Field engineers ask a question out loud and hear the answer from the approved procedure, manual or asset record, with its source, even with no signal. The permit, the safety rules and the engineer stay in charge of every safety decision.
At a glance
An illustrative scenario. The numbers are typical examples, not a client case study. The cloud services and UK rules were checked on 9 November 2026.
A distribution network is decades of equipment from many manufacturers. A jointer at a substation may face switchgear that was installed before they were born, with a manual that exists as a scanned PDF, a local instruction issued after a defect, and an asset record that may or may not match what is in front of them. The right answer exists somewhere in the approved document library. Finding it on site, in the rain, with gloves on and patchy signal, is the hard part.
So engineers do what works. They phone a senior colleague, call the control centre for information rather than for switching, or rely on memory. Control engineers lose time to questions that a document could answer, and the calls that matter wait behind them. Knowledge sits with experienced staff who are retiring, while newer engineers are less sure where to look. When the asset record is wrong, the engineer finds out on site and the correction often never makes it back.
The work also sits inside some of the strictest safety rules in industry. Work on the network is controlled by the operational safety rules: switching by the control engineer, isolation and earthing by authorised persons, and a permit to work or sanction for test before anyone touches equipment. Anything that helps engineers must sit beside that system and never become a shortcut around it. DNOs are also building their 2028–2033 business plans for Ofgem's RIIO-ED3 price control, which put workforce productivity and resilience under scrutiny.
Agree these, and measure the baseline, before anything is built. Example targets are typical, not promises.
From asking to having the cited answer, measured in the pilot, including offline answers.
ExampleFrom 15–20 minutes to under 1 minute
Calls asking for information a document could answer. Calls about switching and permits are excluded and must not fall.
ExampleDown by a third
Share of answers that show an approved, current source. Anything else is a defect.
Example100%
How often it says it has no approved answer. Near zero can mean it is guessing; very high means the library has gaps.
ExampleTracked, and gaps fed to document owners
Corrections raised from site and approved by the asset data team.
ExampleRising at first, then falling as records improve
Answers in the weekly audit that touch on permits, switching or whether equipment is dead. Any one is a stop-and-fix event.
ExampleZero
Cross-sector rules are on the UK regulation map.
Employers must provide safe systems of work and the information, instruction and training to go with them. The assistant is a way to reach information. It never replaces the safe system of work, the permit or the competent person's judgement, and it is risk-assessed as a change to how work is done.
The regulations cover isolation, precautions for work on equipment made dead, work near live conductors, and competence, with HSE guidance in HSR25 and HSG85. The operational safety rules turn these into permits, sanctions for test and switching. The assistant can explain a procedure, but it never issues, changes or interprets a permit, and it never confirms that equipment is isolated, earthed or dead.
For a gas distribution network, safe working sits within the safety case accepted by the HSE. Check with your safety case owner whether introducing the assistant changes any arrangement the case describes, before the pilot.
A DNO is an operator of an essential service, regulated by DESNZ and Ofgem jointly for downstream gas and electricity in Great Britain. The assistant sits in the corporate IT zone with no path into network control systems. It is still added to the NIS asset register, assessed against the NCSC Cyber Assessment Framework, and covered by incident reporting if it becomes something the service relies on.
Voice questions, locations and job references are workers' personal data. The ICO's guidance on monitoring workers expects a clear purpose, the least intrusive approach, transparency and a DPIA. Logs are used to improve answers and documents, not to judge individual engineers, and that is agreed with workforce representatives before the pilot.
Good practice guidance, not new rules: proportionate governance, risk assessment, competence and explainability. Every answer carries its source, and a named owner is accountable for the document library, the prompts and the model.
Showing AWSAzuresovereign / on-prem services. Switch with the toggle; every diagram and table on this page follows it.
01Channels
02Intake
03Intelligence
04Orchestration
05Systems of record
06People
| Layer | AWS | Azure | Sovereign / on-prem |
|---|---|---|---|
| Speech to textAdd equipment names, model numbers and local terms. Test in wind, rain, beside a running generator and through PPE, with your own engineers' accents, not a supplier's benchmark. | Amazon Transcribe (en-GB) with a custom vocabulary | Azure Speech in Foundry Tools, with custom speech | Open-weight speech models (e.g. Whisper) on your own GPUs |
| Reading answers aloudShort answers, read back, with the full section on screen. Push-to-talk, so it never listens all the time. | Amazon Polly | Azure Speech in Foundry Tools | An open-weight text-to-speech model |
| AnsweringBoth clouds offer a choice of models, including Claude. The model only summarises retrieved approved text and must cite it. | Amazon Bedrock | Microsoft Foundry | Open-weight models served with vLLM on your own GPUs, or IONOS AI Model Hub |
| Approved documents (retrieval)Only approved, current versions, filtered by equipment type. Scanned manuals need cleaning and checking before they go in. | Bedrock Knowledge Bases | Foundry IQ, built on Azure AI Search | OpenSearch, or PostgreSQL with pgvector |
| Agent runtimeRead-only tools: document search, asset record, job pack. The original Bedrock Agents closed to new customers on 30 July 2026. | Amazon Bedrock AgentCore | Foundry Agent Service | An open-source agent framework (e.g. LangGraph) on Kubernetes |
| Offline modeOffline, it searches and reads out approved text word for word. No generated answers without signal. Each pack has an expiry date. | Open-weight speech model and a local search index on the device, synced from Amazon S3 | Foundry Local on Windows tablets, or an open-weight model on the device; Azure Speech disconnected containers on approval | Open-weight speech model and a local search index on the device |
| Van gateway (optional)Only worth it if vans already carry compute. Azure IoT Edge 1.5 LTS ends on 10 November 2026; 1.6 LTS is supported to 14 November 2028. Greengrass V1 has reached end of support; build on V2. | AWS IoT Greengrass V2 on the van's edge box | Azure IoT Edge 1.6 LTS, or Arc-enabled Kubernetes | Lightweight Kubernetes (e.g. k3s) on the van's edge box |
| WorkflowA document reaches the index only after its owner approves it. A withdrawn document is removed from the index and flagged to every device at its next sync. | AWS Step Functions | Logic Apps or Durable Functions | Temporal, or n8n |
| Middleware and events | Amazon EventBridge, SQS | Event Grid, Service Bus | Apache Kafka or RabbitMQ |
| Link to document, asset and work systemsRead-only extracts. The only thing written back is a draft asset correction, into the asset data team's queue. | API Gateway, plus your existing integration platform if you have one | API Management, plus your existing integration platform if you have one | Kong or your existing API gateway, plus your existing integration platform if you have one |
| GuardrailsBlocks answers about whether equipment is dead, isolated or safe, and any switching or permit content. Those questions get a fixed reply pointing to the permit and the control engineer. | Bedrock Guardrails, including contextual grounding checks | Foundry guardrails (Azure AI Content Safety) | Open-source guardrails (e.g. NeMo Guardrails, Llama Guard) |
| Identity, devices, keysEngineers sign in with the identity they already use, on devices managed by your existing mobile device management. A lost device can be wiped remotely. | IAM Identity Center, KMS, Macie | Entra ID, Key Vault, Purview | Keycloak or your existing Active Directory; OpenBao or HashiCorp Vault; an HSM |
| Monitoring and auditLog each question, answer and document version used. Access to logs is limited and their purpose agreed with workforce representatives. | CloudWatch, CloudTrail | Azure Monitor, Log Analytics | Prometheus, Grafana, OpenTelemetry |
| UK data residencyIONOS AI Model Hub runs in German data centres: EU, not UK, residency. Network diagrams and asset data may be sensitive under NIS, so check before choosing an EU host. | eu-west-2 (London) | UK South / UK West | Your own UK data centre, or a UK or EU provider |
On a phone, the table shows the platform you pick. Sovereign / on-prem means open, portable components you can run in your own data centre or with a UK or European provider; IONOS is shown as one example, and others exist. What sovereign cloud means →
Many organisations keep core systems and sensitive data on their own servers. This is how the same design works across both.
Stays on-prem
The network control system, SCADA and the permit system stay exactly where they are, and the assistant has no connection to them. The document management system, asset register, GIS and work management system stay where they are too.
Uses cloud AI
Speech, the approved document index and the assistant run in a UK cloud region, or on your own GPUs with open-weight models if network and asset data must stay in your estate. Only approved documents and the asset fields needed for answers are copied across.
How they connect
Approved documents and asset extracts are pushed one way, over AWS Direct Connect or Azure ExpressRoute, through the API layer. Engineers' devices reach the assistant over your private mobile access or VPN, the same way they reach job packs today.
If the link drops
The device switches to its offline pack for the day's jobs and reads out approved text word for word, with the source. If a pack has expired or doesn't cover the asset, the assistant says so, and the engineer uses the paper copy or calls the control centre as they do today.
What each agent may do through its tools, what it may not, and where a person signs off. The limits are enforced by the platform, not the prompt.
Field assistant
Where a person signs offThe engineer and the authorised persons named on the permit make every safety decision, under the operational safety rules, exactly as now. Asset corrections are approved by the asset data team. The assistant's permissions are enforced by the platform's identity and network controls, not by instructions in a prompt.
The document management system stays the master. When a document owner approves a new version, an event triggers the workflow: the document is checked, indexed and added to the offline packs for the right equipment types. When a document is withdrawn, it is removed from the index and flagged to every device at its next sync. The assistant never sees drafts.
Asset and job data come from the asset register, GIS and work management system through the existing API layer, read-only. Each morning, a device syncs the pack for that engineer's jobs over depot Wi-Fi or mobile data. If the job changes during the day, the pack updates when there is signal.
There is no technical path from this platform to the network control system or SCADA, by design. Switching and permits stay in the control centre's own systems and the operational safety rules. The assistant can be switched off at any time, and work carries on exactly as it did before.
Map how engineers find information today, measure the baseline, check the quality of documents for two or three equipment families, and agree the 'never answer' list with the safety rules owner.
Gate · must be true to passBaseline agreed, document owners named, 'never answer' list signed off, DPIA started, workforce representatives briefed, NIS and security review booked.
One depot, two or three equipment families. Start with typed questions, then voice, then the offline pack. Every answer is checked against the source.
Gate · must be true to passCited answer rate at 100%, zero safety boundary breaches in the audit, voice accuracy acceptable in real site conditions, safety and NIS sign-off.
Go live at the pilot depot, with monitoring, support, device management and a rollback plan.
Gate · must be true to passSupport model, document update process, offline pack expiry and engineer training in place.
Add equipment families and depots in waves, then other teams such as overhead lines or metering.
Gate · must be true to passEach new equipment family passes the same document check and pilot gate.
| Activity | Director of operations | Safety rules owner | Product owner | Solutions architectI can fill this | Technical PMI can fill this | EngineersI can fill this | Security & NIS leadI can fill this | DPO |
|---|---|---|---|---|---|---|---|---|
| Business case and benefits | Accountable | Consulted | Responsible | Consulted | Consulted | Informed | Informed | Informed |
| Target architecture and offline design | Informed | Consulted | Consulted | Accountable and Responsible | Consulted | Consulted | Consulted | Informed |
| 'Never answer' list and safety review | Accountable | Responsible | Consulted | Consulted | Informed | Informed | Informed | Informed |
| NIS and security assessment | Informed | Informed | Consulted | Consulted | Informed | Consulted | Accountable and Responsible | Informed |
| DPIA and workforce consultation | Accountable | Informed | Consulted | Consulted | Informed | Informed | Consulted | Responsible |
| Build and integration | Informed | Informed | Consulted | Accountable | Responsible | Responsible | Consulted | Informed |
| Field testing at the pilot depot | Informed | Consulted | Accountable | Responsible | Responsible | Responsible | Informed | Informed |
| Go-live decision | Accountable | Responsible | Responsible | Consulted | Consulted | Informed | Consulted | Consulted |
| Run, monitor and improve | Informed | Consulted | Accountable | Consulted | Consulted | Responsible | Consulted | Informed |
R ResponsibleA AccountableC ConsultedI Informed· not involved
Option A
If there's no architect on the programme, I'd own the design end to end: the speech and retrieval design, the offline mode, the link to your document, asset and work systems, the security boundary with your network control systems, and the gates. I'd work closely with your safety rules owner and report to your programme board.
Option B
If your partner or your own team already has an architect, I'd take on the retrieval, the offline packs and the integration with your document and asset systems under their lead, and give them a second senior opinion on the NIS boundary, device security and how answers are tested.
Goes wrong
The assistant answers from an old procedure, or one still in draft.
How the design avoids it
Index only approved, current versions, remove withdrawn ones the same day, and put an expiry date on every offline pack.
Goes wrong
Engineers start treating it as a safety authority: 'the assistant said it's dead'.
How the design avoids it
It never confirms the state of equipment, gives a fixed reply pointing to the permit and the control engineer, and training says so plainly.
Goes wrong
Voice works in the office and fails on site.
How the design avoids it
Test in wind, rain, beside generators and through PPE, with push-to-talk, a custom vocabulary and the full text always on screen.
Goes wrong
Offline mode is quietly worse than online.
How the design avoids it
Offline, it reads approved text word for word and never generates. If the pack doesn't cover the asset, it says so.
Goes wrong
Logs turn into performance monitoring, and engineers stop using it.
How the design avoids it
Agree the purpose with workforce representatives up front, limit access to logs, and write it into the DPIA.
Changes already announced or under way that affect this design. More in the UK horizon scan.
If the assistant is part of the plan's workforce or resilience case, measure the pilot properly so the benefits stand up to Ofgem's scrutiny.
Treat the assistant's suppliers as in scope, and keep the NIS asset register and supplier assurance current.
If you use van gateways on Azure, build on 1.6 LTS or Arc-enabled Kubernetes, and plan the next upgrade for every van.
Keep the governance record, the 'never answer' list and the audit results in a form you could share with Ofgem.
Record which encryption the devices, sync and API layer use, and keep it easy to change.
Good answers are specific. Vague answers to any of these are worth following up.
Whether you need someone to lead the design or to support the architect you already have, let's talk it through.
