Cross-functional · Playbook 58

HR policy assistant and onboarding

Staff and managers get answers from your own approved policies, with the source quoted. New starters are onboarded on time, with right to work checks done by the prescribed methods and confirmed by a person. Anything sensitive goes straight to someone trained to handle it.

  • Retrieval (RAG)
  • Agents with tools
  • Human in the loop
  • Employment law
  • Home Office right to work
  • Acas
  • Equality Act 2010
  • UK GDPR

At a glance

The problem
HR answers the same policy questions all day, onboarding runs on emails and spreadsheets, and the rules keep changing
Typical volume
Around 3,000 HR queries a month and 1,200 new starters a year
Who's involved
HR operations, HR business partners, employee relations, payroll, IT, line managers, data protection, recognised unions or staff forum
Pilot
8 weeks after a 3-week discovery
Platforms
AWS, Azure, or a sovereign or on-prem stack

An illustrative scenario. The numbers are typical examples, not a client case study. The cloud services and UK rules were checked on 9 November 2026.

The business problem

The HR service centre spends most of its day answering the same questions. How much sick pay do I get? Can I carry over holiday? What's the paternity leave policy? How do I request flexible working? The answers are in the policies, but the policies sit in an intranet that is hard to search, with older versions still in circulation. Managers ask HR to interpret them, and two advisers sometimes give two different answers.

Onboarding is a chain of handoffs. Someone has to issue the written statement of terms on or before the first day, run the right to work check before work starts, set up payroll, ask IT for a laptop and accounts, and book the induction. When one link is late, the new starter arrives to no laptop, or, worse, starts work before the right to work check has been completed. From 1 October 2026 the right to work regime also covers more people than direct employees, such as some workers and individual contractors.

And the law is moving. The Employment Rights Act 2025 is being brought in over 2026 and 2027: statutory sick pay from the first day of sickness and day-one paternity leave since April 2026, a stronger duty to prevent sexual harassment since 30 October 2026, and a six-month qualifying period for unfair dismissal from 1 January 2027. Every change means policies to rewrite and advisers to retrain. An assistant that answers from last year's policy is worse than no assistant at all.

What AI changes

  • Staff and managers ask questions in plain English, in workplace chat or on the intranet, and get an answer drawn only from the current approved policy, with the policy name, version and section quoted.
  • Answers depend on who is asking: the right policy for their contract, country and role, enforced by their permissions, not by the wording of the question.
  • Grievances, disciplinary matters, health, harassment, discrimination, whistleblowing and anything about a person's own case go straight to a named person, with a warm handoff and no AI interpretation.
  • Onboarding runs as a tracked workflow: the agent chases each task, tells the new starter what to do next, and flags anything at risk of missing day one.
  • Right to work checks follow the Home Office's prescribed methods. The agent sends the right instructions and chases; a trained person confirms the result and records it before the start date.
  • Policy owners see which questions the assistant couldn't answer, so gaps and unclear wording are fixed at the source.

How success is measured

Agree these, and measure the baseline, before anything is built. Example targets are typical, not promises.

Queries answered with a citation

Share of routine policy questions answered from an approved policy, with its source shown.

Example60–70% of routine queries

Answer accuracy

Weekly sample of answers checked by an HR adviser against the policy. Wrong answers are logged and fixed at the source.

ExampleAbove 95% on the sample

Sensitive matters handed off

Share of grievance, health, harassment and whistleblowing conversations passed to a person without the assistant giving advice.

ExampleEvery one, tested monthly

Right to work checks before day one

Checks completed and confirmed by a person before work starts, for everyone in scope.

Example100%, reported weekly

Ready on day one

New starters with a written statement, accounts, equipment and induction booked by their first day.

ExampleFrom around 70% to above 95%

Time back for HR advisers

Hours moved from repeat questions to casework and manager support.

ExampleMeasured against the baseline

UK regulation and controls

Cross-sector rules are on the UK regulation map.

  • BISTEmployment Rights Act 1996: written statement of particulars

    Employees and workers must get a written statement of the main terms on or before their first day. The agent assembles it from the approved template and the data in your HR system. A person in HR checks and issues it, and the AI never drafts terms from scratch.

  • BISTEmployment Rights Act 2025, brought in by stages

    Royal Assent on 18 December 2025, with measures commencing through 2026 and 2027 on the government's published timeline. Each policy in the assistant's index has an owner and an effective date, so the old answer stops the day the new rule starts, and an adviser checks the new answer before it goes live.

  • Home OfficeEmployer's guide to right to work checks (1 October 2026) and the Immigration, Asylum and Nationality Act 2006

    Checks must use a prescribed method: the Home Office online service with a share code, a manual document check, or a check through a digital verification service provider registered for right to work on the government's register. Using a provider doesn't move responsibility. The employer must still confirm the person matches the photo and details, and keep records for the employment plus two years. The AI never decides whether someone has the right to work.

  • AcasCode of Practice on disciplinary and grievance procedures

    Tribunals take the Code into account, and awards can be adjusted for unreasonable failure to follow it. The assistant can explain where to find the procedure, but it never advises on an individual case, and any message that sounds like a grievance goes to a person. Acas consulted on a fully revised Code from July to September 2026, including on AI in these processes.

  • EHRCEquality Act 2010: reasonable adjustments and harassment

    A question about a disability, an adjustment, menopause or pregnancy is about a person, not just a policy, so it goes to a trained adviser. Since 30 October 2026 employers must take all reasonable steps to prevent sexual harassment, including by third parties. The assistant makes reporting easy and never weighs up whether something counts as harassment.

  • ICOUK GDPR, the Data Protection Act 2018 and employment records

    HR conversations contain health, family and other special category data. That means a DPIA, access controls so people see only their own data, short retention for chat logs, UK processing, and a contract that stops providers training on your data. The assistant takes no decisions about anyone, so the automated decision rules aren't engaged, and the design keeps it that way.

The solution

Showing AWSAzuresovereign / on-prem services. Switch with the toggle; every diagram and table on this page follows it.

HR policy assistant and onboarding: reference architecture
  1. 01Channels

    • Workplace chat and intranet
    • New starter portal
    • Registered right to work provider
  2. 02Intake

    • API GatewayAPI ManagementKong, or your existing API gatewayChat and API layer
    • Amazon S3Blob StorageCeph, or IONOS S3 Object StorageApproved policy library
    • IAM Identity Center + Verified PermissionsEntra IDKeycloak or your existing Active DirectorySign-in and permissions
  3. 03Intelligence

    • Bedrock Knowledge BasesFoundry IQ (Azure AI Search)OpenSearch, or PostgreSQL with pgvectorPolicy retrieval
    • Agent
      Amazon BedrockMicrosoft FoundryOpen-weight models via vLLMPolicy assistant
    • Agent
      Bedrock AgentCoreFoundry Agent ServiceLangGraph on KubernetesOnboarding agent
  4. 04Orchestration

    • Step FunctionsLogic Apps / Durable FunctionsTemporal, or n8nOnboarding workflow
    • EventBridge + SQSEvent Grid + Service BusApache Kafka or RabbitMQEvents and queues
  5. 05Systems of record

    • Your HR system
    • Payroll
    • IT service desk and identity
  6. 06People

    • Person
      HR adviser: handoffs and answer checks
    • Person
      Employee relations case owner
    • Person
      Trained checker: right to work
  • Cloud or platform service (AWSAzuresovereign / on-prem)
  • AI agent
  • A person decides
  • Your existing systems
  • Outside your organisation

Components, side by side

HR policy assistant and onboarding: components on AWS, Azure and a sovereign or on-prem stack
LayerAWSAzureSovereign / on-prem
Channels and API layerMeet people where they already ask questions. Frontline staff without a desk may need the intranet on their phone.API Gateway, with a bot connector for your workplace chatAPI Management, with a bot connector for your workplace chatKong or your existing API gateway, with an open-source chat connector
Approved policy libraryIndex approved, current versions only. Drafts and superseded versions stay out.Amazon S3, fed only from the policy owner's approved folderBlob Storage, fed only from the policy owner's approved folderCeph, or IONOS S3 Object Storage
Policy retrievalTag every document with contract type, country, effective date and owner, and filter on them at query time.Bedrock Knowledge BasesFoundry IQ, built on Azure AI SearchOpenSearch, or PostgreSQL with pgvector
AnswersBoth clouds offer a choice of models, including Claude. Answers must quote the source; no source, no answer.Amazon BedrockMicrosoft FoundryOpen-weight models served with vLLM on your own GPUs, or IONOS AI Model Hub
Agent runtimeThe original Bedrock Agents closed to new customers on 30 July 2026; new builds use AgentCore.Amazon Bedrock AgentCoreFoundry Agent ServiceAn open-source agent framework (e.g. LangGraph) on Kubernetes
PermissionsManagers' guidance and country-specific policies are filtered by the platform before the model sees them.IAM Identity Center, Amazon Verified PermissionsEntra ID groups, with security filters in Azure AI SearchKeycloak or your existing Active Directory, with filters in the search index
Sensitive-topic routing and guardrailsDenied topics for legal advice, individual cases and eligibility decisions, plus a classifier that hands off rather than answers.Bedrock GuardrailsFoundry guardrails (Azure AI Content Safety)Open-source guardrails (e.g. NeMo Guardrails, Llama Guard)
Personal data in logsRedact names and health details from analytics logs. Keep full transcripts only where a case needs them.Amazon Comprehend PII detectionAzure Language in Foundry Tools (PII detection)Open-source PII detection (e.g. Presidio)
Onboarding workflowThe checklist and its deadlines are workflow rules owned by HR, not model output.AWS Step FunctionsLogic Apps or Durable FunctionsTemporal, or n8n
Right to work checkBuy this, don't build it. Check the provider's register entry shows right to work, and keep its output with the record.A registered right to work digital verification provider, or the Home Office online serviceA registered right to work digital verification provider, or the Home Office online serviceA registered right to work digital verification provider, or the Home Office online service
Link to HR, payroll and ITUse your HR system's own APIs. The agent creates tasks; it doesn't edit employee records.API Gateway, EventBridge, plus your existing integration platform if you have oneAPI Management, Event Grid, plus your existing integration platform if you have oneKong, Kafka, plus your existing integration platform if you have one
Identity, keys, data protectionKMS, MacieKey Vault, PurviewOpenBao or HashiCorp Vault; an HSM
Monitoring and auditLog every answer with the sources used, every handoff, and every right to work confirmation with who made it.CloudWatch, CloudTrailAzure Monitor, Log AnalyticsPrometheus, Grafana, OpenTelemetry
UK data residencyIONOS AI Model Hub runs in German data centres: EU, not UK, residency. Staff records often carry a UK-only requirement.eu-west-2 (London)UK South / UK WestYour own UK data centre, or a UK or EU provider

On a phone, the table shows the platform you pick. Sovereign / on-prem means open, portable components you can run in your own data centre or with a UK or European provider; IONOS is shown as one example, and others exist. What sovereign cloud means →

Hybrid and on-prem

Many organisations keep core systems and sensitive data on their own servers. This is how the same design works across both.

Stays on-prem

The HR system, payroll and the employee relations case files stay where they are. Many employers run payroll on their own servers or with a bureau, and nothing here needs it to move.

Uses cloud AI

The policy index, the assistant and the onboarding agent run in a UK cloud region, or on your own GPUs with open-weight models if staff data must not leave your estate. Policies are low-risk to index; personal data is fetched only when the person asking is entitled to it.

How they connect

A private link (AWS Direct Connect or Azure ExpressRoute) and your API layer. The agent reads task status and creates tasks through the HR system's APIs, and events come back onto your queue.

If the link drops

Staff use the intranet and the HR service centre as before. Onboarding tasks are already in the HR system with owners and dates, so nothing is lost, and right to work checks carry on through the Home Office service and your registered provider.

The agents

What each agent may do through its tools, what it may not, and where a person signs off. The limits are enforced by the platform, not the prompt.

HR policy assistant

May do

  • Search the approved policies the person is entitled to see
  • Answer with the policy name, version and section quoted
  • Show the person their own holiday balance or pay dates from the HR system
  • Explain how to start a request, such as flexible working or leave
  • Hand the conversation to an HR adviser, with the person's agreement

May not do

  • Give legal advice or interpret the law
  • Advise on an individual grievance, disciplinary, absence or performance case
  • Decide whether someone is entitled to something
  • Assess whether behaviour amounts to harassment or discrimination
  • See another person's records, or show managers anything about a named employee
  • Answer from anything other than the approved policy library

Where a person signs offAnything sensitive or about a person's own case goes to a named HR adviser, who decides what happens next. Entitlement decisions are made by HR under the policy. Permissions are enforced by the platform's identity and policy controls, not by instructions in a prompt.

Onboarding agent

May do

  • Read the onboarding checklist and task status in the HR system
  • Send the new starter instructions and reminders
  • Send the link for the registered right to work provider, or ask for a share code
  • Raise IT requests for equipment and accounts
  • Book induction sessions
  • Assemble the written statement from the approved template for HR to check

May not do

  • Mark a right to work check as passed, or judge a document
  • Issue a contract or written statement
  • Change pay, terms or employee records
  • Confirm a start date if the right to work check isn't complete

Where a person signs offA trained person confirms every right to work check, matches the person to the photo and records it before work starts. HR issues every written statement. The start-date block is a workflow rule, not a prompt.

Middleware and integration

The HR system stays the record for people, contracts and onboarding tasks. The assistant and the agent reach it only through an API layer, with read access for what the person asking may see, and task creation for onboarding. Neither writes to pay or terms.

Policies flow one way: from the policy owner's approved library into the index, with an effective date on each. When a policy changes, the new version is indexed, checked by an adviser against a set of test questions, and switched on at its effective date. Superseded versions stay in the archive, not in the index.

Handoffs are cases, not chat messages. When the assistant hands over, it opens a case in your HR case tool with the conversation, so the person doesn't have to repeat themselves. If the AI is switched off, the intranet and the HR service centre work exactly as before.

Process and people

  • A named owner and an effective date for every policy in the index, with change control.
  • A list of topics that always go to a person, agreed with employee relations and your recognised unions or staff forum, and tested every month.
  • A weekly sample of answers checked by an HR adviser, with wrong answers fixed in the policy or the index, not just patched in a prompt.
  • A trained, named group of right to work checkers, with cover for peak starts and a block on starting work until the check is confirmed.
  • A change calendar for the Employment Rights Act 2025, so each policy is rewritten and re-tested before its commencement date.
  • Staff told plainly what the assistant is, what it can't do, and how to reach a person at any point.

Delivery plan

  1. 3 weeks

    Discovery

    Sort the top 200 questions by topic, audit the policy library for owners and versions, map onboarding steps and right to work methods, and agree the always-to-a-person topics.

  2. Gate · must be true to passPolicy library cleaned up, handoff topics agreed with employee relations, DPIA started, baseline measured.

  3. 8 weeks

    Pilot

    Policy assistant for HR advisers first, then one business area. Onboarding agent for one region's starters, alongside the current process.

  4. Gate · must be true to passAnswer accuracy above target on the weekly sample, every sensitive test case handed off, right to work completion at 100%.

  5. 4–6 weeks

    Production

    Open to all staff and managers, and all new starters, with monitoring, support and a rollback plan.

  6. Gate · must be true to passMonitoring, adviser training, staff comms and rollback plan in place.

  7. Ongoing

    Scale

    Add leavers and internal moves, manager guidance, and the next Employment Rights Act changes as they commence.

  8. Gate · must be true to passEach new policy area passes the same answer-check gate.

Roles and RACI

Who is responsible, accountable, consulted and informed, by activity
ActivityHR directorHR operations leadEmployee relationsSolutions architectI can fill thisTechnical PMI can fill thisEngineersI can fill thisDPOSecurityI can fill this
Business case and benefitsAccountableResponsibleConsultedConsultedConsultedInformedInformedInformed
Policy library and ownersAccountableResponsibleConsultedInformedConsultedInformedConsultedInformed
Always-to-a-person topicsAccountableConsultedResponsibleConsultedInformedConsultedConsultedInformed
Target architectureInformedConsultedInformedAccountable and ResponsibleConsultedConsultedConsultedConsulted
DPIA and access modelConsultedConsultedConsultedConsultedInformedConsultedAccountable and ResponsibleConsulted
Build and integrationInformedConsultedInformedAccountableResponsibleResponsibleInformedConsulted
Right to work processAccountableResponsibleInformedConsultedConsultedConsultedConsultedInformed
Go-live decisionAccountableResponsibleConsultedConsultedResponsibleInformedConsultedConsulted

Business case and benefits

HR director
A · Accountable
HR operations lead
R · Responsible
Employee relations
C · Consulted
Solutions architect
C · Consulted
Technical PM
C · Consulted
Engineers
I · Informed
DPO
I · Informed
Security
I · Informed

Policy library and owners

HR director
A · Accountable
HR operations lead
R · Responsible
Employee relations
C · Consulted
Solutions architect
I · Informed
Technical PM
C · Consulted
Engineers
I · Informed
DPO
C · Consulted
Security
I · Informed

Always-to-a-person topics

HR director
A · Accountable
HR operations lead
C · Consulted
Employee relations
R · Responsible
Solutions architect
C · Consulted
Technical PM
I · Informed
Engineers
C · Consulted
DPO
C · Consulted
Security
I · Informed

Target architecture

HR director
I · Informed
HR operations lead
C · Consulted
Employee relations
I · Informed
Solutions architect
A/R · Accountable and Responsible
Technical PM
C · Consulted
Engineers
C · Consulted
DPO
C · Consulted
Security
C · Consulted

DPIA and access model

HR director
C · Consulted
HR operations lead
C · Consulted
Employee relations
C · Consulted
Solutions architect
C · Consulted
Technical PM
I · Informed
Engineers
C · Consulted
DPO
A/R · Accountable and Responsible
Security
C · Consulted

Build and integration

HR director
I · Informed
HR operations lead
C · Consulted
Employee relations
I · Informed
Solutions architect
A · Accountable
Technical PM
R · Responsible
Engineers
R · Responsible
DPO
I · Informed
Security
C · Consulted

Right to work process

HR director
A · Accountable
HR operations lead
R · Responsible
Employee relations
I · Informed
Solutions architect
C · Consulted
Technical PM
C · Consulted
Engineers
C · Consulted
DPO
C · Consulted
Security
I · Informed

Go-live decision

HR director
A · Accountable
HR operations lead
R · Responsible
Employee relations
C · Consulted
Solutions architect
C · Consulted
Technical PM
R · Responsible
Engineers
I · Informed
DPO
C · Consulted
Security
C · Consulted

R ResponsibleA AccountableC ConsultedI Informed· not involved

Where I'd fit

Option A

Lead the architecture

If there's no architect on the programme, I'd own the design end to end: the policy index and its access model, the integration with your HR system, payroll and IT, the onboarding workflow and the gates. I'd report to your programme board and work closely with your HR operations and employee relations leads.

Option B

Support your architect

If your partner or your own team already has an architect, I'd take on the retrieval, the agent permissions and the HR system integration under their lead, and give them a second senior opinion on the rest, especially access control and data protection.

Where this goes wrong

  1. Goes wrong

    The assistant indexes the whole intranet, so it quotes a 2019 policy and a draft nobody approved.

    How the design avoids it

    Index only the approved library, with an owner and effective date on every document, and no source means no answer.

  2. Goes wrong

    Someone describes a grievance or a health problem and gets a policy summary back.

    How the design avoids it

    Topic routing that hands off first and answers second, tested monthly with real examples written by employee relations.

  3. Goes wrong

    A manager asks about a named employee and sees their absence record.

    How the design avoids it

    Permissions enforced by the platform on every lookup, and managers' answers drawn from guidance, not people's files.

  4. Goes wrong

    A new starter begins work because the agent chased everything except the right to work check.

    How the design avoids it

    A workflow rule that blocks the start date until a trained person confirms the check.

  5. Goes wrong

    The law changes and the old answer keeps going out.

    How the design avoids it

    A change calendar, effective dates in the index, and test questions re-run before each commencement date.

On the horizon

Changes already announced or under way that affect this design. More in the UK horizon scan.

  1. 1 January 2027
    Employment Rights Act 2025: the unfair dismissal qualifying period falls to six months, compensation caps are removed, and employers must tell workers of their right to join a trade union.

    Update probation, dismissal and onboarding policies before the date, and add the trade union statement to the onboarding pack and its checklist.

  2. March 2027
    Employment Rights Act 2025: new protections against fire and rehire.

    Put contract changes on the always-to-a-person list now. The assistant should never explain how terms can be changed.

  3. April 2027
    Employment Rights Act 2025: bereavement leave, including for pregnancy loss, and mandatory equality and menopause action plans for private and voluntary sector employers.

    Draft the leave policy early, and make sure questions about bereavement and pregnancy loss are answered kindly and offered a person straight away.

  4. October 2027
    Employment Rights Act 2025: changes to flexible working requests.

    Keep the assistant to explaining how to apply. Decisions on requests stay with managers and HR.

  5. Awaited
    A revised Acas Code of Practice on disciplinary and grievance procedures, consulted on from July to September 2026, including on the use of AI in those processes.

    Keep the assistant out of individual cases, so the new Code changes a policy document, not the system design.

Questions to ask your partner or vendor

Good answers are specific. Vague answers to any of these are worth following up.

Copy them into your next supplier meeting

  1. What stops the assistant answering from a draft or superseded policy?
  2. Which topics always go to a person, and how do you test that every month?
  3. How are permissions enforced so a manager can't see another person's records through the assistant?
  4. Where does a right to work check get confirmed, by whom, and what blocks a start date?
  5. How will each Employment Rights Act change reach the assistant before its commencement date?
  6. Where is our staff data processed and stored, and is it used to train anyone's model?

Planning something like this?

Whether you need someone to lead the design or to support the architect you already have, let's talk it through.

Sam Naseem
Sam NaseemBirmingham, UK · UK & Europe
Available now