Billing exceptions worked in order of harm, not age. Back-billing and smart-mode clocks never missed, plain letters drafted for every case, and a person deciding every catch-up bill, debt step and action for a vulnerable customer.
At a glance
An illustrative scenario. The numbers are typical examples, not a client case study. The cloud services and UK rules were checked on 9 November 2026.
Every billing run throws out exceptions. Reads fail validation. Smart meters stop sending reads and fall back to traditional mode, so bills are estimated. Meter exchanges leave the old and new readings out of step. Consumption looks impossible: a stuck register, a meter recording backwards, or two flats' meters crossed. Some accounts have been estimated for a year. Each case sits in a queue, mostly worked in date order, by analysts who piece the story together from the billing system, the meter's communications log and industry data flows.
Date order is the wrong order. A recent exception for a customer on the Priority Services Register, or one where a smart prepayment meter can't receive top-ups, matters more than an old one on an account that will correct itself at the next read. Meanwhile the back-billing clock runs. Once energy used is more than 12 months old and unbilled through the supplier's fault, it generally can't be charged to a domestic customer. The customer still gets a large catch-up bill for the last 12 months, which is where complaints, debt and harm begin.
The rules are tightening around this work. Since May 2026, the post-2025 smart metering framework requires suppliers to take all reasonable steps to restore smart mode within 90 days of becoming aware a meter has dropped into traditional mode. Older communications hubs and SMETS1 meters are being replaced as 2G and 3G services end on the DCC's published timetable, which brings its own wave of communications failures. And market-wide half-hourly settlement requires every meter to be migrated by 7 May 2027, which changes the data billing depends on.
Agree these, and measure the baseline, before anything is built. Example targets are typical, not promises.
Unbilled energy that can no longer be charged because an exception wasn't fixed in time.
ExampleFalling, measured against last year
The long tail that drives estimated bills and large catch-ups.
ExampleDown by half
Share of meters that fell into traditional mode and were back in smart mode within 90 days of the supplier becoming aware.
ExampleRising every quarter
Median and largest catch-up bills issued after an exception is fixed.
ExampleFalling
How much analysts change drafted letters. Very high means it isn't helping; near zero can mean letters are approved unread.
ExampleStable, and reviewed weekly
Split out for Priority Services Register customers and prepayment customers.
ExampleFalling, and no group worse off
Cross-sector rules are on the UK regulation map.
Suppliers must treat each domestic customer fairly, give information that is complete, accurate and not misleading, and make extra effort for customers in vulnerable situations. Every letter is checked by a person, and vulnerability can raise a case's priority but never lower it.
Suppliers generally can't bill domestic and microbusiness customers for energy used more than 12 months before the bill, unless the customer behaved obstructively or manifestly unreasonably. The 12-month clock is a fixed rule in the workflow. Whether an exception to the rule applies is always a person's decision, with the evidence recorded.
PSR status and recorded needs shape how a case is handled: format of letters, nominee contacts, and extra care before any adverse step. The AI uses the PSR flag to raise priority and route to the vulnerability team. It never changes PSR data.
Repayment plans must take account of the customer's ability to pay, and involuntary prepayment installation has strict rules and protected groups. The AI never starts a debt step, sets a repayment plan or suggests prepayment. A trained person does, after speaking to the customer.
Suppliers with more than 20,000 domestic meter points must take all reasonable steps to restore smart mode within 90 days of becoming aware, and to replace legacy communications hubs and SMETS1 meters by 2033. Communications failures are tracked against that clock, with evidence of the steps taken.
Customers can take a complaint to the Energy Ombudsman after 8 weeks, or sooner with a deadlock letter. Each case keeps the evidence, the suggested cause, and the person's decision and reason, so complaints teams can answer quickly and accurately.
A catch-up bill or a debt step is a significant decision, and PSR records can include health data, which is special category. Since 5 February 2026 the strict limit on solely automated significant decisions applies mainly where special category data is involved. Here, the model only orders the queue, and a person makes every adverse decision. A DPIA covers the scoring and the use of PSR data.
Showing AWSAzuresovereign / on-prem services. Switch with the toggle; every diagram and table on this page follows it.
01Channels
02Intake
03Intelligence
04Orchestration
05Systems of record
06People
| Layer | AWS | Azure | Sovereign / on-prem |
|---|---|---|---|
| Intake: exceptions, reads, comms alertsTake exceptions from the billing platform as events, not a nightly spreadsheet. | API Gateway, EventBridge, S3 | API Management, Event Grid, Data Lake Storage | Kong or your existing API gateway; Apache Kafka; Ceph or IONOS S3 Object Storage |
| Data preparationJoin read history, the meter's communications log, exchange records and account flags into one view per meter point. | AWS Glue, Amazon Athena | Microsoft Fabric | Apache Spark on Kubernetes, with PostgreSQL |
| Priority and cause modelsSimple, explainable models first. Each score comes with its top reasons. Retrain as half-hourly settlement and new communications hubs change the data. | Amazon SageMaker AI | Azure Machine Learning | MLflow and Kubeflow on Kubernetes |
| Model monitoring and fairnessSageMaker Model Monitor and Clarify closed to new customers on 30 July 2026. Check monthly that PSR and prepayment customers aren't waiting longer. | Your own drift and fairness checks in the SageMaker AI pipeline | Azure Machine Learning model monitoring and responsible AI dashboard | Open-source monitoring on MLflow, with Prometheus and Grafana |
| Letter draftingBoth clouds offer a choice of models, including Claude. Drafts use approved templates and only the facts on the account. | Amazon Bedrock | Microsoft Foundry | Open-weight models served with vLLM on your own GPUs, or IONOS AI Model Hub |
| Templates and policies (retrieval)Approved letter templates, billing policies and the back-billing procedure, each with an owner and a version. | Bedrock Knowledge Bases | Foundry IQ, built on Azure AI Search | OpenSearch, or PostgreSQL with pgvector |
| Agent runtimeThe original Bedrock Agents closed to new customers on 30 July 2026; new builds use AgentCore. | Amazon Bedrock AgentCore | Foundry Agent Service | An open-source agent framework (e.g. LangGraph) on Kubernetes |
| Workflow and legal clocksBack-billing and 90-day smart mode clocks are rules, mirrored in the billing platform's own reports so they still run if the AI is off. | AWS Step Functions | Logic Apps or Durable Functions | Temporal |
| Link to the billing platformThe AI writes only tasks, notes and draft letters. Bills, payments and debt actions stay in the billing platform, done by people. | API Gateway, plus your existing integration platform if you have one | API Management, plus your existing integration platform if you have one | Kong or your existing API gateway, plus your existing integration platform if you have one |
| Human reviewPeople decide where they already work, not in a new screen. | In the analysts' existing billing workbench | In the analysts' existing billing workbench | In the analysts' existing billing workbench |
| Customer messagesOnly fixed templates go out without a person. Every generated letter is approved first. | Through your existing letter, email and SMS channels | Through your existing letter, email and SMS channels | Through your existing letter, email and SMS channels |
| GuardrailsBlocks amounts, dates or promises in a draft that aren't on the account, and any wording about debt collection or prepayment. | Bedrock Guardrails | Foundry guardrails (Azure AI Content Safety) | Open-source guardrails (e.g. NeMo Guardrails, Llama Guard) |
| Identity, keys, data protectionPSR needs are shared as categories the case needs, not full health details. | IAM Identity Center, KMS, Macie | Entra ID, Key Vault, Purview | Keycloak or your existing Active Directory; OpenBao or HashiCorp Vault; an HSM |
| Monitoring and auditLog every score, its reasons, every draft and every human decision with the reason. | CloudWatch, CloudTrail | Azure Monitor, Log Analytics | Prometheus, Grafana, OpenTelemetry |
| UK data residencyIONOS AI Model Hub runs in German data centres: EU, not UK, residency. | eu-west-2 (London) | UK South / UK West | Your own UK data centre, or a UK or EU provider |
On a phone, the table shows the platform you pick. Sovereign / on-prem means open, portable components you can run in your own data centre or with a UK or European provider; IONOS is shown as one example, and others exist. What sovereign cloud means →
Many organisations keep core systems and sensitive data on their own servers. This is how the same design works across both.
Stays on-prem
The billing and CRM platform, the metering and industry data flows, the DCC connection and the debt and collections system stay where they are, whether on your own servers or hosted by your billing system supplier. Nothing in this design needs them to move.
Uses cloud AI
The data lake, the priority and cause models, letter drafting and the exception assistant run in a UK cloud region, or on your own GPUs with open-weight models if customer data must stay in your estate. Only the fields each step needs are sent.
How they connect
Through the billing platform's API and the API layer, over AWS Direct Connect or Azure ExpressRoute. Exceptions flow out as events, and scores, tasks and draft letters come back as events onto your queue.
If the link drops
Analysts work the queue in the billing platform's own order, and the back-billing and smart mode clocks keep running in its own reports. Scoring and drafting catch up when the link returns, with nothing lost or done twice.
What each agent may do through its tools, what it may not, and where a person signs off. The limits are enforced by the platform, not the prompt.
Exception assistant
Where a person signs offA person approves every bill correction, catch-up bill, back-billing decision, direct debit change and debt step, and every action for a customer on the Priority Services Register or otherwise in a vulnerable situation. The assistant's permissions are enforced by the platform's identity and policy controls, not by instructions in a prompt.
The billing platform stays the record. Exceptions leave it as events, through its API or your existing integration platform, and are joined with read history, the meter's communications log and industry data flows in the data lake. Everything carries the meter point and account reference, so a retry never creates a duplicate task or letter.
Scoring runs each night across the whole queue, and again whenever a new exception or a new read arrives. Scores, suggested causes and draft letters go back into the analysts' existing workbench as tasks. The AI never writes a bill, a payment or a debt action.
The legal clocks don't depend on the AI. The 12-month back-billing limit and the 90-day smart mode target run as rules in the workflow and in the billing platform's own reports. If the AI is paused, the queue falls back to those rules and date order, exactly as before.
Map the exception types and today's queue, measure the baseline, check data access to the communications log and read history, and pick two exception types.
Gate · must be true to passBaseline agreed, data access confirmed, DPIA started, compliance and the vulnerability lead involved.
Smart meters in traditional mode and long-running estimated bills, in shadow mode: the model scores and drafts, analysts work as normal, and the two are compared.
Gate · must be true to passPriority agrees with experienced analysts' judgement, no customer group waits longer, letters pass compliance review, and nothing breaches the legal clocks.
Scores and drafts go live for the two exception types, with monitoring, support and a rollback plan.
Gate · must be true to passMonitoring, fairness checks, rollback plan and analyst training in place.
Add meter exchanges, crossed meters and suspected faulty meters, then reuse the pattern for half-hourly settlement exceptions.
Gate · must be true to passEach new exception type passes the same pilot gate.
| Activity | Billing operations director | Product owner | Solutions architectI can fill this | Technical PMI can fill this | EngineersI can fill this | Data scientist | Compliance & DPO | Vulnerability lead |
|---|---|---|---|---|---|---|---|---|
| Business case and benefits | Accountable | Responsible | Consulted | Consulted | Informed | Consulted | Consulted | Consulted |
| Target architecture and billing integration | Informed | Consulted | Accountable and Responsible | Consulted | Consulted | Consulted | Consulted | Informed |
| Priority and cause models | Informed | Consulted | Consulted | Informed | Consulted | Accountable and Responsible | Consulted | Consulted |
| DPIA, templates and Standards of Conduct review | Accountable | Consulted | Consulted | Informed | Informed | Informed | Responsible | Consulted |
| Build and integration | Informed | Consulted | Accountable | Responsible | Responsible | Consulted | Informed | Informed |
| Shadow testing and fairness checks | Informed | Accountable | Consulted | Responsible | Responsible | Responsible | Consulted | Consulted |
| Go-live decision | Accountable | Responsible | Consulted | Responsible | Informed | Consulted | Consulted | Consulted |
| Run, monitor and improve | Informed | Accountable | Consulted | Consulted | Responsible | Responsible | Consulted | Consulted |
R ResponsibleA AccountableC ConsultedI Informed· not involved
Option A
If there's no architect on the programme, I'd own the design end to end: the event flow out of your billing platform, the data joins, how the models and drafting fit the analysts' workbench, the legal clocks, and the gates. I'd work closely with your compliance and vulnerability leads and report to your programme board.
Option B
If your partner, your billing system supplier or your own team already has an architect, I'd take on the integration with the billing platform, the workflow and the drafting under their lead, and give them a second senior opinion on how the models are explained, monitored and kept fair.
Goes wrong
The model learns that some customers' cases are 'low value' and pushes them down the queue.
How the design avoids it
Vulnerability can only raise priority, and a monthly check compares waiting times by customer group.
Goes wrong
A back-billing deadline passes because the model scored the case low.
How the design avoids it
Legal clocks are fixed rules that escalate on time, outside the model, and run in the billing platform too.
Goes wrong
Drafted letters state amounts or dates that aren't right.
How the design avoids it
Drafts use only the facts on the account, guardrails block anything else, and a person approves every generated letter.
Goes wrong
Analysts approve drafts and suggested causes without checking.
How the design avoids it
Evidence shown beside every suggestion, an edit-rate measure, and a weekly sample review.
Goes wrong
Half-hourly data and new communications hubs change the patterns, and the model drifts.
How the design avoids it
Monitor drift monthly, plan retraining around the migration deadline, and keep the rules as a safety net.
Changes already announced or under way that affect this design. More in the UK horizon scan.
Expect new exception types and different read patterns. Plan retraining and new checks before the deadline, not after.
Track communications failures by cohort, so a wave of meters going into traditional mode is seen and staffed for before it reaches billing.
Make sure billing complaints can be answered from the case record within 6 weeks.
Keep debt and prepayment steps out of the AI's reach, and design the workbench so new protections are a rule change, not a rebuild.
Keep the scoring reasons, the decision log and the human review records in a form you could show the ICO.
Good answers are specific. Vague answers to any of these are worth following up.
Whether you need someone to lead the design or to support the architect you already have, let's talk it through.
