Business case and benefits
- HR director
- A · Accountable
- HR operations lead
- R · Responsible
- Employee relations
- C · Consulted
- Solutions architect
- C · Consulted
- Technical PM
- C · Consulted
- Engineers
- I · Informed
- DPO
- I · Informed
- Security
- I · Informed
Staff and managers get answers from your own approved policies, with the source quoted. New starters are onboarded on time, with right to work checks done by the prescribed methods and confirmed by a person. Anything sensitive goes straight to someone trained to handle it.
At a glance
An illustrative scenario. The numbers are typical examples, not a client case study. The cloud services and UK rules were checked on 9 November 2026.
The HR service centre spends most of its day answering the same questions. How much sick pay do I get? Can I carry over holiday? What's the paternity leave policy? How do I request flexible working? The answers are in the policies, but the policies sit in an intranet that is hard to search, with older versions still in circulation. Managers ask HR to interpret them, and two advisers sometimes give two different answers.
Onboarding is a chain of handoffs. Someone has to issue the written statement of terms on or before the first day, run the right to work check before work starts, set up payroll, ask IT for a laptop and accounts, and book the induction. When one link is late, the new starter arrives to no laptop, or, worse, starts work before the right to work check has been completed. From 1 October 2026 the right to work regime also covers more people than direct employees, such as some workers and individual contractors.
And the law is moving. The Employment Rights Act 2025 is being brought in over 2026 and 2027: statutory sick pay from the first day of sickness and day-one paternity leave since April 2026, a stronger duty to prevent sexual harassment since 30 October 2026, and a six-month qualifying period for unfair dismissal from 1 January 2027. Every change means policies to rewrite and advisers to retrain. An assistant that answers from last year's policy is worse than no assistant at all.
Agree these, and measure the baseline, before anything is built. Example targets are typical, not promises.
Share of routine policy questions answered from an approved policy, with its source shown.
Example60–70% of routine queries
Weekly sample of answers checked by an HR adviser against the policy. Wrong answers are logged and fixed at the source.
ExampleAbove 95% on the sample
Share of grievance, health, harassment and whistleblowing conversations passed to a person without the assistant giving advice.
ExampleEvery one, tested monthly
Checks completed and confirmed by a person before work starts, for everyone in scope.
Example100%, reported weekly
New starters with a written statement, accounts, equipment and induction booked by their first day.
ExampleFrom around 70% to above 95%
Hours moved from repeat questions to casework and manager support.
ExampleMeasured against the baseline
Cross-sector rules are on the UK regulation map.
Employees and workers must get a written statement of the main terms on or before their first day. The agent assembles it from the approved template and the data in your HR system. A person in HR checks and issues it, and the AI never drafts terms from scratch.
Royal Assent on 18 December 2025, with measures commencing through 2026 and 2027 on the government's published timeline. Each policy in the assistant's index has an owner and an effective date, so the old answer stops the day the new rule starts, and an adviser checks the new answer before it goes live.
Checks must use a prescribed method: the Home Office online service with a share code, a manual document check, or a check through a digital verification service provider registered for right to work on the government's register. Using a provider doesn't move responsibility. The employer must still confirm the person matches the photo and details, and keep records for the employment plus two years. The AI never decides whether someone has the right to work.
Tribunals take the Code into account, and awards can be adjusted for unreasonable failure to follow it. The assistant can explain where to find the procedure, but it never advises on an individual case, and any message that sounds like a grievance goes to a person. Acas consulted on a fully revised Code from July to September 2026, including on AI in these processes.
A question about a disability, an adjustment, menopause or pregnancy is about a person, not just a policy, so it goes to a trained adviser. Since 30 October 2026 employers must take all reasonable steps to prevent sexual harassment, including by third parties. The assistant makes reporting easy and never weighs up whether something counts as harassment.
HR conversations contain health, family and other special category data. That means a DPIA, access controls so people see only their own data, short retention for chat logs, UK processing, and a contract that stops providers training on your data. The assistant takes no decisions about anyone, so the automated decision rules aren't engaged, and the design keeps it that way.
Showing AWSAzuresovereign / on-prem services. Switch with the toggle; every diagram and table on this page follows it.
01Channels
02Intake
03Intelligence
04Orchestration
05Systems of record
06People
| Layer | AWS | Azure | Sovereign / on-prem |
|---|---|---|---|
| Channels and API layerMeet people where they already ask questions. Frontline staff without a desk may need the intranet on their phone. | API Gateway, with a bot connector for your workplace chat | API Management, with a bot connector for your workplace chat | Kong or your existing API gateway, with an open-source chat connector |
| Approved policy libraryIndex approved, current versions only. Drafts and superseded versions stay out. | Amazon S3, fed only from the policy owner's approved folder | Blob Storage, fed only from the policy owner's approved folder | Ceph, or IONOS S3 Object Storage |
| Policy retrievalTag every document with contract type, country, effective date and owner, and filter on them at query time. | Bedrock Knowledge Bases | Foundry IQ, built on Azure AI Search | OpenSearch, or PostgreSQL with pgvector |
| AnswersBoth clouds offer a choice of models, including Claude. Answers must quote the source; no source, no answer. | Amazon Bedrock | Microsoft Foundry | Open-weight models served with vLLM on your own GPUs, or IONOS AI Model Hub |
| Agent runtimeThe original Bedrock Agents closed to new customers on 30 July 2026; new builds use AgentCore. | Amazon Bedrock AgentCore | Foundry Agent Service | An open-source agent framework (e.g. LangGraph) on Kubernetes |
| PermissionsManagers' guidance and country-specific policies are filtered by the platform before the model sees them. | IAM Identity Center, Amazon Verified Permissions | Entra ID groups, with security filters in Azure AI Search | Keycloak or your existing Active Directory, with filters in the search index |
| Sensitive-topic routing and guardrailsDenied topics for legal advice, individual cases and eligibility decisions, plus a classifier that hands off rather than answers. | Bedrock Guardrails | Foundry guardrails (Azure AI Content Safety) | Open-source guardrails (e.g. NeMo Guardrails, Llama Guard) |
| Personal data in logsRedact names and health details from analytics logs. Keep full transcripts only where a case needs them. | Amazon Comprehend PII detection | Azure Language in Foundry Tools (PII detection) | Open-source PII detection (e.g. Presidio) |
| Onboarding workflowThe checklist and its deadlines are workflow rules owned by HR, not model output. | AWS Step Functions | Logic Apps or Durable Functions | Temporal, or n8n |
| Right to work checkBuy this, don't build it. Check the provider's register entry shows right to work, and keep its output with the record. | A registered right to work digital verification provider, or the Home Office online service | A registered right to work digital verification provider, or the Home Office online service | A registered right to work digital verification provider, or the Home Office online service |
| Link to HR, payroll and ITUse your HR system's own APIs. The agent creates tasks; it doesn't edit employee records. | API Gateway, EventBridge, plus your existing integration platform if you have one | API Management, Event Grid, plus your existing integration platform if you have one | Kong, Kafka, plus your existing integration platform if you have one |
| Identity, keys, data protection | KMS, Macie | Key Vault, Purview | OpenBao or HashiCorp Vault; an HSM |
| Monitoring and auditLog every answer with the sources used, every handoff, and every right to work confirmation with who made it. | CloudWatch, CloudTrail | Azure Monitor, Log Analytics | Prometheus, Grafana, OpenTelemetry |
| UK data residencyIONOS AI Model Hub runs in German data centres: EU, not UK, residency. Staff records often carry a UK-only requirement. | eu-west-2 (London) | UK South / UK West | Your own UK data centre, or a UK or EU provider |
On a phone, the table shows the platform you pick. Sovereign / on-prem means open, portable components you can run in your own data centre or with a UK or European provider; IONOS is shown as one example, and others exist. What sovereign cloud means →
Many organisations keep core systems and sensitive data on their own servers. This is how the same design works across both.
Stays on-prem
The HR system, payroll and the employee relations case files stay where they are. Many employers run payroll on their own servers or with a bureau, and nothing here needs it to move.
Uses cloud AI
The policy index, the assistant and the onboarding agent run in a UK cloud region, or on your own GPUs with open-weight models if staff data must not leave your estate. Policies are low-risk to index; personal data is fetched only when the person asking is entitled to it.
How they connect
A private link (AWS Direct Connect or Azure ExpressRoute) and your API layer. The agent reads task status and creates tasks through the HR system's APIs, and events come back onto your queue.
If the link drops
Staff use the intranet and the HR service centre as before. Onboarding tasks are already in the HR system with owners and dates, so nothing is lost, and right to work checks carry on through the Home Office service and your registered provider.
What each agent may do through its tools, what it may not, and where a person signs off. The limits are enforced by the platform, not the prompt.
HR policy assistant
Where a person signs offAnything sensitive or about a person's own case goes to a named HR adviser, who decides what happens next. Entitlement decisions are made by HR under the policy. Permissions are enforced by the platform's identity and policy controls, not by instructions in a prompt.
Onboarding agent
Where a person signs offA trained person confirms every right to work check, matches the person to the photo and records it before work starts. HR issues every written statement. The start-date block is a workflow rule, not a prompt.
The HR system stays the record for people, contracts and onboarding tasks. The assistant and the agent reach it only through an API layer, with read access for what the person asking may see, and task creation for onboarding. Neither writes to pay or terms.
Policies flow one way: from the policy owner's approved library into the index, with an effective date on each. When a policy changes, the new version is indexed, checked by an adviser against a set of test questions, and switched on at its effective date. Superseded versions stay in the archive, not in the index.
Handoffs are cases, not chat messages. When the assistant hands over, it opens a case in your HR case tool with the conversation, so the person doesn't have to repeat themselves. If the AI is switched off, the intranet and the HR service centre work exactly as before.
Sort the top 200 questions by topic, audit the policy library for owners and versions, map onboarding steps and right to work methods, and agree the always-to-a-person topics.
Gate · must be true to passPolicy library cleaned up, handoff topics agreed with employee relations, DPIA started, baseline measured.
Policy assistant for HR advisers first, then one business area. Onboarding agent for one region's starters, alongside the current process.
Gate · must be true to passAnswer accuracy above target on the weekly sample, every sensitive test case handed off, right to work completion at 100%.
Open to all staff and managers, and all new starters, with monitoring, support and a rollback plan.
Gate · must be true to passMonitoring, adviser training, staff comms and rollback plan in place.
Add leavers and internal moves, manager guidance, and the next Employment Rights Act changes as they commence.
Gate · must be true to passEach new policy area passes the same answer-check gate.
| Activity | HR director | HR operations lead | Employee relations | Solutions architectI can fill this | Technical PMI can fill this | EngineersI can fill this | DPO | SecurityI can fill this |
|---|---|---|---|---|---|---|---|---|
| Business case and benefits | Accountable | Responsible | Consulted | Consulted | Consulted | Informed | Informed | Informed |
| Policy library and owners | Accountable | Responsible | Consulted | Informed | Consulted | Informed | Consulted | Informed |
| Always-to-a-person topics | Accountable | Consulted | Responsible | Consulted | Informed | Consulted | Consulted | Informed |
| Target architecture | Informed | Consulted | Informed | Accountable and Responsible | Consulted | Consulted | Consulted | Consulted |
| DPIA and access model | Consulted | Consulted | Consulted | Consulted | Informed | Consulted | Accountable and Responsible | Consulted |
| Build and integration | Informed | Consulted | Informed | Accountable | Responsible | Responsible | Informed | Consulted |
| Right to work process | Accountable | Responsible | Informed | Consulted | Consulted | Consulted | Consulted | Informed |
| Go-live decision | Accountable | Responsible | Consulted | Consulted | Responsible | Informed | Consulted | Consulted |
R ResponsibleA AccountableC ConsultedI Informed· not involved
Option A
If there's no architect on the programme, I'd own the design end to end: the policy index and its access model, the integration with your HR system, payroll and IT, the onboarding workflow and the gates. I'd report to your programme board and work closely with your HR operations and employee relations leads.
Option B
If your partner or your own team already has an architect, I'd take on the retrieval, the agent permissions and the HR system integration under their lead, and give them a second senior opinion on the rest, especially access control and data protection.
Goes wrong
The assistant indexes the whole intranet, so it quotes a 2019 policy and a draft nobody approved.
How the design avoids it
Index only the approved library, with an owner and effective date on every document, and no source means no answer.
Goes wrong
Someone describes a grievance or a health problem and gets a policy summary back.
How the design avoids it
Topic routing that hands off first and answers second, tested monthly with real examples written by employee relations.
Goes wrong
A manager asks about a named employee and sees their absence record.
How the design avoids it
Permissions enforced by the platform on every lookup, and managers' answers drawn from guidance, not people's files.
Goes wrong
A new starter begins work because the agent chased everything except the right to work check.
How the design avoids it
A workflow rule that blocks the start date until a trained person confirms the check.
Goes wrong
The law changes and the old answer keeps going out.
How the design avoids it
A change calendar, effective dates in the index, and test questions re-run before each commencement date.
Changes already announced or under way that affect this design. More in the UK horizon scan.
Update probation, dismissal and onboarding policies before the date, and add the trade union statement to the onboarding pack and its checklist.
Put contract changes on the always-to-a-person list now. The assistant should never explain how terms can be changed.
Draft the leave policy early, and make sure questions about bereavement and pregnancy loss are answered kindly and offered a person straight away.
Keep the assistant to explaining how to apply. Decisions on requests stay with managers and HR.
Keep the assistant out of individual cases, so the new Code changes a policy document, not the system design.
Good answers are specific. Vague answers to any of these are worth following up.
Whether you need someone to lead the design or to support the architect you already have, let's talk it through.