Medable

The agent platform is now a product line of its own, built on a trial platform whose value stands without it. The company sells named agents (a Clinical Monitoring or CRA Agent, a TMF Agent that classifies trial master file documents, a Digital Data Flow Agent that turns protocols into structured data, and a PI Summary and Review Agent for site oversight of outcome data) and Agent Studio for building more, alongside AI features in Studio that generate electronic outcome instruments, translations and test evidence. Those capabilities do not exist without the models. The electronic outcome assessment, consent, televisit and participant apps that carry most of the company's reported scale work without them.

The oversight structure is described; which actions each agent takes on its own is left to configuration. Agent Studio lets a sponsor run agents autonomously or with a person approving, and the company's line is autonomous where it can be and human-led where it must be.

Recommendations pass verification workflows and data quality checks before users see them, the 2026 governance white paper describes customer-set warning and critical thresholds with human approval records, and a company blog lists work that stays with people: regulatory filings, data lock, and deciding which data issues are clinically meaningful.

The CRA Agent is described as taking on up to 90 percent of monitoring administration, including sending site emails and reminders and updating systems. No default limits per agent are published, nor what stops an agent acting when its scores fall.

The model hosts and the versioning discipline are published; the models are not. The sub-processor list names Google Cloud for AI models, Groq for open weight models and Microsoft Foundry for cloud AI models. The company says it selects and fine-tunes models purpose built for life sciences, and its 2026 governance white paper describes an immutable version history for every agent component, rollback, and scheduled evaluation that catches changes pushed by upstream model providers. Which models run which agent, and what data fine-tuned them, is not stated.

A public sub-processor list names the model layer; the terms that govern data there are not published. The list (30 Mar 2026) names 13 parties with their service, purpose and processing location, including three AI hosts (Google Cloud for AI models, Groq for open weight models, Microsoft Foundry), cloud hosts (Amazon Web Services, Google Cloud, Alibaba Cloud for China), MongoDB, Box, Twilio, Tencent for messaging in China, Salesforce and HCL for help desk, OneTrust and TransPerfect. The company reserves the right to change it at its discretion. Retention and training terms at the AI hosts, and which host serves which agent, are not stated.

Named deployments with figures for the trial platform, and modeled economics for one agent. Case studies report more than 85 percent electronic consent in an ICON menopause study, with 18 sites at full adoption; 75 percent electronic consent among elderly patients in a US renal care trial; 99 percent outcome assessment adherence in Japan; and a 43 percent cut in translation timelines with Lionbridge.

For the agents, a Tufts Center for the Study of Drug Development analysis announced in August 2026 applied an expected net present value model to time savings and costs Medable supplied for its Clinical Monitoring Agent in an oncology program, estimating up to $21 million per program and 82 times return; a peer reviewed paper is promised. No agent's accuracy or effect in a running trial is published. Scale figures (hundreds of trials in more than 70 countries) describe use, not benefit.

Retention is stated for participant app data; what reaches the models is not. The Medable App privacy information (19 May 2026) says the company stores app data for the sponsor, by default for 25 years under its standard operating procedures, encrypted in transit and at rest, and handles deletion or correction only at the sponsor's direction.

The sub-processor list (30 Mar 2026) sends personal data to three AI hosts: Google Cloud for AI models, Groq for open weight models and Microsoft Foundry. The company says it selects and fine-tunes models on high-quality, relevant data but does not say whether participant or sponsor data is used, what the model hosts retain, or whether data from one sponsor's agents reaches another's. Its own buying guide tells sponsors to ask whether customer data trains foundation models.

Agents can also use Google Search and a URL fetcher, so outside web content enters their context. Nothing is published on safety engineering: guardrails, hallucination handling or how a safety event is handled, beyond the performance monitoring described for agents.

A service privacy document and a processor role are published; business associate status is not. The Medable App privacy information (19 May 2026) and the privacy center say the company acts as a data processor for its customers, storing, sharing and deleting participant data at the sponsor's direction, and a pre-signed data processing addendum is available for GDPR transfers. The FAQ says products are designed to conform to HIPAA. No statement says whether the company signs business associate agreements, for which customers, or on what terms. Which of those roles applies in a given configuration is not set out.

Controls are asserted with nothing independent behind them. The app privacy information says data is encrypted in transit and at rest, and the site names no SOC 2 report, ISO/IEC 27001 certification, HITRUST certification or penetration test, and has no trust center. France's data protection authority reviewed security material when it approved the company as a processor, which is a data protection authorization rather than a security audit.

The company's own guide to choosing AI trial vendors recommends SOC 2 Type II, ISO 27001, HITRUST and independent penetration testing as vendor credentials. The platform holds outcome, consent and televisit data for participants in more than 70 countries, often on their own phones.

No device claim is made, and the products are scoped as trial operations. The FAQ says the products are designed to conform to 21 CFR Part 11, HIPAA and GDPR; the TMF Agent page says it is designed to comply with all global regulations, including Part 11, ICH E6 (R2) and GDPR. Outcome data and the trial master file feed submissions and inspections, so electronic records rules apply.

Studio auto-generates validation evidence packages for configuration changes, and the governance white paper describes versioned agents with exportable records for a quality system. No validation summary or qualification package is published.

A named process for governing agent behavior is published; no evaluation across groups or languages is. The company's 2026 white paper on continuous governance describes scheduled evaluation runs (ad hoc, hourly or daily) that score each agent on response accuracy, behavioral consistency, grounding and safety, warning and critical thresholds the customer sets per dimension, human review of results, and exportable performance history and approval records for a sponsor's quality system.

That is material a customer's own review team can use. Nothing is published on how agents or the AI features perform across the populations and languages the platform serves, and the translation question stands: the platform runs in more than 120 locales, AI speeds translation (the company cites a 43 percent cut in timelines in a case study with Lionbridge), and an outcome instrument whose translated items shift in meaning yields data that is no longer comparable across language groups. The company routes translation through RWS and Lionbridge; how linguistic validation is kept when the first draft is machine generated is not described.

Errors can be traced and rolled back; nothing stands behind the output. The company says every automated action is logged, explainable and auditable, and its 2026 governance white paper describes an immutable version history for each agent component, rollback to a prior version, alerts when scored performance falls below a threshold, and a documented record of detection, root cause, remediation and requalification. The TMF Agent's filings also land in the target system's own audit trail.

No error rate is published for any agent or AI feature: the white paper's drop from 94 to 71 percent accuracy is an illustration, and the published figures (60 percent time saved per TMF document, 90 percent faster instrument builds) measure speed. No warranty, indemnity or remediation commitment is published.

No clinical record integration; the trial systems it connects to are named. This is sponsor side trial software, so the systems that matter are the ones its buyers run. The company names connections to Veeva EDC, CTMS and eTMF, Medidata Rave, Oracle InForm, Oracle IRT, Oracle Argus for safety and Citeline, plus DocuSign, RWS, Box, Microsoft 365, Slack, Salesforce and databases, reached through connectors and Model Context Protocol servers so agents can read and act across them. No interface documentation, marketplace listing or production reference for a specific connection is published.

Hosting regions are published; which one a study uses, and where model calls go, is not. The sub-processor list (30 Mar 2026) gives processing locations: Amazon Web Services in Frankfurt and Virginia, Google Cloud in Frankfurt and Oregon, Alibaba Cloud in Beijing for China hosting, and MongoDB in Germany and the United States. AI inference runs through Google Cloud, Groq (Texas and Helsinki) and Microsoft Foundry (Virginia and Sweden).

France's data protection authority approved Medable as a processor for a French sponsor. The privacy statement relies on data processing agreements and standard contractual clauses for transfers. Tenant isolation and whether a study's model calls stay in its hosting region are not stated.

No price is published, and what drives it is. The FAQ says pricing depends on the scope and complexity of the study, the capabilities used, its locations and the number of studies on the platform, and the pricing page asks for a demo. Enterprise agreements are with sponsors and contract research organizations, and the platform can be bought through Google Cloud Marketplace, where usage can count against a customer's committed Google Cloud spend.

Coverage is named and validated for part of it. The platform serves sponsor-side clinical development in decentralized, hybrid and site-based trials, with solutions for oncology, vaccines and cardiometabolic studies, in more than 70 countries and 120 locales; no clinical care use is claimed. Case studies support the outcome assessment and consent products in vaccine, renal, women's health and Japanese studies. The agents have been modeled in one oncology program and have no published results elsewhere.