The primary objective was to design and deploy a production-ready, Claude-powered AI platform that allowed underwriting and risk teams to:
Insurance RegTech
Share a brief about your project and get a guaranteed response within 24 hours.
The primary objective was to design and deploy a production-ready AI platform that allowed underwriting and risk teams to:
Automate document review and risk summarisation across large policy volumes
Deploy agentic AI workflows that could reason across multiple data sources
Implement RAG-based knowledge retrieval against internal underwriting guidelines
Operate within a GDPR, SOC 2 Type II, ISO 27001, and HIPAA-compliant infrastructure
Replace fragmented, manual processes with a governed, auditable AI layer
Policy documents, risk assessments, client histories, and compliance flags lived across disconnected systems. Underwriters spent hours manually pulling context before making decisions with no intelligent layer to assist.
Generic AI products were evaluated but fell short on data residency, audit trail requirements, and the ability to enforce SOC 2 Type II and ISO 27001 controls at the infrastructure level.
The client needed AI that could not just summarise a document, but reason across multiple inputs, policy terms, risk history, regulatory flags, and surface a structured recommendation. This required agentic architecture, not a basic prompt-response setup.
As the network grew across regions, the client needed an AI foundation that could scale on cloud infrastructure while maintaining consistent compliance posture and AI governance controls.
As an AWS Partner Network member with GenAI/ML competency, we deployed Claude via AWS Bedrock as the core reasoning engine. This included:
Secure API routing through AWS PrivateLink to keep all data within the client's VPC
Claude model configuration tuned per underwriting use case
Integration with existing policy management systems via AWS Lambda triggers
Monitoring and cost governance through AWS CloudWatch and Cost Explorer
We built a Retrieval-Augmented Generation pipeline that gave Claude grounded access to the client's internal underwriting rulebooks, regulatory guidelines, and precedent case library. This included:
Document ingestion and chunking pipeline built on AWS SageMaker Processing
Vector embeddings stored in Amazon OpenSearch Service
Retrieval layer integrated directly into Claude's context window at inference time
Automated re-indexing as source documents were updated
Rather than single-turn queries, we architected multi-step agentic workflows where Claude could plan, retrieve, reason, and respond across a sequence of underwriting tasks. Key agents built included:
Policy Review Agent, reads submitted documents, cross-references internal guidelines, flags anomalies
Risk Summarisation Agent, synthesises client history, claims data, and market risk signals into a structured brief
Compliance Check Agent screens outputs against GDPR and regulatory requirements before surfacing to the underwriter
For domain-specific terminology and insurance-specific output formatting, we ran supervised fine-tuning jobs on SageMaker using the client's historical underwriter notes and accepted policy language, improving Claude's output precision for their context. AI Governance and Compliance Framework We implemented a full enterprise compliance layer across the deployment:
GDPR, data minimisation enforced at ingestion; PII fields anonymised before reaching the model
SOC 2 Type II, all AI interactions logged with timestamps, user IDs, input hashes, and output records; audit reports generated quarterly
ISO 27001, access control policies, encryption at rest and in transit, incident response procedures documented and tested
HIPAA, where claimant health data was present, a separate HIPAA-aligned processing pipeline was maintained with additional access restrictions
Claude API
AWS Bedrock
AWS SageMaker
Amazon OpenSearch
AWS Lambda
AWS PrivateLink
Python
Node.js
PostgreSQL
Nginx
We began with a structured discovery phase, mapping every touchpoint in the underwriting workflow, identifying data sources, documenting compliance obligations per jurisdiction, and defining success metrics with the client's technical and compliance leads.
Given the AWS partnership and Bedrock availability, we designed a fully AWS-native architecture. Every component, compute, storage, vector search, and orchestration was selected to keep data within the client's existing AWS environment, satisfying data residency and sovereignty requirements from day one.
Before any agentic workflows were built, we established the knowledge retrieval layer. Getting Claude grounded in the client's own guidelines and precedents was the foundation; hallucination risk drops significantly when the model has authoritative source material to reference.
With the knowledge base in place, we built and tested each agent individually before integrating them into end-to-end workflows. Each agent was scoped narrowly, a focused task with defined inputs and outputs, to keep behaviour predictable and auditable.
Rather than treating compliance as a final checklist, we embedded it into every phase. Architecture diagrams were reviewed against ISO 27001 controls. Data flow maps were validated against GDPR requirements. Logging schemas were designed to SOC 2 Type II audit standards from the start.
Post-launch, Wesoftek remained engaged as a managed service provider, monitoring model performance, handling re-indexing cycles, managing prompt versioning, and providing quarterly compliance reporting to support the client's internal audit function.
With the Policy Review and Risk Summarisation agents handling initial document processing, underwriters received structured briefs in seconds rather than spending hours on manual review.
The retrieval layer meant Claude's responses referenced actual internal guidelines rather than generic reasoning, reducing errors and increasing underwriter trust in AI outputs.
The three agents deployed replaced distinct manual workflows that previously required separate tools, separate teams, and significant coordination overhead.
The client received documented compliance coverage across GDPR, SOC 2 Type II, ISO 27001, and HIPAA, enabling the AI platform to be approved for use across all regions in their network.
The architecture is modular. The client's technology team can now commission new agents for claims processing, regulatory reporting, or customer communication without rebuilding the compliance or infrastructure layer.
