Every repair reaches the right trade, with the right parts and the right priority, at an appointment that suits the tenant. Fixed rules handle emergencies, and a person decides anything that might be a hazard.
At a glance
An illustrative scenario. The numbers are typical examples, not a client case study. The cloud services and UK rules were checked on 9 November 2026.
A tenant reports a leak under the sink. The contact centre picks a code from a list of several hundred, often the nearest one rather than the right one. The job goes to a plumber with a standard two-hour slot and no idea what part is needed. The plumber finds a cracked waste pipe behind the kitchen unit that needs a joiner first, or a tap cartridge that isn't on the van. The tenant takes another day off work, and the job is reopened.
Across a large landlord, this adds up. A typical repairs service fixes around two thirds of jobs on the first visit. Every return visit costs an operative's time, a second appointment and the tenant's patience, and it shows in the Tenant Satisfaction Measures and in complaints. Planners spend their mornings rearranging diaries by hand around no-access visits, emergencies and contractors who don't update the system until days later.
The stakes are higher now. A repair report can also be the first sign of a hazard. Since 27 October 2025, Awaab's Law sets fixed timescales for emergency hazards and damp and mould once the landlord is aware of them, and from 30 November 2026 it covers more hazards, including excess cold, falls, electrical hazards and fire. The repairs front door is where the landlord most often becomes aware. Getting triage right is no longer only about efficiency; it decides whether the legal clock is recognised on day one.
Agree these, and measure the baseline, before anything is built. Example targets are typical, not promises.
Share of repairs completed on the first visit, with no follow-on job within 30 days.
ExampleFrom about two thirds to over 80%
Share of jobs where the trade, job code and priority didn't need changing after the visit.
ExampleAbove 90%, checked weekly against operative feedback
Reports matching the hazard rules that reached a competent person on the day they arrived.
ExampleEvery one
The Tenant Satisfaction Measure for emergency and non-emergency repairs completed within target.
ExampleUp, measured against last year
How often advisers and planners change the suggestions. Very high means it isn't helping; near zero can mean people have stopped checking.
ExampleStable, and reviewed weekly
Satisfaction with the last repair and the time taken, split by channel and by households with recorded vulnerabilities.
ExampleUp, and no group worse off
Cross-sector rules are on the UK regulation map.
The clock starts when the landlord becomes aware of a potential hazard, usually the moment a report arrives. Emergency hazards must be investigated and made safe within 24 hours. Significant hazards must be investigated within 10 working days, with a written summary within 3 working days and safety work within 5 working days. The repairs system records the time each report arrived. The models never decide whether something is a hazard, and they can't hold a report back.
Triage is part of the initial determination, not a separate step, and must take account of the household's circumstances. The guidance allows an investigation to be done remotely when photos or videos let a competent investigator decide, and the tenant can always ask for an in-person visit. So tenant photos go to the competent person with the report. The vision model helps them find the right photo, but the judgement is theirs.
The updated HHSRS has 21 hazards and three bands. The fixed hazard rules map repair types to the hazards they could indicate, such as exposed wiring, a broken stair or no heating. The rules are approved by a person and change only under change control. Phase 2 of Awaab's Law, from 30 November 2026, makes many more repair types possible hazards.
Landlords must provide an effective, efficient and timely repairs service, keep tenants informed, and report the Tenant Satisfaction Measures, including repairs completed within target. Online photo reporting is an extra channel, never the only one, so tenants who phone or can't use an app get the same service. The Transparency, Influence and Accountability Standard means tenants are told how their photos are used.
A repair request is a service request, not a complaint. But when a tenant says they're unhappy with how a repair is being handled, the Code says a complaint must be raised, even while the repair continues. The assistant flags signs of dissatisfaction to the adviser, who logs the complaint. Stage 1 complaints must be acknowledged within 5 working days and answered within 10 working days of acknowledging.
Tenant photos often show people, children, medicines or belongings. That means a DPIA before the pilot, telling tenants what photos are used for, keeping them with the repair record for a set period, processing in UK regions, and a contract that stops providers training their models on them. Under the rules in force since 5 February 2026, the safeguards for automated decisions still apply, so a person can always review a priority or appointment, and a tenant can challenge it.
Showing AWSAzuresovereign / on-prem services. Switch with the toggle; every diagram and table on this page follows it.
01Channels
02Intake
03Intelligence
04Orchestration
05Systems of record
06People
| Layer | AWS | Azure | Sovereign / on-prem |
|---|---|---|---|
| Intake: reports, photos, contractor updatesStrip location data from photos on arrival, and resize them before any model sees them. | API Gateway, Amazon S3 | API Management, Blob Storage | Kong or your existing API gateway; Ceph or IONOS S3 Object Storage |
| Reading photosTest on real tenant photos: dark cupboards, blurred close-ups, the wrong room. Don't start new work on Azure Custom Vision (retires 25 September 2028) or Amazon Lookout for Vision (ended). | Multimodal models in Amazon Bedrock; Bedrock Data Automation for image descriptions | Multimodal models in Microsoft Foundry; Azure Content Understanding for image descriptions | An open-weight vision model served with vLLM on your own GPUs |
| Triage reasoningBoth clouds offer a choice of models, including Claude. The output is a suggested trade, job code, priority and parts list, each with a reason. | Amazon Bedrock | Microsoft Foundry | Open-weight models served with vLLM on your own GPUs, or IONOS AI Model Hub |
| Fixed emergency and hazard rulesPlain, versioned rules owned by the repairs and compliance leads. They run before and after the models, and the models can only add to them. | Rules held in DynamoDB and run in Lambda | Rules held in Azure SQL and run in Azure Functions | An open-source rules engine (e.g. Drools) |
| Job codes and repair guidance (retrieval)The schedule of rates, repair responsibilities and the asset register, so suggestions use your codes and your boiler models. | Bedrock Knowledge Bases | Foundry IQ, built on Azure AI Search | OpenSearch, or PostgreSQL with pgvector |
| Agent runtimeThe original Bedrock Agents closed to new customers on 30 July 2026; new builds use AgentCore. | Amazon Bedrock AgentCore | Foundry Agent Service | An open-source agent framework (e.g. LangGraph) on Kubernetes |
| Routes and diary optimisationIf you already have a scheduling tool, the agent books through it rather than replacing it. Azure Maps Route v1 retires on 31 March 2028. | Amazon Location Service (Routes), with an open-source solver (e.g. OR-Tools) on AWS Lambda or ECS | Azure Maps Route (2025-01-01 version), with an open-source solver (e.g. OR-Tools) on Azure Container Apps | Open-source routing on OpenStreetMap data (e.g. Valhalla) and an open-source solver (e.g. OR-Tools) |
| Workflow and events | AWS Step Functions, EventBridge, SQS | Logic Apps or Durable Functions, Event Grid, Service Bus | Temporal, Apache Kafka or RabbitMQ |
| Tenant messagesAppointment confirmations and reminders only, from approved templates. | AWS End User Messaging (SMS) | Azure Communication Services (SMS) | Your existing SMS provider |
| Link to the repairs systemAgree in discovery what your repairs system supplier's API allows: raising jobs, booking slots, attaching photos. | API Gateway, plus your existing integration platform if you have one | API Management, plus your existing integration platform if you have one | Kong or your existing API gateway, plus your existing integration platform if you have one |
| Guardrails | Bedrock Guardrails | Foundry guardrails (Azure AI Content Safety) | Open-source guardrails (e.g. NeMo Guardrails, Llama Guard) |
| Identity, permissions, keysContractors see only their own jobs and the photos attached to them. | IAM Identity Center, Amazon Verified Permissions, KMS | Entra ID, Azure RBAC, Key Vault, Purview | Keycloak or your existing Active Directory; OpenBao or HashiCorp Vault; an HSM |
| Monitoring and auditLog the report time, every suggestion, every rule that fired, every change and who made it. | CloudWatch, CloudTrail | Azure Monitor, Log Analytics | Prometheus, Grafana, OpenTelemetry |
| UK data residencyIONOS AI Model Hub runs in German data centres: EU, not UK, residency. Check where map and routing requests are processed. | eu-west-2 (London) | UK South / UK West | Your own UK data centre, or a UK or EU provider |
On a phone, the table shows the platform you pick. Sovereign / on-prem means open, portable components you can run in your own data centre or with a UK or European provider; IONOS is shown as one example, and others exist. What sovereign cloud means →
Many organisations keep core systems and sensitive data on their own servers. This is how the same design works across both.
Stays on-prem
The repairs and housing management system, the operative scheduling tool, van stock and the asset register stay where they are. Many landlords run these on their own servers or with a hosted supplier, and nothing in this design needs them to move.
Uses cloud AI
Photo reading, triage suggestions, the job-code index and the scheduling agent can run in AWS or Azure, or on your own GPUs with open-weight models if tenant photos must not leave your estate. Only the report text, the photos and the property's component details are sent, not the tenant's wider record.
How they connect
A private link (AWS Direct Connect or Azure ExpressRoute) and the API layer. Suggestions come back to the adviser's screen, and bookings go into the repairs system through its API, so the system of record stays the only place a job lives.
If the link drops
Reports are still taken and logged in the repairs system with the time they arrived, so the Awaab's Law clock is unaffected. The fixed emergency rules run on your side, advisers pick job codes and book slots as they did before, and photos queue for reading when the link returns.
What each agent may do through its tools, what it may not, and where a person signs off. The limits are enforced by the platform, not the prompt.
Triage assistant
Where a person signs offThe adviser confirms every job before it's raised. A competent person decides every possible hazard. The agent's permissions are enforced by the platform's identity and policy controls, not by instructions in a prompt.
Scheduling agent
Where a person signs offPlanners approve each day's routes and any change to emergency or hazard jobs. A person decides every no-access closure and every contractor variation.
The repairs and housing management system stays the record for every job. Reports from every channel are logged there first, with the time they arrived, before any model runs. The AI suggests and books through an API layer. If you already run an integration platform, the AI uses it like any other system.
Contractors connect through events, not shared logins. A job raised for a contractor becomes a message with an ID. The contractor's system sends back accepted, appointed, attended, completed or no-access, with photos. If a contractor's system is down, messages wait on the queue and nothing is lost or sent twice. Contractors who can't integrate use a simple web form that sends the same events.
The fixed emergency and hazard rules run in the workflow, outside the models. If a model is slow, wrong or switched off, the rules still put a gas smell, exposed wiring or no heating for a vulnerable household at the front of the queue.
The AI can be switched off without stopping the repairs service. If it's paused, advisers choose job codes and book slots exactly as they did before.
Map today's repairs process, measure first-time fix and triage accuracy, agree the repairs system route, and draft the fixed rules with the repairs and compliance leads.
Gate · must be true to passBaseline agreed, supplier route confirmed, fixed rules approved, DPIA started.
Online reports with photos for two trades, in shadow mode: the AI suggests, advisers work as normal, and the two are compared. Then booking for the same trades.
Gate · must be true to passTriage accuracy within agreed limits, every possible hazard reached a person on day one, no group worse off, and sign-off from the head of repairs.
Suggestions and booking go live for the pilot trades, on the web, app and phone, with monitoring, support and a rollback plan.
Gate · must be true to passMonitoring, support model, rollback plan and training for advisers and planners in place.
Add trades one at a time, then contractors through events, then route optimisation for in-house operatives.
Gate · must be true to passEach new trade or contractor passes the same pilot gate.
| Activity | Director of property | Product owner | Solutions architectI can fill this | Technical PMI can fill this | EngineersI can fill this | Head of repairs | Compliance & DPO | SecurityI can fill this |
|---|---|---|---|---|---|---|---|---|
| Business case and benefits | Accountable | Responsible | Consulted | Consulted | Informed | Consulted | Informed | Informed |
| Target architecture and repairs system integration | Informed | Consulted | Accountable and Responsible | Consulted | Consulted | Consulted | Consulted | Consulted |
| Fixed emergency and hazard rules | Accountable | Consulted | Consulted | Informed | Consulted | Responsible | Consulted | Informed |
| DPIA and photo handling | Informed | Consulted | Consulted | Informed | Informed | Consulted | Accountable and Responsible | Consulted |
| Build, integration and contractor events | Informed | Consulted | Accountable | Responsible | Responsible | Consulted | Informed | Consulted |
| Accuracy testing on real reports | Informed | Accountable | Responsible | Consulted | Responsible | Responsible | Informed | Informed |
| Go-live decision | Accountable | Responsible | Consulted | Responsible | Informed | Consulted | Consulted | Consulted |
| Run, monitor and improve | Informed | Accountable | Consulted | Consulted | Responsible | Responsible | Consulted | Consulted |
R ResponsibleA AccountableC ConsultedI Informed· not involved
Option A
If there's no architect on the programme, I'd own the design end to end: the triage and scheduling agents, the fixed rules alongside them, the integration with your repairs system and contractors, and the gates. I'd report to your programme board.
Option B
If your partner or your own team already has an architect, I'd take on the photo triage, the agents and the contractor events under their lead, and give them a second senior opinion on the repairs system integration and the Awaab's Law controls.
Goes wrong
The model decides a photo doesn't show a hazard, and nobody looks.
How the design avoids it
Models can only raise a priority. Fixed rules route possible hazards to a competent person, and the clock runs from the report.
Goes wrong
The demo used clear photos. Real ones are dark, blurred or of the wrong room.
How the design avoids it
Pilot on last quarter's real reports, and let the assistant ask for a better photo rather than guess.
Goes wrong
Photo reporting quietly becomes the only fast route, and phone callers wait longer.
How the design avoids it
Advisers get the same suggestions on the phone, and outcomes are measured by channel.
Goes wrong
The scheduling agent fills diaries but moves emergency jobs to fit.
How the design avoids it
Emergency and hazard jobs are locked, and the agent has no permission to move them.
Goes wrong
Contractor updates arrive days late, so the landlord can't see Awaab's Law timescales.
How the design avoids it
Events with IDs, a simple fallback form, and contract terms that require timely updates.
Changes already announced or under way that affect this design. More in the UK horizon scan.
Update the fixed hazard rules, adviser prompts and contractor terms before 30 November. Many everyday repairs, such as no heating or a broken stair, become possible hazards.
Keep the hazard rules as data owned by people, not logic buried in prompts, so adding hazards is a change to a table.
Expect repairs performance to be published and questioned. Make sure the timestamps and outcomes the system records are accurate enough to publish.
Keep the suggestions, the rules that fired and the human decisions in a form you could show the ICO.
Use the repairs data to spot components that keep failing, and feed it into the planned investment programme.
Good answers are specific. Vague answers to any of these are worth following up.
Whether you need someone to lead the design or to support the architect you already have, let's talk it through.
