Sorcero

Reading and synthesizing across a reported 263 million publications and 1.3 billion citations plus congress sessions, safety cases, and medical inquiries is a task with no manual equivalent; the platform exists because the volume defeats human review. Natural language processing tuned to medical literature is the product rather than a feature on a workflow tool.

A described oversight design with a defined human checkpoint, held below the top of the axis by the shape of the failure it has to catch.

The company states that teams review, validate and refine generated insights before escalating them, which places a person between the model and the decision rather than after it. It states complete traceability and audit trails for every decision, and clear visibility into every flagged signal. Every insight carries a citation back to its source so a reviewer can check the basis rather than the conclusion. A customer quote in the company's own materials describes the working pattern honestly: an answer in two minutes, then thirty minutes checking the references. That is what verified use actually looks like and it is to the company's credit that it is published.

Two things keep this at B. The oversight described is oversight of what the system surfaces. In safety surveillance the error that matters is what it does not surface, and no reviewer can audit an absence by reading a worklist. Nothing states what sampling, back testing or independent review exists to detect misses.

The second is the grading layer. Hallucination grading agents check output produced by the same agentic framework. That is a useful internal control and it is not independent verification, because a shared architecture and a shared grounding corpus can share a blind spot. This index has recorded the same structure elsewhere in this category, where a system both writes and tests its own work.

Ask what proportion of output is independently reviewed, how misses are surfaced, and whether the grading agents are evaluated against human adjudication.

More specific than most platform vendors in this lane, and short of what a regulated buyer would need.

What is named: a retrieval augmented generation architecture, grounding in biomedical ontologies, an agentic framework with differentiated agent types including hallucination grading and role aware prompt agents, and citation of every insight to its source. The safety product's content foundation is named as a major scientific publisher's corpus, developed with that publisher's pharmacovigilance expertise, which is a real provenance statement rather than a claim to proprietary data. Six foundational patents are reported. Naming the retrieval architecture matters here, because it tells a buyer that answers are grounded in retrieved documents rather than generated from parametric memory, which is the difference that makes citation meaningful.

What is not named: the underlying models, whether they are the company's own or licensed, where they run, how they were adapted, how versions are managed, or what evaluation exists for any component. For a platform describing itself as validated under good practice frameworks, the version question is not incidental, since a change to an underlying model is a change to a system a customer may be relying on for a regulated activity.

The reported figures are efficiency: insights many times faster, a large proportion of analysis time saved. Both are plausible and neither speaks to correctness.

Ask which models underlie each capability, whether any are third party, how model changes are notified within a validated environment, and what evaluation exists for the retrieval step as distinct from the generation step.

The content foundation is named and the model layer is not. On the corpus, the safety product's content is stated to be a major scientific publisher's own corpus, developed with that publisher's pharmacovigilance expertise, which is a real provenance statement rather than a claim to proprietary data, and it lets a buyer identify what the answers are drawn from and judge its coverage independently.

For a product whose value rests on retrieval, naming the retrieved corpus is the substantive half of this axis, and grounding in named biomedical ontologies extends the same disclosure. On the model layer there is nothing: no model named, no statement of whether models are the company's own or licensed, no hosting arrangement, no sub processor list, and no version management practice.

That last omission is not incidental for a platform describing itself as validated under good practice frameworks, because a change to an underlying model is a change to a system a customer may be relying on for a regulated activity, and a customer who validated a configuration cannot tell whether they are still running it. The operative material is public literature rather than patient data, which lowers the stakes on this axis relative to the clinical vendors graded alongside. Ask which models underlie each capability, whether any are third party or externally hosted, and how model changes are notified within a validated environment.

Adoption is credible and consistently reported at a third to 40 percent of the top 30 global pharmaceutical companies, with workshop participation from Amgen, Biogen, Lundbeck, and argenx. Third party positioning is stronger than most: CB Insights names the company a Leader in AI enabled pharmacovigilance software alongside IQVIA, Veeva, and Oracle, which is notable for a company of this size, and it holds a 2025 Google Cloud Partner of the Year award. Held back from A because headline efficiency figures, 18x faster insights and 70 percent time saved, are vendor and customer stated without published methodology or baseline.

The company names hallucination prevention as an explicit platform property alongside validated outputs and regulatory safeguards, and describes an agentic architecture in which specialized agents validate medical information rather than a single model generating answers. That is the correct concern to foreground: in medical affairs and pharmacovigilance a fabricated citation or missed adverse event signal has regulatory consequence.

A customer quote in the company's own materials is telling about how this is used in practice, describing getting an answer in two minutes and then spending thirty minutes checking the references. Held back from A because no measured hallucination or accuracy rate was published, and the operative work here is public literature rather than patient data.

A scoping determination and it closes, with one adjacent obligation that a buyer should not overlook because this axis reads as clear.

The customers are pharmaceutical and medical device organisations. The material processed is public literature and citation data, congress content, internal customer relationship records, medical inquiry logs and safety case records. None of it reaches the platform from a provider on whose behalf the company is acting, so the company is not a business associate and the United States health privacy rule is not the operative framework. Grading the absence of a business associate agreement as a gap would misdescribe the relationship.

What governs instead is named clearly by the company itself: good pharmacovigilance practice for the safety work, with the customer's own reporting obligations sitting above it, and European data protection law where relevant.

The adjacent obligation concerns physicians rather than patients. A core capability identifies which key opinion leaders and clinicians are active in particular research areas or treating particular populations, and builds a picture of individual clinicians from publications, congress activity and interaction records. Those clinicians are identifiable living individuals, and in Europe and the United Kingdom that processing is squarely personal data processing, engaging a lawful basis, transparency obligations toward the individuals profiled, and rights of access and objection. Clinicians are rarely told that such profiles exist.

Ask what lawful basis supports clinician profiling in each jurisdiction, whether transparency information reaches the individuals concerned, and how an access or objection request would be handled.

No SOC 2, ISO 27001, HITRUST or equivalent attestation was located and there is no trust centre.

Two architectural statements are made and both are real. The company states that customers have complete ownership of their data with access controls and a dedicated tenant, and it describes audit ready security. Dedicated tenancy is a concrete isolation claim rather than a general assurance, and it is the right answer for a platform serving many pharmaceutical organisations that compete with one another.

The contrast within the company's own materials is what makes the grade. On regulation it is precise, naming good practice and good pharmacovigilance practice, the United States electronic records rule, European data protection law and the in vitro diagnostic regulation. On security it says the platform supports numerous security, compliance and privacy frameworks, and names none of them. A company demonstrably capable of naming five regulatory instruments in one sentence has made a choice when it declines to name a single security framework in the next.

That gap is worth closing before contracting, because the platform ingests internal customer material alongside public literature: customer relationship records, medical inquiry logs and safety case data, all of which are commercially sensitive and some of which concerns identifiable individuals.

Ask which frameworks the platform has actually been examined against and by whom, whether an attestation exists and what it covers, whether the dedicated tenant extends to the agentic components and the retrieval index, and what access company staff hold to customer tenants.

No device pathway applies to the platform itself. The framework that does apply is named specifically, which places this above most of the category and short of the two vendors that publish the underlying artefacts.

The safety product is described as a validated platform under good practice and good pharmacovigilance practice, compliant with the United States electronic records rule and European data protection law, with complete traceability and audit trails stated for every decision. The regimes it addresses are named rather than gestured at: pharmacovigilance, medical device vigilance, and the European in vitro diagnostic regulation, with monitoring positioned against both the United States and European regulators. For a product whose function is detecting literature likely to trigger an individual case safety report, naming the specific instruments is the right disclosure, because the customer's own reporting obligations are what the tool exists to serve.

What separates this from the top of the axis is that the claims are assertions rather than artefacts. No validation summary report, qualification documentation, or scope statement was located. That last omission matters most: the validation claim attaches to the safety product, and nothing states whether it extends to the wider intelligence platform, the medical affairs modules, or the agentic framework added later. A customer using the platform for medical affairs should not assume it inherits the safety product's validated state.

Ask for the validation package and its scope, which modules and which release it covers, and how the agentic components are qualified given that they were added after the original validation.

The mitigation architecture is described and it is the right one. Every performance claim about it is unquantified, while the figure cited for the alternative is precise.

What is described: retrieval augmented generation, grounding in biomedical ontologies, rigorous testing and proprietary validation processes, source citations linking each insight back to the original, and an agentic framework including dedicated hallucination grading agents. That is a coherent and appropriate design for the problem, and citation to source is the single most useful property a system like this can have.

What is claimed about its performance: near zero hallucinations, human level accuracy, industry leading accuracy. None carries a number, a denominator or a method. In the same materials the company cites a specific figure for how often generic systems hallucinate. Quantifying the alternative's failure rate precisely while describing your own only in adjectives is a construction this index has now recorded twice in one review period, and it is worth naming as a pattern rather than treating as ordinary marketing.

One omission is more consequential than the rest and is specific to the safety use case. The company describes precision in detecting literature likely to trigger a case report. Precision concerns false alarms. The regulated quantity here is recall, because an article that should have triggered a report and was not flagged becomes a missed reporting obligation, and a missed obligation is a compliance failure rather than an inconvenience. A missed article also leaves no trace, unlike a false alarm, which a reviewer discards.

Ask for the recall figure on case report detection, the method and reference set behind it, and how residual misses are detected.

The mechanisms are the right ones and the company's own materials contain the most honest assessment of what they achieve. Naming the retrieval architecture matters because it tells a buyer answers are grounded in retrieved documents rather than generated from parametric memory, which is the difference that makes a citation meaningful rather than decorative.

Grounding in biomedical ontologies, an agentic design with differentiated agent types including hallucination grading, and citation of every insight to its source are all real controls, and foregrounding hallucination as the concern is correct for this domain, since in medical affairs and pharmacovigilance a fabricated citation or a missed safety signal has regulatory consequence rather than merely embarrassing someone.

What holds this at C is that nothing measures any of it, and the customer quote the company publishes is more informative than the efficiency figures beside it: getting an answer in two minutes and then spending thirty minutes checking the references. Taken at face value that describes a tool whose time saving is largely consumed by the verification it necessitates, which is exactly what a published hallucination rate would let a buyer evaluate instead of guess.

No measured hallucination or accuracy rate, no evaluation methodology and no warranty, indemnity or remediation commitment was located. Ask for the measured hallucination rate, the citation accuracy rate, and how much verification the vendor expects a reviewer to perform.

Not an EHR integration story, correctly, since the buyer is a pharmaceutical organization. Integration breadth is instead across life sciences data sources: public literature and citation databases, congress and abstract data, internal CRM systems, safety case records, and medical inquiry logs, with the Axiom acquisition adding medical device real world data. Combining public evidence with internal interaction data is the substantive capability. Held back from A because named source systems and integration methods were not retrieved.

One isolation statement, no residency position.

The company states that customers hold their data in a dedicated tenant with access controls and full data privacy. Dedicated tenancy is the substantive claim on this axis and it addresses the question that matters most for a platform whose customers compete with one another: whether one pharmaceutical organisation's medical inquiry logs, customer relationship records and safety cases can be reached from another's environment.

Everything else is absent. No hosting region, no residency option, no retention period, no subprocessor list, and no statement of where the retrieval index or the agentic components run relative to the tenant. The company is a named cloud platform partner and holds a partner award from that provider, which indicates the infrastructure without stating the geography.

Residency is not academic here. The company asserts compliance with European data protection law, serves global pharmaceutical organisations, and processes both safety case data and identifiable clinician information across jurisdictions. An assertion of compliance without a stated transfer mechanism or processing location leaves the buyer to establish both.

Ask where the tenant is hosted and whether region can be elected, what transfer mechanism supports European processing, whether the dedicated tenant boundary includes the retrieval index and model inference or only stored data, and for the subprocessor register.

No public pricing. Contact the vendor. Enterprise agreements with life sciences organizations. The company states it pairs the platform with high touch services including Insights Leads and Deployment Strategists, so this is a SaaS plus services engagement rather than pure licence, and buyers should establish the split since the services component typically drives adoption but also cost.

Bounded to the medical side of life sciences: medical affairs, scientific communications, publications, and pharmacovigilance, extended to medical device organizations through the Axiom Health acquisition. That scoping is what keeps it in this index, since medical affairs is a scientific exchange function subject to its own regulatory separation from commercial promotion. Buyers should note the platform also serves commercial teams, and that boundary is worth confirming in deployment.