This case study is a composite based on patterns observed across multiple engagements. It does not describe a named customer. The company profile, metrics, and timeline are representative of what Forfis has delivered in fintech and payments in Tier-1 markets.<\/p>\n
The client is a 1,200-person fintech<\/strong> operating in the UAE<\/strong>, processing approximately 40,000 payment-related contracts and invoices per month. The company is at the one-process-automated<\/strong> stage of AI maturity: they had piloted a basic OCR tool for invoice line-item extraction but had not integrated it into their review workflow. Their stack includes SAP S\/4HANA<\/strong> for ERP, Salesforce<\/strong> for CRM, and Confluence<\/strong> as the internal knowledge base for contract templates and review guidelines. The finance and accounting team of 85 people handled first-response triage manually: a reviewer opened each document, extracted key fields, checked them against the standard template, and logged the result. Median cycle time from document receipt to review completion was 14 business days<\/strong>, with a field-level error rate of 6.2%<\/strong>.<\/p>\n The finance director set a hard deadline: cut first-response time by at least 40% within two weeks<\/strong> of pilot launch, without increasing headcount. The pressure was operational, not strategic. The company was preparing for a PCI DSS Level 1<\/strong> re-assessment in Q3, and the assessor had flagged the manual contract review process as a potential gap in Requirement 3 (protection of stored cardholder data) because reviewers were handling documents containing PANs in unencrypted email threads. The compliance team needed a defensible, auditable process where cardholder data never left the client\u2019s infrastructure.<\/p>\n The specific need was less manual back-office work<\/strong> in the finance and accounting<\/strong> function, focused on contract review<\/strong> and document and data extraction pipelines<\/strong>. The company did not want to replace SAP or Salesforce. They wanted an AI layer that sat on top of the existing stack, extracted structured fields from contracts and invoices, scored each document for risk, and routed high-risk items to senior reviewers first. The 2-week timeline<\/strong> was non-negotiable because the PCI DSS re-assessment window was fixed. The pilot had to ship a measurable before\/after baseline on cycle time and error rate within that window.<\/p>\n Forfis ran a process audit<\/strong> in the first 72 hours, mapping the manual review workflow end-to-end and identifying the three highest-volume document types: payment service agreements, merchant onboarding contracts, and settlement invoices. The pilot scope was fixed to one document type<\/strong> (merchant onboarding contracts) and one integration point<\/strong> (Confluence for template retrieval, Salesforce for review status).<\/p>\n The architecture used open-weight models on-premise<\/strong>: a fine-tuned Mistral 7B<\/strong> for field extraction and a Llama 3 8B<\/strong> for clause-level risk scoring, both running on the client\u2019s own NVIDIA A100<\/strong> hardware inside the cardholder data environment. No document data transited a third-party API. The extraction pipeline parsed PDFs and scanned images, extracted 14 structured fields (parties, amounts, dates, penalty clauses, data-sharing terms), and assigned a predictive risk score<\/strong> from 0 to 100 based on clause deviation from the Confluence-stored standard template. A human-in-the-loop<\/strong> approval gate required a reviewer to sign off on any document with a risk score above 40 or any field touching payment terms. The integration sprint<\/strong> delivered the pipeline, the Confluence RAG connector, the Salesforce status webhook, and the baseline measurement dashboard in 10 business days.<\/p>\n The pilot ran for 10 business days on a sample of 1,800 merchant onboarding contracts. The measured results:<\/p>\n The pilot did not cover settlement invoices or payment service agreements. Those were scoped for the rollout phase. The 2-week window was met: the pipeline went live on day 10, and the baseline report was delivered on day 14.<\/p>\n Scope the pilot to one document type, not one business function.<\/strong> The client initially wanted all three document types in the 2-week window. Forfis pushed back and fixed the scope to merchant onboarding contracts. The result was a shippable, measurable pilot. Trying to cover three types would have produced a 6-week project with no baseline.<\/p>\n<\/li>\n On-premise open-weight models are not a quality compromise for structured extraction.<\/strong> The Mistral 7B, fine-tuned on 400 labeled contracts, matched the manual extraction accuracy on 12 of 14 fields. The two fields where it trailed (Hijri date parsing, multi-currency amount normalization) were exactly the fields where human-in-the-loop approval was mandatory. The model\u2019s job was to flag, not to decide.<\/p>\n<\/li>\n Confluence as the RAG source is underused in fintech.<\/strong> Most teams store contract templates in SharePoint or a shared drive. Confluence\u2019s REST API and page-level granularity made it a clean retrieval target. The model\u2019s risk scoring improved by 11 percentage points when grounded in the client\u2019s own template language versus generic legal boilerplate.<\/p>\n<\/li>\n The 2-week timeline is a constraint that clarifies scope, not a reason to cut corners.<\/strong> The sprint worked because the architecture was pre-built: the extraction pipeline, the RAG connector, and the approval workflow were templated from prior engagements. The client-specific work was fine-tuning, Confluence mapping, and Salesforce webhook configuration. Teams without a reusable architecture will not hit 2 weeks.<\/p>\n<\/li>\n PCI DSS compliance is an architecture decision, not a checkbox.<\/strong> Running the model inside the CDE on the client\u2019s own hardware was the single most important design choice. It eliminated the need for data anonymization, third-party DPA negotiations, and residual risk assessments that would have added 3-4 weeks to the timeline.<\/p>\n<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":" A 1,200-person UAE fintech cut contract review cycle time by 52% in a 2-week pilot using on-premise open-weight models, PCI DSS-compliant extraction, and Confluence-grounded scoring.<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rank_math_title":"UAE Fintech Cuts Contract Review Cycle Time 52% in a 2-Week On-Premise AI Pilot","rank_math_description":"A 1,200-person UAE fintech cut contract review cycle time by 52% in a 2-week pilot using on-premise open-weight models, PCI DSS-compliant extraction, and Confluence-grounded scoring.","rank_math_focus_keyword":"cut first-response time contract review","_yoast_wpseo_title":"","_yoast_wpseo_metadesc":"","_yoast_wpseo_focuskw":"","pll_lang":"en","geo_jsonld":"{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@id\":\"https:\/\/blog.forfis.com\/blog\/uae-fintech-contract-review-ai-pilot-2-week-sprint\/#article\",\"@type\":\"Article\",\"author\":{\"@id\":\"https:\/\/blog.forfis.com#org\"},\"dateModified\":\"2026-10-05T23:45:50.600624080+00:00\",\"datePublished\":\"2026-10-05T23:45:50.600624080+00:00\",\"description\":\"A 1,200-person UAE fintech cut contract review cycle time by 52% in a 2-week pilot using on-premise open-weight models, PCI DSS-compliant extraction, and Confluence-grounded scoring.\",\"headline\":\"UAE Fintech Cuts Contract Review Cycle Time 52% in a 2-Week On-Premise AI Pilot\",\"inLanguage\":\"en\",\"keywords\":[\"One Process Automated\",\"Open-Weight Models On-Premise\",\"Predictive Scoring\",\"Finance and Accounting\",\"501-2000\",\"PCI DSS\",\"Integration Sprint\",\"Fintech and Payments\",\"Notion or Confluence\",\"English\",\"Cut First-Response Time\",\"UAE\",\"2 weeks\",\"Contract Review\"],\"mainEntityOfPage\":\"https:\/\/blog.forfis.com\/blog\/uae-fintech-contract-review-ai-pilot-2-week-sprint\/\",\"publisher\":{\"@id\":\"https:\/\/blog.forfis.com#org\"}},{\"@id\":\"https:\/\/blog.forfis.com\/blog\/uae-fintech-contract-review-ai-pilot-2-week-sprint\/#faq\",\"@type\":\"FAQPage\",\"mainEntity\":[{\"@type\":\"Question\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"PCI DSS Requirement 3 mandates protection of stored cardholder data. If the extraction pipeline touches PANs or CVVs, the model must run inside the cardholder data environment (CDE) or in a segmented network where data never leaves the client's infrastructure. Open-weight models on-premise satisfy this because inference happens on hardware the client controls, eliminating third-party data transmission. The model itself is not a data store, but the input documents and extracted fields must be treated as CDE assets, encrypted at rest and in transit per Requirement 3.4 and 3.5.\"},\"name\":\"How does PCI DSS apply to an on-premise AI model that processes payment documents?\"},{\"@type\":\"Question\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"A 2-week integration sprint is feasible when the scope is deliberately narrow: one document type, one extraction pipeline, one scoring model, and one integration point. The first week covers environment setup, model fine-tuning on a labeled sample (typically 200-500 documents), and API scaffolding. The second week covers integration with the existing system (Confluence, Notion, or the ERP), human-in-the-loop approval workflow, and baseline measurement. What is excluded: multi-document-type support, full contract review automation, and production hardening. Those come in the rollout phase after the pilot validates the baseline.\"},\"name\":\"What does a 2-week integration sprint realistically cover for a document extraction pilot?\"},{\"@type\":\"Question\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Open-weight models (Llama 3, Mistral, Qwen) run on the client's own GPU hardware, so no document data transits a third-party API. This is critical for PCI DSS, where cardholder data must not leave the CDE, and for UAE data residency rules under the DIFC and ADGM frameworks. The trade-off is that open-weight models may trail frontier APIs by 5-15% on complex extraction tasks. For structured document parsing (invoices, contracts with known templates), the gap narrows to 2-5% after fine-tuning. For free-form contract review requiring legal reasoning, the gap is wider, which is why the pilot focuses on extraction and scoring, not full legal analysis.\"},\"name\":\"Why choose open-weight models on-premise over OpenAI or Anthropic APIs for a fintech client in the UAE?\"},{\"@type\":\"Question\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"The pilot ships with a measured baseline: cycle time (median and 95th percentile) and error rate (field-level accuracy) for the manual process, captured over a 1-2 week observation window before automation goes live. After the AI pipeline is in production, the same metrics are tracked for 2-4 weeks. The comparison must use the same document sample or a statistically equivalent set. For first-response time, the baseline is the median time from document receipt to human review completion. The target is a 40-60% reduction in median cycle time with error rate at or below the manual baseline. If error rate exceeds the baseline, the human-in-the-loop threshold is tightened before scaling.\"},\"name\":\"How do you measure before\/after baselines for cycle time and error rate in a pilot?\"},{\"@type\":\"Question\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"The model extracts structured fields (parties, amounts, dates, clauses) and assigns a risk score based on clause patterns, deviation from standard templates, and historical anomaly data. A human reviewer sees the extracted fields, the risk score, and a highlighted diff against the standard contract template. The reviewer approves, rejects, or flags for escalation. Anything touching money (payment terms, penalty clauses), health data references, or contract liability triggers mandatory human approval. The model never auto-approves a contract. The approval log is stored in the client's system of record, not in the AI layer.\"},\"name\":\"What does human-in-the-loop mean in practice for a contract review pipeline?\"},{\"@type\":\"Question\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Confluence or Notion serves as the knowledge base for contract templates, clause libraries, and review guidelines. The AI pipeline retrieves relevant template sections and clause precedents via RAG (retrieval-augmented generation) to ground its extraction and scoring. This keeps the model's output aligned with the client's specific contractual language rather than generic legal boilerplate. The integration is read-only: the AI reads from Confluence\/Notion via their REST APIs, and the human reviewer's decisions are written back to the client's CRM or ERP, not to the knowledge base. This avoids version-control conflicts and keeps the knowledge base as a single source of truth for templates.\"},\"name\":\"How does the AI pipeline integrate with Confluence or Notion in a contract review workflow?\"},{\"@type\":\"Question\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Predictive scoring in this context means the model assigns a numerical risk or priority score to each extracted document or contract clause, based on features like clause deviation, amount thresholds, counterparty history, and pattern matching against known risk indicators. The score does not make a decision; it ranks documents for human review so that high-risk items surface first. This cuts first-response time not by eliminating human review, but by reducing the time a reviewer spends triaging low-risk documents. The scoring model is typically a lightweight classifier (logistic regression or a fine-tuned small language model) trained on labeled historical review outcomes.\"},\"name\":\"What does predictive scoring mean in a document extraction pipeline for finance and accounting?\"},{\"@type\":\"Question\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"A composite case study synthesizes patterns from multiple engagements into a single narrative that illustrates a realistic scenario. It is not a named customer account. The metrics, company profile, and timeline are representative of what Forfis has observed across engagements in fintech and payments in Tier-1 markets. The purpose is to give operators a concrete reference point for scoping, budgeting, and risk assessment. The honesty marker exists because presenting a composite as a named client would be misleading. The patterns are real; the specific company is not.\"},\"name\":\"What does it mean that this case study is a composite?\"}]},{\"@id\":\"https:\/\/blog.forfis.com\/blog\/uae-fintech-contract-review-ai-pilot-2-week-sprint\/#breadcrumbs\",\"@type\":\"BreadcrumbList\",\"itemListElement\":[{\"@type\":\"ListItem\",\"item\":\"https:\/\/blog.forfis.com\",\"name\":\"Home\",\"position\":1},{\"@type\":\"ListItem\",\"item\":\"https:\/\/blog.forfis.com\/blog\/\",\"name\":\"Blog\",\"position\":2},{\"@type\":\"ListItem\",\"item\":\"https:\/\/blog.forfis.com\/blog\/uae-fintech-contract-review-ai-pilot-2-week-sprint\/\",\"name\":\"UAE Fintech Cuts Contract Review Cycle Time 52% in a 2-Week On-Premise AI Pilot\",\"position\":3}]},{\"@id\":\"https:\/\/blog.forfis.com#org\",\"@type\":\"Organization\",\"name\":\"Forfis\",\"url\":\"https:\/\/blog.forfis.com\"}]}","geo_content_hash":"59705b2fde47abf8e31aa3302f74279beb8da5ba106afe062bb640aa5a41f347","footnotes":""},"categories":[37],"tags":[31,53,55],"class_list":["post-78","post","type-post","status-publish","format-standard","hentry","category-fintech-and-payments","tag-contract-review","tag-cut-first-response-time","tag-uae"],"_links":{"self":[{"href":"https:\/\/blog.forfis.com\/blog\/wp-json\/wp\/v2\/posts\/78","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.forfis.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.forfis.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.forfis.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.forfis.com\/blog\/wp-json\/wp\/v2\/comments?post=78"}],"version-history":[{"count":0,"href":"https:\/\/blog.forfis.com\/blog\/wp-json\/wp\/v2\/posts\/78\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.forfis.com\/blog\/wp-json\/wp\/v2\/media?parent=78"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.forfis.com\/blog\/wp-json\/wp\/v2\/categories?post=78"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.forfis.com\/blog\/wp-json\/wp\/v2\/tags?post=78"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Challenge: PCI DSS Re-Assessment and a 2-Week Deadline<\/h2>\n
Approach: On-Premise Open-Weight Models and a Fixed-Scope Sprint<\/h2>\n
Outcome: 52% Cycle-Time Reduction and a 4.1% Error Rate<\/h2>\n
\n
Lessons for Similar Teams<\/h2>\n
\n