Corti

The models are the product. Corti builds its own healthcare models for speech recognition, note generation and medical coding and sells them through APIs, SDKs and an agent framework, with its Symphony system and FactsR reasoning engine on top and Corti Assistant as its own application. Every product it ships sits downstream of that model work.

FactsR moves review into the visit. Rather than leaving a clinician to proofread a finished narrative, it extracts discrete clinical facts such as symptoms, vitals, medications and social history as the consultation unfolds, runs each through an automated validation loop, and lets the clinician accept or adjust each fact live. Checking one fact against what was just said is a smaller and more reliable task than auditing a paragraph after the visit.

The terms make the human step explicit. Corti's master terms say output is probabilistic and may be inaccurate, that human validation is required, and that the customer must evaluate all output before relying on it. Beta services are excluded from any workflow where failure or inaccuracy could cause harm.

What produces the output is described in some detail. Corti's data processing agreement sets out the pipeline: a speech recognition model fine tuned on consultation audio without patient or consultation metadata, a separate coding model that takes both audio and transcript and is periodically fine tuned on user corrections, and a proprietary large language model that turns the transcript into a note against a template. FactsR is described as a four stage loop with defined behavior at each stage, and the models ship through documented endpoints for structured transcription and real time streaming.

Results are published against outside standards. The Danish clinical speech model was built with the Alexandra Institute through the CoRal initiative against open benchmarks, Corti publishes research on its speech and coding systems at venues including EMNLP and INTERSPEECH, and its benchmarks page reports results on clinical reasoning, coding and speech accuracy, including a 60.5 percent overall score on an open benchmark OpenAI built from real physician interactions.

Subprocessors are published region by region, last updated 7 August 2026. In the EU, Microsoft Azure hosts the service in the Netherlands, Ireland and Sweden, Scaleway runs AI processing in France, the Netherlands, Germany and Sweden without hosting or storing customer data, and DCAI in Denmark provides inference, training and GPU capacity. In the US, Azure hosts a US instance. Speechmatics, in Ireland, supplies supplementary speech recognition for limited language support and for validating Corti's own models, Datadog processes usage telemetry, and Corti's US and UK entities provide support with access to non sensitive data only. The Embedded Assistant adds PostHog, Mixpanel and Intercom for analytics and support.

The models are Corti's own, and the terms say what happens to data once it arrives: customer data is not used to train or improve models offered to other customers unless the customer opts in through a separate addendum, and personal data is deleted 30 days after the contract ends.

Published research and an outside review stand behind the platform. Corti's papers on speech recognition and medical coding have appeared at EMNLP and INTERSPEECH and on arXiv, including a medical coding model trained on clinical narratives from a population wide cohort of 1.8 million patients and a replicability study of automated coding on MIMIC-III and MIMIC-IV, and its benchmarks page publishes results on clinical reasoning, coding and speech accuracy. KLAS published a First Look report in April 2026 scoring Corti 93.3 from interviews with six healthcare companies building on it.

What is missing is outcome evidence for documentation in care. No study of the ambient product's effect on clinician time, note quality or patients is published, and the vendor's figure of a 65 percent reduction in note bloat comes without a method.

Retention, training use and de identification are each stated. Corti's data processing agreement keeps personal data for the life of the contract and deletes it 30 days after termination. The master terms commit Corti not to use customer data to train or improve models offered to other customers unless the customer opts in through a separate model training addendum, which sets out roles, retention, safeguards and a ban on re identification; anonymized usage data such as logs and telemetry may be used to improve the platform. Data can be hosted in the EU or the US with no cross border transfer, with encryption keys held per customer.

The processing agreement also describes training inside the product: the speech model is fine tuned on consultation audio without patient metadata, and the coding model is fine tuned on user corrections.

Safety engineering on the model is described only in outline, as bias detection evaluations, explainability and clinical safety checks, without published detail. Corti runs an anonymous AI concern form for employees, partners and users to report problems or harms, reviewed confidentially by its staff.

HIPAA practices are claimed without the contract behind them. Corti's safety page offers airtight HIPAA practices alongside GDPR controls, and a 2025 update cites adherence to HIPAA standards, but no business associate agreement, template or statement of business associate status is published, and neither the master terms nor the data processing agreement mentions one.

The US footprint makes the question live. Corti runs a US hosting instance on Microsoft Azure, has a US subsidiary providing support, is self certified under the EU US Data Privacy Framework, and markets to US buyers. Because it sells infrastructure that partners build on, the company that would sign an agreement with a covered entity may be the partner rather than Corti, and nothing published sets out which.

Certifications are named with dates. Corti's latest ISO audit cycle, completed on 16 June 2026 with no nonconformities, renewed ISO/IEC 27001 and added ISO/IEC 27017 for cloud controls and ISO/IEC 27018 for personal data in the cloud, and ISO/IEC 42001 for AI management came in March 2026. Corti also holds SOC 2 Type II and the German BSI C5 Type II cloud attestation, both reported in June 2025, plus UK Cyber Essentials and the NHS Data Security and Protection Toolkit, and it is self certified under the EU US Data Privacy Framework with its Swiss and UK extensions.

The trust center runs on Drata with continuous compliance monitoring. The controls described include FIPS compliant encryption, per customer keys, role based access through Azure AD with full audit logging, regular vulnerability scans and penetration tests, and an incident response plan with root cause documentation. Whether the SOC 2 and C5 reports have been renewed since June 2025 is not shown publicly.

A Class I medical device registration covers Corti Assistant MD, with the UK MHRA since July 2025 and in the EU under the medical devices regulation since September 2025. Class I conformity is declared by the manufacturer rather than reviewed by a notified body, but it carries obligations on clinical evaluation, post market surveillance and change control, and both registrations can be checked in public registers. Corti describes external certification of its ISO 13485 quality management system as under way, and it offers partners technical documentation and version control to support their own device and AI compliance.

The position is clear for a customer buying Corti Assistant MD and blurred for one buying a partner product. Corti states that the registration creates no obligations for partners and resellers, while the same announcement invites partners to point to an EU registered medical device powered by the same platform and says the safety and performance of products built on its API are guaranteed. A registration attaches to one named product and does not carry over to what others build on the API, and nothing published says whether a given partner product is registered, or by whom.

An ISO/IEC 42001 certification of Corti's AI management system, awarded in March 2026, sits behind its governance, and the company says it runs bias detection evaluations, explainability checks and clinical safety checks, follows good machine learning practice for training and validation, and keeps an anonymous form for reporting AI concerns.

Its answer to accent and dialect is engineering rather than disclosure. Corti builds language specific clinical models, starting with a Danish model built with the Alexandra Institute that it says handles background noise, overlapping speech, regional accents and mixed language use, and NHS Grampian nurses have helped its system learn the Doric dialect of northeast Scotland. No subgroup results or performance by speaker population are published.

Part of Corti's performance can be checked by outsiders. The Danish speech work was built with the Alexandra Institute through the CoRal initiative against open benchmarks and shared speech data, and Corti publishes benchmark results and research papers on its speech and coding systems, so its claims can be tested against public standards rather than only its own tests.

The contract is narrower. The master terms say Corti does not warrant that output is error free or fit for use without professional oversight and require human validation, and Corti indemnifies customers against third party intellectual property claims, while a 2025 announcement describes the safety and performance of products built on its API as guaranteed. The figure of a 65 percent reduction in note bloat has no published method. Accountability is layered: most deployments reach clinicians through a partner's product, so a health system asking what happens when a note is wrong is asking its application vendor, which is asking Corti.

The product sits one layer below the record system. It ships models and reasoning through APIs and SDKs, and the integration into an EHR is built by the vendor or health system using it: Dedalus built ORBIS Speech Assistant on Corti for its record system in Germany, Voicepoint delivers a documentation product in Switzerland, and Corti's Embedded Assistant places its application inside a partner's interface. The API streams audio, extracts facts and generates structured notes for a partner to write into its EHR.

No integration that Corti itself operates with a named record system such as Epic or Oracle Health is published, so a health system comparing Corti with a turnkey scribe is comparing infrastructure with a finished product.

Deployment choices are documented down to the region. Data can be hosted in the EU or the US with no cross border transfer, the subprocessor lists name the Azure regions and EU AI processing providers behind each instance, and Corti publishes separate lists for its French, Danish and EU sovereign instances.

Its sovereign healthcare AI cloud, launched in July 2025, is built to run on any cloud or on premise and to move off any single vendor, so recorded consultations can stay inside a health system's own infrastructure and jurisdiction. Encryption keys are held per customer.

Pricing is published and usage based. Corti gives new accounts $50 of free credits and then charges pay as you go, with speech to text at $0.0065 a minute and note generation, medical coding and agents at $4 per million input tokens and $16 per million output tokens, all drawn from one credit wallet. An Acceleration Pack adds 1,000 credits and five hours of developer support for $1,000 a month, Corti Advance offers embedded engineering on a rolling monthly commitment with no minimum term, and enterprise deployments with sovereign cloud, custom models and priority throughput are quoted.

What a finished partner product costs a health system depends on the partner, since many clinicians reach Corti through someone else's application.

The settings follow the company's history. Corti started in emergency call triage and now documents primary care, telehealth and hospital ward care, with NHS Grampian using it on a ward at Inverurie Hospital and other NHS trusts working with it elsewhere in the UK. Language coverage is built model by model, with clinical speech models for Danish and French among them, rather than claimed across a long list. No specialty list is published.