Corti on Why Healthcare AI Demands Compliance and Sovereignty

Of the many industries to build AI for, healthcare might be the least forgiving. Patient well-being, regulation, and compliance all require high degrees of precision, with little room for error.

On a recent podcast, I sat down with Nicklas Frahm, director of platform engineering at Corti, a healthcare AI company founded in 2016, to talk about what it takes to build infrastructure for that environment.

From 911 Calls to a Healthcare AI Platform

Nicklas came to Corti as a mechatronics engineer by training rather than as a traditional software engineer. He specialized in embedded systems, which he said pays off now that he works with GPUs.

Corti started in call recording for emergency call centers, where 911 latency made real-time processing a requirement.

Over time, the Corti team discovered it had a talent for infrastructure, a discovery that shaped what the company became: a platform people who develop healthcare applications can build on. Nicklas, who leads a team of about 10, said they “cover the entire stack,” from the hardware that runs the models to the experience of the ML engineers who bring those models to life for customers.

Corti now spans five verticals: medical-grade speech recognition tuned for medical-term recall and a low word error rate; text generation for documents like a SOAP note, a standard writing method health professionals use to record patient visits; an agentic framework that can autonomously handle checking for drug-to-drug interactions and other tasks; medical coding through its Code Like Humans tool, which uses generative AI for ICD-10 coding; and raw frontier LLM access via a lightning-fast OpenAI-compatible API hosted on European infrastructure via Corti Models.

Compliance by Design

I mentioned that healthcare is often associated with the words “compliance,” “regulations” and “precision” because the stakes of getting it wrong are so high. Nicklas said his team builds to meet BSI C5, SOC 2, ISO 27001, ISO 27017, ISO 27018 and HIPAA requirements.

He pushed back on the idea that compliance is friction. “I see compliance as a way to give you a mandate to build things securely and to make sure that you build it at a high quality,” he said.

Compliance and security are part of the design from the start, he said. If you add them later, it can make model development “very, very hard.”

Building a Sovereign Stack

Nicklas said Corti built its own Kubernetes engine using Cluster API and Talos Linux, chosen for security, reusability and adaptability, so it could swap out the underlying substrate as needed.

The new inference clusters running on that engine went live in winter, Nicklas said, and Corti will soon launch a fully sovereign environment decoupled from hyperscalers.

That work responds to real customer demands, including some customers in Switzerland that require no external access to their systems, and to a broader sovereignty debate Nicklas said starts with raw numbers. By his account, the United States owns about 70% of the world’s GPUs. Owning the technology stack by building it yourself, rather than buying it from someone else, is part of how Corti defines sovereignty.

Concerns about the U.S. CLOUD Act, along with country-specific frameworks like Germany’s C5 and France’s HDS, shape which partners European healthcare customers will trust. Corti still relies on Microsoft Azure but chose Scaleway, a European provider expanding into the U.S., as a strategic partner.

What Stays Open, What Stays Proprietary

Corti has contributed upstream to partners like Scaleway when off-the-shelf tools fell short, including custom tooling for leader election on networks it can’t directly access. It leans on open source too, with Nicklas citing Envoy as an example.

He draws a line, though, between what Corti makes open source and what stays proprietary. The inference stack, models and tooling that make the platform work end to end are off-limits, but the Kubernetes engine is generic enough to share.

“You can’t just be a user, you kind of need to contribute back,” he said.

The TechArena Take

Nicklas’ conversation makes a strong case that healthcare AI’s hardest problems lie in the infrastructure underneath the model. He and Corti have found success by considering compliance frameworks and sovereignty concerns during the design stage rather than bolting them on after the fact.

Corti’s bet is that building both in from the start, from meeting data protection standards like HIPAA to owning its own Kubernetes engine to choosing partners by where they operate, is what lets a healthcare AI company move fast. Open-sourcing the generic infrastructure layer while keeping the healthcare-specific stack proprietary is a sensible way to give back without giving away its core differentiation.

To learn more, visit corti.ai, cortilabs.com, or find Corti’s open-source work at kommodity.io.

‍