"Onboard EU clients three times faster without growing headcount at the same rate."
Shipped: 4.2 hours to 1.4 hours per audit.
Case study · 2025 · Marsh McLennan CIS · Germany / Amsterdam
Project Aura
When commercial insurance clients send ESG paperwork, someone still has to read it. At CIS that someone was an analyst, four hours a case. I was asked to make it faster. The real brief was to make it trustworthy enough to sign.
65%Audit time cut, 4.2h to 1.4h
40%More anomalies caught
4.8AI-SUS trust score out of 5
0Backend rewrites required
The problem
Four hours a case. Every case. Every quarter.
Analysts opened a PDF, found Scope 2 emissions on page 34, typed it into a 15-year-old system, then did it again. Transcription errors sat around 23%. CSRD was about to turn those errors from an ops headache into a legal one.
Leadership wanted 3x client onboarding without hiring in lockstep. Legal wanted zero hallucination, full stop. Engineering wanted an overlay, not a rewrite. If I missed any of those, the product would die in review.
The insight that stuck: analysts did not fear slow AI. They feared signing a number they could not trace to a page.
"If it cannot be traced to a cited internal document, it is a liability."
Shipped: closed-loop RAG, source-pinned, human approved before commit.
"Do not touch the legacy database. API overlay only."
Shipped: read/write layer. Engineers signed off in sprint 2.
People
Three people. Three meanings of "this works."
The AI was not the hard part. Sarah needed to verify. Thomas needed throughput he could defend. Julian needed an immutable log. Miss one and the whole thing gets rejected.
Senior Risk Analyst
"If I cannot verify where that number came from, I cannot sign. I do not care how fast it is."
Needs: inline citations, confidence next to every value, one click to the exact PDF page.
CIS Lead
"Show me bottlenecks. Tell me if AI is speeding work, or just moving it around."
Needs: pipeline velocity, override rates, weekly quality delta versus manual audits.
EU Compliance
"Every AI decision, every override, every source. Exportable for a regulator."
Needs: GDPR, CSRD, SFDR trail. Append-only. Named analyst. Timestamped.
Process
I had to change the process for this one.
Standard Double Diamond assumes you can predict the output. Aura is probabilistic. I treated model behaviour as a design material, the same way I treat a constraint.
Discover
Three weeks embedded with analysts. Shadow sessions, data audit, an AI readiness score before any UI love.
Define
Intent maps across 240 audit sessions. Named the exact moments autonomy must yield to judgment.
Design
Explainability seams: reasoning, confidence, and source as first-class UI, not a tooltip afterthought.
Test
Wizard of Oz before the model. We planted a 5% calculation error to test automation bias. 100% of analysts caught it.
Between Define and Design I added a calibration loop: audit real document sets, map failure modes, then set the confidence thresholds that switch the UI. That stops you designing for a perfect model that will never show up.
Architecture
Why the data never leaves.
I pushed for closed-loop RAG early. Under GDPR, client emissions data hitting an external API is an egress problem. If the model can only reason about documents already inside the private cloud, hallucination becomes a structural issue, not a prompt issue.
01. Retrieve, then speak
If a figure is not in the indexed source, Aura returns "No verified source found." It never invents a number to be helpful.
02. Three agent tracks
Extraction, comparison, compliance check. Separate confidence rules, so one failure does not paint the whole screen green.
03. Human approval gate
Nothing writes to the legacy system until a named analyst approves. That click is the audit trail Julian asked for.
What changed
Measured, not claimed.
65%Time, Jira tracking, n=47 audits
40%Anomaly rate, 6-month compliance review
3×Onboarding throughput, no extra headcount
£0Backend spend. Overlay only.
Tooling stayed inside enterprise licences: Figma AI Enterprise, ProtoPie, Azure OpenAI in EU region, Dovetail, Maze. Legal blocked consumer AI on client data. That constraint made the design better.