

Three questions follow and none is answered publicly: what standard the pipeline meets and whether that has been independently validated, what retention applies to report text and to artefacts derived from it, and whether learning is isolated to the originating customer or pooled across the estate. Establish whether your reports enter a dataset serving other customers, and whether you can decline without losing the personalisation the product is sold on.

Specific, falsifiable operational figures with named baselines, which is better than most: follow up exam completion improved from roughly 30 percent to over 75 percent with Continuity, a reported median of one hour saved per radiologist shift, and up to 35 percent fewer dictated words. Held back from A because these are vendor and customer reported without published methodology or peer review.

A specific and domain appropriate control is published, which is unusual in this category. The company states it operates a de identification pipeline specialised to radiology reports. That is a named technical control aimed at the actual modality rather than a generic assurance that data is protected. Free text radiology reports carry identifiers in narrative, in referring physician names and in dictated asides rather than in labelled fields, so a pipeline built for that material is the right control and it is credited here.

The same disclosure raises the question that holds this off A. The company also states it holds one of the largest proprietary radiology report datasets in the world and trains its own models on it, and the product is described as learning each radiologist's language preferences from their historical reports. A de identification pipeline built and maintained at that level of specialisation is itself evidence of a systematic secondary use programme, because a company does not build one unless it is routinely processing customer reports for a purpose beyond returning the immediate output. The control implies the practice.

Three questions follow and none is answered publicly. What standard the pipeline meets, whether safe harbour or expert determination, and whether that has been independently validated. What retention period applies to report text and to artefacts derived from it. And whether learning is isolated to the originating customer or pooled across the estate that produced the proprietary corpus. A buyer should establish whether its own reports enter a dataset serving other customers, and whether it can decline without losing the personalisation the product is sold on.

HIPAA compliance is asserted and there is corroborating evidence of an operating programme, but no instrument is published and the assertion itself is loosely worded.

Supporting the grade: the security page states HIPAA compliance alongside the SOC 2 Type II attestation, and a published cybersecurity role at the company names coordinating HIPAA compliance assessments including risk analyses and policy reviews, and managing business associate agreements, as core duties. A staffed function performing risk analysis and administering agreements is stronger evidence than a marketing line alone, and agreements plainly exist given deployment inside hospital radiology departments.

Against it: no agreement terms are published and nothing states whether one is standard, negotiated or separately priced. The page describes the company as HIPAA certified, and no HIPAA certification scheme exists, which is a phrase this index tracks because it signals compliance language assembled rather than checked. The site's terms and conditions link resolves to an empty anchor, and the privacy policy is a generic third party generated document rather than one addressing clinical data, so the legal instrument set a buyer can actually read is thin relative to the company's scale and customer base.

This is the standard middle rung on this axis: compliance asserted, instrument unpublished. Ask for the agreement text, and for the date and scope of the most recent HIPAA risk analysis, since the company evidently performs them.

Substantive and largely verifiable, with one serious defect on the same page.

What is real: SOC 2 Type II, with the trust services criteria named as security, confidentiality and availability, which is more scope than most vendors state. A trust centre exists at trust.radai.com, hosted on Vanta, though its contents render client side and could not be read here. The company states continuing twelve month third party audit cycles, real time control monitoring with more than 130 tests performed daily, service alerting, system logging and anomaly detection, and formal security and access policies available on request. A published cybersecurity role at the company describes managing the SOC 2 Type II audit cycle end to end and coordinating HIPAA risk analyses, which corroborates an operating compliance function rather than a single historical report.

The defect: under a heading stating that the company complies with these standards, the security page lists SOC 1 and ISAE 3402, SOC 3, DIACAP, PCI DSS Level 1, FISMA, FedRAMP and a run of ISO standards including 9001, 27017, 27018 and 28001. That is a cloud infrastructure provider's compliance programme list rather than this company's. DIACAP is a retired United States Department of Defense assurance process, and a radiology reporting company does not hold FedRAMP or FISMA authorisation. Presenting a supplier's certifications under a first person compliance heading is the strongest form of the inherited certification problem this index tracks. Separately the page describes the company as SOC 2 Type II and HIPAA certified, when SOC 2 is an attestation rather than a certification and HIPAA has no certification scheme at all.

Graded B on the strength of the genuine attestation, the trust centre and the monitoring detail. It does not reach A while the same page attributes a supplier's credentials to itself. Ask for the SOC 2 report and its scope, and disregard the standards list.

No clearance, De Novo or premarket authorisation was located for any product in the portfolio, and the company publishes no statement of its regulatory position. The products are documentation and workflow tools, which is ordinarily outside the device definition, but two features make the boundary worth examining rather than assuming.

The first is that the impression is the diagnostic conclusion of a radiology report. Software drafting that conclusion sits close to the line, and whether it stays outside turns on the clinical decision support criteria in the 21st Century Cures Act, which ask whether the clinician can independently review the basis of the output. Here the basis is the radiologist's own dictated findings, which is a reasonable argument for staying outside. The company does not make it.

The second is the company's own claim that in about 5 percent of reports the tool catches and helps fix clinically significant errors in the radiologist's dictation. Detecting clinically significant error is a stronger function than reformatting language, and a vendor advertising it should be able to explain why the feature sits outside the device framework.

One correction worth recording so it is not repeated: the FDA cleared NinesAI and NinesMeasure algorithms were acquired by Sirona Medical in 2022 and have no connection to this company. Graded C because a framework plainly reaches this territory, the company is silent on where it stands within it, and that silence is conspicuous in a lane where most peers hold clearance.

No subgroup analysis, no bias assessment, no fairness testing and no model card was located. Two mechanisms specific to this product make the absence worth stating plainly rather than noting in passing.

The first is personalisation. The product learns each radiologist's individual language preferences from their historical reports and reproduces them, and the output is the impression, which is the diagnostic conclusion of the report rather than a draft note. A model fitted to an individual's prior habits will reproduce that individual's systematic tendencies, including habitual omissions and hedges. Nothing describes how the system behaves when the historical pattern it has learned is itself the weakness.

The second is one directional measurement, a pattern this index tracks across categories. The company publishes that the tool catches clinically significant errors in the radiologist's dictation in about 5 percent of reports. Nothing measures the opposite error. There is no rate for how often a generated impression omits a finding present in the dictation, and none for the specific failure mode of the feature that pulls stable findings forward from prior reports, which is carrying forward something that has since changed. That failure is quiet by construction, because the text looks like a normal prior finding.

Ask for performance by modality, by body region and by case complexity, and ask for the miss rate alongside the catch rate.

The company states plainly that it uses its own generative models trained specifically for radiology rather than general purpose models, and that answers the question this index puts to every generative vendor about whether the product is a thin layer over somebody else's model.

It answers it in the direction that removes an external model provider from the data chain, which is worth crediting on both axes: a vendor that owns its models has fewer parties to disclose and more control over what the system does, and it also means the vendor cannot attribute a failure to a supplier. Held at C because none of the evaluation apparatus is published.

No architecture, no training data provenance beyond the assertion that the corpus is proprietary and large, no benchmark, no validation methodology and no error taxonomy, and no warranty, indemnity or remediation commitment. The headline figure, that the tool catches clinically significant errors in around one in twenty reports, carries no definition of what counts as clinically significant, no denominator and no independent verification, so a buyer cannot tell whether it describes a meaningful safety function or a broad class of minor corrections, and those two readings imply very different products.

A laterality error and a tense inconsistency would both be corrections. Ask for the definition and the denominator before treating that number as a safety claim, plus the false flag rate a radiologist has to dismiss.

Operates inside the systems radiologists already use, integrating with existing microphones, PACS, RIS, and EHR rather than presenting a parallel interface, and is distributed through vendor neutral marketplaces. Workflow native by design.

The hosting model is effectively stated but only as a sales point, and no residency commitment exists anywhere.

The company describes a lightweight client with single sign on that rolls out in minutes, states there are no servers or virtual machines to set up, and says that if the workstations have internet access the practice is ready to go. That is a plain statement that the product is cloud hosted with no on premise option and no local processing, delivered on a page about ease of deployment rather than as a data governance disclosure. A buyer gets the architecture from a convenience claim.

One point genuinely favours this vendor on the inference location question. The company states it runs its own generative models trained for radiology rather than calling a general purpose external provider, so there is no third party model vendor in the chain inheriting rights over report content. That is better than most generative products in this index and it is credited here.

What is missing is everything downstream. No cloud region, no residency commitment, no infrastructure provider named on any first party page, and no statement of where inference physically runs. Report text containing protected health information leaves the institution on every study, within seconds of dictation, and nothing published says where it goes or whether the customer has any choice in it. Ask for the region, the residency terms, and whether any customer controlled deployment exists at all.

No public pricing. Contact the vendor. Sold through practice and health system agreements with no published rate card.

Radiology specifically, and the scoping is clear at the level of function and buyer. Named products cover report generation, impression drafting and incidental finding follow up, sold to hospital radiology departments, physician owned practices and teleradiology groups. Named deployments include large multi site physician owned practices, and four health systems hold strategic investment positions in the company, which is itself a form of evidence about where the product is used.

Held off A because no subspecialty or modality scoping is published. Nothing states which modalities the models were trained and validated on, whether output quality is consistent across computed tomography, magnetic resonance, plain film, mammography and nuclear medicine, or whether particular body regions or subspecialties are better supported than others. That distinction matters more here than in most categories, because report structure and language vary sharply by modality and subspecialty, and a model learning from one distribution will be weaker in another without that being visible to the radiologist using it. Ask which modalities are in scope and what evidence supports each.