Complaints arrive in a shared Outlook inbox, ICT incident reports come from monitoring and Teams, and deadlines run from receipt. AI assigns a category, severity and deadline according to your procedure and logs it in a SharePoint register, while a person approves and decides whether to notify the financial regulator.
Built for ISO 27001NIS2 DORA
A complaint can arrive in a shared Outlook inbox on a Friday evening, an ICT incident report can come from the monitoring system overnight, and another can arrive as a Teams message from an employee. On Monday a compliance officer reads them, decides whether each is a complaint or a simple question and whether an incident is major under the DORA criteria, logs it in the register, usually a SharePoint list or a Dynamics 365 case, and assigns an owner. By the time it is their turn, part of the deadline has already passed, and the same case sometimes appears twice in the register under different names. The severity assessment depends on who is reading that day, and the deadline for notifying the financial regulator is noticed on the last day.
The solution brings all the channels together. A Power Automate flow picks up a new email from the Outlook inbox, a self-service form, a Teams message or a monitoring alert and passes it to Claude, running in an Amazon Bedrock EU region. Following your complaint handling procedure and the DORA incident classification criteria, the model assigns a category, severity level, affected services and a proposed deadline, and checks that the register has no similar open record. The flow creates a record in the SharePoint register or a Dynamics 365 case marked "awaiting approval" and assigns an owner according to your rules, and the owner receives a Teams notification. They approve or change the classification, while the decision to notify the financial regulator is made only by a person, and the system reminds them of the deadline. Every step stays in the log with time and user.
Four steps from input to a record in your system, with human approval wherever there is risk.
Power Automate monitors the complaints Outlook inbox, self-service forms, the Teams incident channel and monitoring system alerts. Each new report gets a receipt time, from which the deadline is counted, and is passed to classification within minutes, regardless of working hours.
The model assesses a report against your complaint handling procedure and the DORA criteria: affected services, number of customers, duration, data impact. It assigns a category, severity level and proposed deadline, explains which criterion drove the result, and checks the SharePoint register or Dynamics 365 for a similar open case.
The flow creates a record in the SharePoint register or a Dynamics 365 case marked "awaiting approval" and assigns an owner by category, and the owner receives a Teams notification with the proposed classification. They approve or change the classification and deadline. Whether to notify the financial regulator, and when, is decided by a person; the system only reminds them of approaching deadlines.
A report that the model cannot classify with enough confidence goes to a manual queue with no proposed classification. All actions are logged: receipt, classification, changes, approval, the regulator notification flag. When you update the procedure or criteria, we update the rules and test them against your sample cases.
Collecting reports from the Outlook inbox, self-service, Teams and monitoring, creating records in your SharePoint register or Dynamics 365, and assigning owners.
Your complaint procedure and DORA criteria turned into a documented rule set with an explanation for every decision and a duplicate check in the register.
Review by the responsible person in a Teams message or the register, deadline reminders and a flag recording the decision on notifying the financial regulator.
A full action log for every case in SharePoint or Dynamics 365 and a monthly report on categories, deadlines and major incidents.
Claude via API in an Amazon Bedrock EU region + a Power Automate flow from Outlook and Teams into a register in SharePoint or Dynamics 365. We connect to the register through an API, a file export or an email flow, depending on your version; we choose the method after a check. Learn more about this service and its limits on the service page.
No. The system classifies and reminds about deadlines, while the decision to notify and the notification itself are prepared by the compliance officer according to the regulator's procedure. The log shows who made that decision and when.
Yes. We write to a SharePoint list and to Dynamics 365 cases through Power Automate connectors, and if the register is in another system, we connect through its API, a file export or an email flow, depending on the version. We choose the integration method after a check, and until then records can be created in a Teams approval card.
No. The model runs in an Amazon Bedrock EU region, content is not used for training, and the register stays in your Microsoft 365 tenant or in Dynamics 365. We describe the flow in your GDPR record of processing activities.
What is the contract termination procedure, when is enhanced customer due diligence required, who approves an exception: staff ask colleagues in…
Where is my payment, what is my limit, how much does a transfer cost: the answers are already in your core system.
The customer passes the Onfido or Sumsub check, but someone still retypes the business register extract, proof of income and beneficial owner…
A quarterly report to the financial regulator means days of collecting data from Sage, the core system and registers into Excel and checking it by…
This service is delivered by specialists with valid international certifications. Their expertise is confirmed by independent organisations, not by us.
AI systems are deployed with protection against data leakage and model abuse.
The AI security programme and its controls are managed following the ISACA methodology.
AI risks are identified and managed like any other IT risk.
We reply within 1 business day
