{"id":201,"date":"2026-10-06T18:59:54","date_gmt":"2026-10-06T18:59:54","guid":{"rendered":"https:\/\/blog.forfis.com\/blog\/uk-medtech-ai-monthly-reporting-on-premise\/"},"modified":"2026-10-06T18:59:54","modified_gmt":"2026-10-06T18:59:54","slug":"uk-medtech-ai-monthly-reporting-on-premise","status":"publish","type":"post","link":"https:\/\/blog.forfis.com\/blog\/uk-medtech-ai-monthly-reporting-on-premise\/","title":{"rendered":"UK Medtech Firm Cuts Monthly HR Reporting from 14 Hours to 3 with On-Premise AI"},"content":{"rendered":"

Background: A 1,200-Person UK Medtech Firm<\/h2>\n

This case study is a composite drawn from patterns Forfis has observed across multiple engagements in the UK healthcare and medtech sector. No named customer is represented; the details are aggregated and anonymised to preserve confidentiality while preserving the operational specifics that matter to a peer reader.<\/p>\n

The company in question is a mid-sized medtech firm with roughly 1,200 employees, headquartered in the West Midlands. It operates in the AI-Native Operations maturity band: leadership has already committed to embedding AI into core workflows, but the execution layer is still catching up. The existing stack includes a commercial HRIS, a CRM for partner and client records, and a document management system for regulatory filings. The firm holds ISO 27001 certification and is subject to UK GDPR, which constrains where and how employee and patient-adjacent data can be processed.<\/p>\n

The trigger for the engagement was straightforward. The monthly HR and recruiting report, which feeds into the board pack and the quarterly investor update, was taking the HR operations team approximately 14 hours to assemble by hand. The report pulled headcount data, time-to-fill metrics, offer acceptance rates, and attrition figures from three separate systems, then required a narrative summary that the HR director reviewed line by line. The process was error-prone, slow, and dependent on a single analyst who was also covering day-to-day recruiting operations.<\/p>\n

Challenge: 14 Hours of Manual Work and an ISO 27001 Audit Clock<\/h2>\n

The operational pressure was not just the 14-hour cycle time. The HR director had flagged two compounding risks. First, the manual process had produced two material errors in the preceding six months: a misreported attrition figure that required a corrected board pack, and a time-to-fill metric that was off by a full week due to a date-format mismatch between the HRIS and the spreadsheet. Second, the firm was preparing for an ISO 27001 surveillance audit, and the manual reporting process, with its reliance on a single analyst and unversioned spreadsheets, was a known weakness in the information security management system documentation.<\/p>\n

The compliance constraint shaped the technical requirements from the outset. Employee data, including names, roles, and performance-adjacent metrics, could not be sent to a third-party cloud API. The firm\u2019s data protection officer required that any AI processing of HR data occur on infrastructure within the company\u2019s own network perimeter. This ruled out a simple SaaS chatbot or a cloud-hosted LLM API for the core reporting pipeline. The solution had to be a conversational agent and document-extraction layer running on open-weight models deployed on the client\u2019s own GPU hardware, with a custom REST API and webhook integration to the existing HRIS, CRM, and document management system.<\/p>\n

The timeline was fixed at three months, driven by the board\u2019s desire to see the new reporting process in place before the next quarterly cycle. That constraint meant the pilot had to be scoped tightly: one report type, one data source chain, one approval workflow.<\/p>\n

Approach: On-Premise Open-Weight Models and a Fixed-Scope Pilot<\/h2>\n

Forfis began with a two-week process audit. We mapped the reporting workflow end-to-end: which data points came from which system, what transformations were applied manually, where the narrative summary was drafted, and who approved the final document. The audit identified four distinct sub-processes: data extraction from the HRIS, data extraction from the CRM, metric calculation and formatting, and narrative generation. Each was scored on volume, error rate, and regulatory sensitivity.<\/p>\n

The pilot was scoped to the data extraction and metric calculation sub-processes, plus a retrieval-augmented generation layer for the narrative summary. The architecture used open-weight models (Llama 3 70B for extraction, Mistral 7B for classification) running on the client\u2019s own A100 GPU cluster. The integration layer was a custom REST API with webhooks: the HRIS pushed headcount and attrition data on a scheduled basis, the CRM pushed recruiting pipeline data, and the document management system received the final report via a webhook trigger. The conversational agent, accessible to the HR director and two senior HR managers, allowed them to query the underlying data in natural language and request specific report sections be regenerated.<\/p>\n

Human-in-the-loop approval was non-negotiable. The AI generated the draft report; the HR director reviewed and approved it before it was pushed to the board distribution list. Every approval was logged with a timestamp and user identifier, creating an audit trail that satisfied the ISO 27001 surveillance auditor. The pilot ran for one full reporting cycle, with the manual process running in parallel as a control.<\/p>\n

Outcome: Cycle Time Down to Under 3 Hours, Error Rate Down 70 Percent<\/h2>\n

The pilot results were measured against the baseline established during the audit. Cycle time dropped from approximately 14 hours to under 3 hours: the automated pipeline completed data extraction and metric calculation in about 40 minutes, the narrative generation took roughly 15 minutes, and the remaining time was spent on human review and approval. The error rate, measured as the number of corrections required after the report was first drafted, fell by approximately 70 percent. The two types of errors that had occurred in the prior six months (date-format mismatch and misreported attrition) did not recur in the pilot cycle.<\/p>\n

The ISO 27001 surveillance audit, conducted in the final month of the engagement, noted the new reporting pipeline as a positive finding. The audit trail for AI-generated outputs, the on-premise data processing, and the defined approval workflow addressed the specific weakness the auditor had flagged in the previous cycle. The firm\u2019s data protection officer confirmed that no regulated data had left the network perimeter during the pilot.<\/p>\n

Rollout extended the pipeline to cover the full monthly reporting suite, including the quarterly investor update. The managed operations contract began at the end of month three, covering model monitoring, integration health checks, and a defined escalation path for incidents. The HR operations team retained ownership of the business logic and approval workflow; Forfis handled the technical infrastructure and AI layer.<\/p>\n

Lessons for Similar Teams<\/h2>\n

Five lessons from this engagement generalise to similar teams in regulated, mid-sized organisations:<\/p>\n