Corti

The models are the company. Corti is a research and development organisation building healthcare foundation models and selling them as infrastructure through SDKs and APIs, including three healthcare specialised foundation models it states were trained exclusively on medical data and a clinical grade Danish speech to text model. Every product it ships is downstream of model work rather than a workflow wrapper with a model inside it.

The finest grained oversight model in this category, and structurally distinct from the other two strong approaches here. Rather than asking a clinician to proofread a finished narrative, FactsR surfaces atomic clinical facts as the consultation unfolds and lets the clinician review, accept or adjust each one live, after each fact has already passed an automated validation loop.

Verifying a discrete extracted fact against what was just said is a materially easier and more reliable cognitive task than auditing a paragraph after the visit, which is where automation bias does its damage. This index now holds three distinct oversight architectures worth comparing directly: Abridge makes verification auditable through Linked Evidence, Speke makes it a human scribe's job, and Corti makes it atomic and concurrent.

The strongest transparency posture located in this category, on three separate grounds. Architecture is described mechanically rather than adjectivally: FactsR is set out as a four stage recursive loop with named behaviour at each stage, not as advanced reasoning. Models are shipped through documented API endpoints with distinct paths for structured transcription and real time streaming, so behaviour is inspectable by the developers integrating it.

Most importantly, Corti built its Danish clinical speech model in partnership with the Alexandra Institute through the CoRal initiative, contributing to open benchmarks and shared Danish speech data so performance is measured against public standards rather than internal ones. That is the direct inverse of the unfalsifiable vendor generated benchmarking this index flags elsewhere. One caveat holding the grade honest: the headline claim of a 65 percent reduction in note bloat is vendor generated with no published methodology or comparison set.

Good disclosure of who is involved, with the deployment architecture doing much of the work. Sovereign cloud and on premise options mean a health system can keep clinical audio inside its own infrastructure and jurisdiction, which does not answer the chain question so much as remove it, because a self hosted deployment cannot route encounter content to parties the customer has not chosen.

That is the strongest structural answer available on this axis and only a handful of vendors across this index and its sister offer it. Named collaboration adds to it: the Danish clinical speech work was built with the Alexandra Institute through a public initiative, so at least one external party in the development chain is identified along with what it contributed.

The models themselves are the company's own product rather than a wrapper, which shortens the chain genuinely rather than rhetorically. Held below the top grade because the hosted path is undocumented. No cloud provider is named for customers who do not self host, no sub processor list was located, and no base model lineage is given for the capabilities outside the Danish collaboration.

The training question also carries more weight here than for an application vendor, because model development is the business: whether customer audio contributes to the foundation models is unstated and should be settled in writing.

Graded on what was retrieved for the ambient documentation product specifically, and that is thin. The 65 percent note bloat figure is vendor generated with no methodology. The frequently cited statistics about clinician AI attitudes come from surveys Corti commissioned with YouGov, which is market research rather than clinical evidence and is self interested by construction.

The Alexandra Institute collaboration is real independent work but evaluates speech model accuracy, not clinical or operational outcomes. This is likely the most understated axis in the record: Corti has a research heritage in emergency call triage with a peer reviewed literature behind it, none of which was retrieved in this pass. Priority refresh candidate.

Strong on data control, unevidenced on data lifecycle. The sovereign cloud and on premise options mean a health system can keep clinical audio inside its own infrastructure and jurisdiction, which is the most substantive PHI protection available in this category because it removes the question rather than answering it.

What was not located is the rest: retention periods for audio and transcripts, de identification practice, and an explicit statement on whether customer data is used to train Corti's foundation models, which matters more for a company whose business is model development than for an application vendor.

The frame does differ from the United States vendors in this category, and the earlier assessment was right about that. This company is European first and its compliance argument is built around the European AI regulation, the medical devices regulation and data sovereignty rather than around the United States health privacy rule.

What has changed is that the axis can no longer be treated as simply out of scope. The company states alignment with the EU US Data Privacy Framework and its Swiss and United Kingdom extensions, which is a mechanism for lawful transatlantic transfers and only matters where United States data flows exist. It publishes a maintained subprocessor list. It markets to United States buyers alongside European ones. A company doing all three is operating in United States territory in some form, and wherever a covered entity's protected health information is processed the business associate relationship arises regardless of where the vendor is domiciled.

Nothing located states a business associate agreement position, offers a template, or scopes which processing activities would fall under one. That is the gap, and it is an absence of the contracting position rather than an absence of sophistication.

Two cautions for a United States buyer. The European posture is strong and it does not transfer, because the AI regulation, the medical devices regulation and the data protection regulation address different questions from the health privacy rule, and satisfying one says nothing about the other. And this company sells infrastructure that partners build products on, so establish which entity in the chain would actually sign, since the party holding the relationship with the covered entity may be the partner rather than Corti.

The earlier assessment recorded no attestation located. That is comprehensively overturned, and this is now the strongest security posture in the ambient scribe category.

Held and dated: ISO/IEC 27001 certification of the information security management system, achieved August 2025. SOC 2 Type II, renewed June 2025. BSI C5 Type II, the German cloud computing compliance criteria catalogue attestation, passed June 2025. Alongside those, UK Cyber Essentials and the UK Data Security and Protection Toolkit, with stated alignment to NIS2 and DORA.

Two things lift this above a long list of logos. The company publishes and maintains a subprocessor list, refreshed July 2025. That is the document which actually tells a buyer where data goes, and almost nobody else in this lane publishes one at all. And it states alignment with the EU US Data Privacy Framework including the Swiss and United Kingdom extensions, addressing the transatlantic transfer question directly rather than leaving it implied.

Two qualifications belong with the grade. ISO/IEC 27017 and 27018 are described as compliance the company would reach in a future quarter rather than as held certifications, and in process is not certified. And every date here falls in 2025, so a buyer should confirm current standing rather than assume renewal, since attestations of this kind carry defined periods.

Measured against this index's benchmark for the axis, meaning a vendor holding several independent examinations across security and quality standards, this record meets it. For a supplier assessment the remaining work is verifying currency rather than discovering evidence.

The earlier assessment recorded this vendor's regulatory argument without its regulatory status. Both now exist, and the status is substantive.

Corti Assistant MD has been registered with the United Kingdom medicines and healthcare regulator as a Class I medical device since July 2025, and the company reports registering the same product as a Class I device in the European Union under the medical devices regulation. It describes operating ISO 13485 workflows and beginning external certification of its quality management system.

Read the class accurately, as this index does elsewhere. Class I is the lowest risk classification and conformity at that level is declared by the manufacturer rather than assessed by a notified body, so this is a registered declaration rather than a regulator's review of the software. It nonetheless carries real obligations on clinical evaluation, post market surveillance and change control that United States only peers in this category do not, and it is more than almost anyone else in this lane holds.

The point a buyer most needs concerns what the registration covers. This company sells an application programming interface that other companies build products on, and the registration attaches to one named product. The company states plainly that the registration creates no obligations for partners and resellers building on the interface, while also inviting those partners to point to an EU registered medical device powered by the same platform. Both statements can be true, and the distinction matters enormously to anyone buying from a partner rather than from Corti directly. A registration held by an infrastructure supplier does not transfer to the product built on top of it. Establish which entity holds the registration for the product actually being purchased.

The earlier observation stands: this company treats regulatory rigour as a commercial wedge rather than a hurdle. That remains a commercial argument, but it is now backed by a regulatory position rather than only asserted.

Addresses the category's central failure mode by engineering rather than by disclaimer, which is unusual enough to credit even though it is not a governance disclosure in the conventional sense. Where other vendors either ignore accent and dialect degradation or name it in a limitations document, Corti builds language specific clinical models and states that its Danish model handles background noise, overlapping dialogue, regional accents, compound terminology and mixed language usage, developed with an independent research institute explicitly so that measured performance reflects real clinical language rather than clean test audio. Held at B rather than A because no fairness statement, subgroup analysis or published performance breakdown across speaker populations was located, so the work is asserted rather than shown.

The route into this band is participation in a public benchmark, and it is the strongest falsifiability signal located in this lane. Corti built its Danish clinical speech capability with the Alexandra Institute through the CoRal initiative, contributing to open benchmarks and shared speech data, which means performance on that work is measurable by outsiders against a public standard rather than only by the company against its own.

Everywhere else in this index a vendor performance claim can be neither reproduced nor contested; here at least part of the record can be. That is what a commitment looks like when it is real, and it should be the model other vendors are asked to follow.

Architecture supports it, being described mechanically as a named multi stage loop with stated behaviour at each stage rather than as advanced reasoning, and the capability ships through documented interfaces so the developers integrating it can inspect behaviour directly. Held below the top grade for two reasons.

No indemnity, warranty or remediation commitment toward customers was located, and the headline claim of a 65 percent reduction in note bloat is vendor generated with no methodology or comparison set published, so the falsifiability is partial rather than general.

The accountability structure is also layered in a way worth stating plainly: this is sold to developers who build products on it, so the counterparty is an application vendor rather than a health system, and the patient sits three removes from the company whose model produced the text. Ask which claims are benchmarked publicly and which are internal.

Read this grade as a scoping fact rather than a deficiency. Corti deliberately sits one layer below the EHR question: it ships models and reasoning through SDKs and APIs and the integration into a record system is performed by the vendor or health system building on it, with partners such as Voicepoint in Switzerland delivering the finished documentation product.

A health system evaluating Corti against a turnkey scribe is not comparing like with like, because the integration work that Abridge or Suki performs is here the buyer's or integrator's responsibility. No named EHR integrations were verified in this pass.

The clearest A on this axis anywhere in the ambient category, where almost every competitor is Not Rated. In July 2025 Corti launched what it describes as Europe's first sovereign healthcare AI cloud, designed to run on any cloud or on premise and to remain portable off any single vendor, with the explicit purpose of letting clinical AI run without residing in a United States anchored hyperscaler.

This is the ambient documentation instance of the question this index tracks across categories, which is where the sensitive asset physically goes. Cardiac imaging splits on where the scan goes and drug discovery on where the chemistry goes; here the asset is recorded patient conversation, and Corti is the only vendor assessed so far that lets the buyer decide.

No published rate card. Sold as infrastructure through SDK and API relationships and through partners rather than as a per provider subscription, so no comparable per clinician figure exists.

Broad by setting rather than enumerated by specialty. Documented across emergency dispatch, primary care and telehealth, a spread that reflects the company's origin in emergency call triage and is unusual in a category dominated by outpatient office visits. Language coverage is deliberately deep rather than wide, with dedicated clinical grade models per language beginning with Danish, which is the opposite of the many languages one model approach competitors advertise. No specialty count published.