Every order's ready time predicted station by station, so components meet at final assembly exactly when the vehicle needs them. When something slips, the plan is redrawn in minutes and a planner approves it.
At a glance
An illustrative scenario. Linked to a real, anonymised case study below; the numbers here are still typical examples. The cloud services and UK rules were checked on 9 November 2026.
Take a manufacturer that makes goods to order, each one built to a customer's specification for a fixed handover time. Orders come from business customers by EDI and a customer portal, and amendments arrive through the day, many for dispatch the same night or the next morning. Each order line draws on several stations: material preparation, forming or machining, sub-assembly, final assembly, finishing and inspection, then packing and marshalling for dispatch. Nothing can be made early and parked. Each item is made for one order and can't be held in stock, and every component that waits takes floor space and handling the next order needs.
So the work has to converge. The parts from each station all need to reach final assembly at the same moment, and the finished order needs to reach the dock just before its vehicle leaves. Today, planners build that plan each evening in spreadsheets, using standard times that were set years ago. By mid-morning something has slipped: a machine ran long, a materials delivery arrived late, a line stopped for a changeover or a breakdown, two people called in sick, or a customer changed an order. The replan happens by phone and whiteboard, one problem at a time.
The costs show up everywhere. Components wait for an assembly slot, or assembly stands idle waiting for components. Orders miss their vehicle and go short, or miss the customer's handover window. Overtime is booked late, and people are asked to stay on or come in at short notice. Planned maintenance and machine checks are never knowingly skipped, but they're protected by experienced supervisors watching the clock, not by the plan itself.
Agree these, and measure the baseline, before anything is built. Example targets are typical, not promises.
Orders complete and on the dock before their vehicle leaves.
ExampleUp from around 92% to 98% or more
How long finished components sit waiting to be used, taking floor space and extra handling.
ExampleDown by half
Orders handed over inside each customer's agreed window, not just on the right day.
ExampleEvery order, with exceptions explained
Work made too early, too late or in the wrong quantity, and rework, by value.
ExampleMeasured against last year
Shifts added, cancelled or moved with less than the agreed notice. A measure of planning quality, and soon a legal one.
ExampleFalling month on month
How often planners approve the suggested replan unchanged. Very low means it isn't helping; near 100% can mean nobody is checking.
ExampleStable, and reviewed weekly
Cross-sector rules are on the UK regulation map.
Work equipment must be suitable for its use, maintained in an efficient state, in efficient working order and in good repair, inspected where the regulations require it, and used only by people with adequate training. The scheduler treats planned maintenance, inspections and changeovers as fixed blocks it can't move or shorten, and only plans work onto a machine when trained operators are rostered for it. Only the health and safety lead can change those rules.
Workers are entitled to 11 hours' rest between working days, a 20-minute break when working more than six hours, weekly rest, and an average 48-hour week unless they opt out. Every staffing suggestion is checked against these limits and each person's recorded hours before a supervisor sees it.
The Act gives qualifying zero-hours, low-hours and agency workers rights to reasonable notice of shifts and to payment when shifts are cancelled, moved or cut short at short notice. The detail is being set in regulations and the start date isn't fixed yet. From March 2027, forcing major shift-pattern changes (days to nights, weekdays to weekends) through dismissal and re-engagement is also restricted. The scheduler works within each person's contract, and every shift change is logged with when it was notified.
Business customers' contracts set the delivery windows and what happens if one is missed, and where no time is fixed the Sale of Goods Act expects delivery within a reasonable time. The plan works to each order's agreed handover time, and customer service, not the system, tells customers about any change.
Crewing and attendance data is personal data, so there's a DPIA before the pilot. Ready-time predictions use station and crew-level data, not individual performance, which keeps the system from becoming a way of monitoring people. Decisions about individual workers' hours are made by supervisors, with the safeguards the automated decision rules require if that ever changes.
Showing AWSAzuresovereign / on-prem services. Switch with the toggle; every diagram and table on this page follows it.
01Channels
02Intake
03Intelligence
04Orchestration
05Systems of record
06People
| Layer | AWS | Azure | Sovereign / on-prem |
|---|---|---|---|
| Intake: orders, events, historyStart with the timestamps you already have. Discovery checks whether stations really scan at start and finish, or at the end of the shift. | API Gateway, Kinesis Data Streams, S3 | API Management, Event Hubs, Azure Data Lake Storage | Kong or your existing API gateway; Apache Kafka; Ceph or IONOS S3 Object Storage |
| Ready-time predictionGradient-boosted models predicting a range (likely and late), not a single time, per station and product. Amazon Forecast is closed to new customers, so it isn't used. | Amazon SageMaker AI | Azure Machine Learning | MLflow and Kubeflow on Kubernetes |
| Schedule optimiserThis is optimisation, not generative AI. Machine safety, maintenance, quality and working time rules are hard constraints; cost, overtime and waste are what it trades off. | An open-source constraint solver (e.g. OR-Tools or Timefold) on AWS Batch or ECS | An open-source constraint solver (e.g. OR-Tools or Timefold) on Azure Batch or Container Apps | An open-source constraint solver (e.g. OR-Tools or Timefold) on Kubernetes |
| Replan explanations and draftsThe only generative step. It explains each option in plain words and drafts customer and supervisor notes for a person to send. | Amazon Bedrock | Microsoft Foundry | Open-weight models served with vLLM on your own GPUs, or IONOS AI Model Hub |
| Agent runtimeThe original Bedrock Agents closed to new customers on 30 July 2026; new builds use AgentCore. | Amazon Bedrock AgentCore | Foundry Agent Service | An open-source agent framework (e.g. LangGraph) on Kubernetes |
| WorkflowRuns each replan from trigger to approval to publish, with timeouts if nobody responds. | AWS Step Functions | Logic Apps or Durable Functions | Temporal, or n8n |
| Middleware and events | Amazon EventBridge, SQS | Event Grid, Service Bus | Apache Kafka or RabbitMQ |
| Link to ERP and MESThe approved plan is published to the MES as a versioned plan. Nothing writes to production tables directly. | Through your ERP and MES suppliers' published APIs, or your existing integration layer | Through your ERP and MES suppliers' published APIs, or your existing integration layer | Through your ERP and MES suppliers' published APIs, or your existing integration layer |
| Human reviewPlanners approve where they already work. If there's no planning board today, a simple approval screen is part of the build. | In the planners' existing planning board or MES screens | In the planners' existing planning board or MES screens | In the planners' existing planning board or MES screens |
| GuardrailsThe real guardrail is the constraint library: the model can explain a plan but can't change a limit. | Bedrock Guardrails | Foundry guardrails (Azure AI Content Safety) | Open-source guardrails (e.g. NeMo Guardrails, Llama Guard) |
| Identity, keys, data protectionOnly planners can publish a plan; only the quality and health and safety lead can change a safety or quality limit. | IAM Identity Center, KMS, Macie | Entra ID, Key Vault, Purview | Keycloak or your existing Active Directory; OpenBao or HashiCorp Vault; an HSM |
| Monitoring and auditLog every prediction, every option offered, every approval and override with its reason, and every shift change with when it was notified. | CloudWatch, CloudTrail | Azure Monitor, Log Analytics | Prometheus, Grafana, OpenTelemetry |
| UK data residencyProduction data is less sensitive than staff data. Keep rostering and attendance data in the UK. | eu-west-2 (London) | UK South / UK West | Your own UK data centre, or a UK or EU provider |
On a phone, the table shows the platform you pick. Sovereign / on-prem means open, portable components you can run in your own data centre or with a UK or European provider; IONOS is shown as one example, and others exist. What sovereign cloud means →
Many organisations keep core systems and sensitive data on their own servers. This is how the same design works across both.
Stays on-prem
Machine and line control, the MES, test and inspection equipment and label printers stay on site, along with the approved plan the floor is working to. Many manufacturers also run their ERP on their own servers, and nothing here needs it to move.
Uses cloud AI
Model training, the optimiser runs and the replan assistant can run in AWS or Azure. For the sovereign option, all of it runs on your own servers: the optimiser doesn't need GPUs, and the explanation model is small.
How they connect
A private link (AWS Direct Connect or Azure ExpressRoute), or a site VPN for smaller plants, through the API layer. Shop-floor events go out and replan options come back. Only the planner's approval sends a plan to the MES.
If the link drops
The factory keeps running on the last approved plan. Planners replan by hand for the gap, as they do today, and events queue on site until the link returns. A plant that can't accept that can run a copy of the optimiser on a local server.
What each agent may do through its tools, what it may not, and where a person signs off. The limits are enforced by the platform, not the prompt.
Replan assistant
Where a person signs offA planner approves every plan before it reaches the MES. A supervisor decides every staff change and tells the people affected. Only the quality and health and safety lead can change a safety or quality limit. The agent's permissions are enforced by the platform's identity and policy controls, not by instructions in a prompt.
The ERP stays the record for orders, bills of materials and stock, and the MES stays the record for what each line is doing. Orders and amendments arrive by EDI into the ERP as they do now, and changes reach the scheduler as events. The scheduler never edits an order; it plans around it.
Shop-floor events drive the replanning: a station starting or finishing a batch, a line stopping, a changeover starting, a delivery being received. Each becomes a message on a queue. If the cloud side is slow, events wait safely, and every message carries an ID, so a retry never counts a batch twice.
The approved plan is published to the MES as a numbered version and held on site. The floor always runs on the last approved plan. If the scheduler is switched off, planners go back to building the plan themselves, exactly as they did before.
Traceability isn't a separate project. Batch and lot links are written at each station as they are today, and the scheduler reads them, so a replan never breaks the chain from supplier delivery to customer dispatch.
Map the stations and the flow, measure today's on-time rate and waste, check the quality of shop-floor timestamps, and collect every safety, quality and working time rule the plan must respect.
Gate · must be true to passBaseline agreed, timestamp gaps known, constraint library drafted with the quality and health and safety lead, DPIA started.
One product family, in shadow mode: the system predicts and proposes, planners plan as normal, and the two are compared each day.
Gate · must be true to passReady-time predictions within agreed limits, no option that breaks a constraint, planner and quality and health and safety sign-off.
Planners approve live replans for the pilot family, with monitoring, support and a rollback plan.
Gate · must be true to passMonitoring, support model, rollback plan and planner and supervisor training in place.
Add product families and stations one at a time, then link in the evening plan build and supplier delivery timing.
Gate · must be true to passEach new family passes the same pilot gate.
| Activity | Operations director | Planning manager | Solutions architectI can fill this | Technical PMI can fill this | EngineersI can fill this | Quality & H&S lead | HR & DPO | SecurityI can fill this |
|---|---|---|---|---|---|---|---|---|
| Business case and benefits | Accountable | Responsible | Consulted | Consulted | Informed | Consulted | Informed | Informed |
| Target architecture, ERP and MES integration | Informed | Consulted | Accountable and Responsible | Consulted | Consulted | Consulted | Informed | Consulted |
| Constraint library and safety review | Consulted | Consulted | Consulted | Informed | Consulted | Accountable and Responsible | Informed | Informed |
| Working time and staff-change rules, DPIA | Consulted | Consulted | Consulted | Informed | Informed | Consulted | Accountable and Responsible | Consulted |
| Build and integration | Informed | Consulted | Accountable | Responsible | Responsible | Consulted | Informed | Consulted |
| Shadow testing on real orders | Informed | Accountable | Responsible | Responsible | Responsible | Consulted | Informed | Informed |
| Go-live decision | Accountable | Responsible | Consulted | Responsible | Informed | Consulted | Consulted | Consulted |
| Run, monitor and improve | Informed | Accountable | Consulted | Consulted | Responsible | Consulted | Consulted | Consulted |
R ResponsibleA AccountableC ConsultedI Informed· not involved
Option A
If there's no architect on the programme, I'd own the design end to end: the prediction and optimisation design, the integration with your ERP, MES and EDI flows, and the gates, working closely with your quality and health and safety leads. I've built a just-in-time order management system for goods that couldn't be stored, coordinating any number of production steps or stations so final assembly happened exactly when each order was ready for handover. I'd report to your programme board.
Option B
If your partner or your own team already has an architect, I'd take on the scheduling engine and the ERP and MES integration under their lead: the part where timing, events and systems of record have to agree. I'd also give them a second senior opinion on the constraint design and the rollback plan.
Goes wrong
The model learns from timestamps that are wrong, because stations scan at the end of a batch or the end of a shift.
How the design avoids it
Check timestamp quality in discovery, fix the scanning before the pilot, and predict a range, not a single time.
Goes wrong
The optimiser treats a maintenance window or a machine check as a cost to trade off when the day gets tight.
How the design avoids it
Machine safety, maintenance, quality and working time rules are hard constraints in a library the quality and health and safety lead owns. The optimiser can't relax them.
Goes wrong
The plan changes every few minutes, so the floor stops trusting it and goes back to the whiteboard.
How the design avoids it
Freeze windows per station and a threshold for what reaches the planner. Small slips are absorbed, not replanned.
Goes wrong
The plan only lives in the cloud, so a network outage stops the factory.
How the design avoids it
The approved plan is held on site in the MES. The floor never waits on the AI.
Goes wrong
Staff get moved around at short notice because the algorithm found it cheapest.
How the design avoids it
Supervisors decide every staff change, every notice is logged, and short-notice changes are a KPI that has to fall.
Changes already announced or under way that affect this design. More in the UK horizon scan.
Log when every shift change is notified and to whom, and make the notice threshold a setting, so the rules can be applied on the day they start without a rebuild.
Keep the scheduler inside each person's contracted pattern. Pattern changes go through HR, not through the plan.
Keep staff data out of the prediction models, keep people deciding staff changes, and keep the decision log in a form you could show a regulator or a staff representative.
Good answers are specific. Vague answers to any of these are worth following up.
Whether you need someone to lead the design or to support the architect you already have, let's talk it through.
