A day with an AI credit controller

Most credit control fails in the gap between "we should chase that" and someone actually chasing it. Invoices age. The polite first reminder gets deferred because the morning is busy. The statutory interest clause in the terms never gets applied because nobody wants the awkward conversation. By the time anyone looks, a £6,000 account is 50 days overdue and the relationship has soured anyway.

An autonomous credit controller closes that gap by simply doing the work, every day, on a schedule, and stopping only at the points where a human genuinely needs to decide. At Legacie and WH Scott Group this role runs as Sarah (and at group level, Sharon). What follows is a grounded walk-through of a day in that role — the ledger review, the chases, the jurisdiction-aware interest, the reconciliation, and the human approval gate before anything formal goes out. The numbers below are a hypothetical worked example, not reported results.

The Morning Ledger Review

Sarah doesn't wait to be asked. A standing daily cron fires early, and the first thing she does is pull the live aged-debtors position from the finance system — Business Central on the WH Scott side, the block-management ledgers on the Legacie side. She reconciles open invoices against received payments, buckets everything by age (current, 1–30, 31–60, 60+), and flags what's changed since yesterday.

This is read-only work, and deliberately so. The credit-control role is technically prevented from mutating the accounting systems — the fail-closed tool-policy denies write tools to a role that has no business issuing credit notes or editing invoices. She can read, analyse, and propose; she cannot quietly alter a ledger. That boundary is enforced in code, not in a prompt that hopes she behaves.

By the end of the review she has a ranked worklist. Say it surfaces an invoice — INV-20418, £2,140, issued to a commercial tenant, now 32 days overdue, no payment received, no dispute logged. That account moves into the chase queue.

Why a schedule beats a reminder

The point of running daily isn't speed for its own sake. It's that nothing falls through. An account that tips from 30 to 31 days overdue gets picked up the same morning, with the right tone for that stage, rather than weeks later when it's become a problem. Consistency is the entire job, and a schedule delivers consistency in a way a busy human rarely can.

Chasing Politely But Relentlessly

The worked example invoice gets a first chase: a courteous, specific email. It names the invoice number, the amount, the original due date, and a clear way to pay or to flag a query. It is not a threat. The first contact assumes the best — invoices get missed.

What makes it relentless rather than naggy is the durable memory behind it. Sarah remembers that this tenant paid late twice last quarter and always settles within a week of the second reminder. She remembers the right contact in their accounts team, because the generic AP inbox never replies. She remembers a part-payment promise made on a call three weeks ago. None of that lives in a person's head or a sticky note; it persists across months, so every chase is informed by the actual history of the relationship.

The cadence escalates by stage, not by mood:

• •Day 1 of overdue: friendly reminder, full payment details.
• •~Day 7: firmer follow-up, restating the amount and due date, offering to resolve any query.
• •~Day 14+: a final-reminder tone that references the terms and signals that statutory remedies are available.

Crucially, a run can't just go quiet. The role operates under a delivery contract: it cannot end a cycle without a real, logged outbound action. If Sarah can't send — a tool fails, a recipient bounces, something looks off — she escalates to a human rather than silently doing nothing and leaving the debt to rot. "No outbound, no excuse" is the rule.

An agent that goes silent is worse than no agent at all — silence looks like progress and isn't.

Statutory Interest, By Jurisdiction

This is where an autonomous controller earns its keep, because applying late-payment interest correctly is fiddly, jurisdiction-specific, and almost always skipped by humans who'd rather not.

WH Scott operates across the UK and Ireland, so the rules differ by where the debtor sits:

• •UK debts fall under the Late Payment of Commercial Debts (Interest) Act 1998: statutory interest at 8% above the Bank of England reference rate, plus a fixed compensation sum that steps with the size of the debt, plus reasonable recovery costs.
• •Irish debts fall under S.I. No. 580/2012, which transposes the EU Late Payment Directive: interest at 8% above the ECB main refinancing rate, plus the €40 minimum compensation.

Sarah selects the correct regime from the debtor's jurisdiction, applies the right reference rate, and calculates the entitlement on the actual overdue period — not a guess. For our £2,140 UK invoice at 32 days, she computes the daily statutory interest accrued, adds the fixed compensation band that applies to a debt of that size, and shows the working. The figure is presented transparently: principal, days overdue, rate applied, interest, compensation, total.

She does not silently bolt interest onto a friendly first reminder. Statutory interest is a remedy, and it surfaces at the stage where it's appropriate — and, when it forms part of a formal notice, only after a human has approved it. The calculation is hers; the decision to wield it is signed off.

The Human Approval Gate

A first reminder is routine and goes out under standing authorisation. A formal late-payment notice — one that asserts statutory interest, threatens further action, or could affect a commercial relationship — is not routine. It stops at a gate.

When Sarah decides INV-20418 warrants a formal notice, she doesn't send it. She drafts it in full — the letter, the interest calculation, the recipient — and pushes an approval request to a human over WhatsApp or Microsoft Teams. The human sees exactly what would go out, to whom, and why, and replies to approve, edit, or hold. Nothing leaves until that approval lands.

How the send itself is governed

Even with a human's yes, the send is constrained by the platform's governance:

• •Every external send needs a signed authorisation — an HMAC-SHA256 token that is time-limited and bound to the specific recipient. A blanket "send anything" permission doesn't exist; approval is scoped to this message, this address, this window.
• •Untrusted inbound is sandboxed for prompt injection, so a hostile reply buried in an email thread can't talk Sarah into firing off something she shouldn't.
• •Logs are redacted — no PII or memory contents leak into operational logging.

So the human gate isn't a checkbox bolted on top of an otherwise free-running system. It sits inside a stack where the act of sending is itself fenced.

Reconciliation And The Audit Trail

Payments arrive throughout the day, and the next morning's run reconciles them. When the tenant pays the £2,140, Sarah matches the receipt to INV-20418, clears it from the chase queue, and closes the loop — no further reminders go to someone who has already paid, which is exactly the kind of embarrassing error that erodes trust in automated chasing.

Underneath all of it sits a tamper-evident, append-only audit ledger. Every step is recorded: the ledger pulled at 06:00, the first reminder sent at 06:42, the interest calculated under the 1998 Act, the formal notice drafted, the approval requested over Teams at 14:10, the human's reply, the send, the payment matched two days later. You can reconstruct precisely what happened, when, and on whose authority — which matters when a debtor disputes a charge, or when finance wants to know why interest was applied to one account and not another.

The whole thing runs inside per-tenant Azure isolation — each company gets its own subscription, Key Vault, and container environment, behind an OAuth 2.1 (Entra ID) gateway, with gitleaks and CodeQL in CI and automated end-to-end guardrail tests. The platform inherits Azure's certified infrastructure; formal certifications such as SOC 2 are on the roadmap rather than held today, and we'd rather say so plainly.

What you're left with is a credit controller that works every day, chases on history rather than vibes, applies the right statute to the right debt, never sends a formal notice without a human's yes, and leaves a complete record of every move. The judgement that matters stays human. The relentless, repetitive, easily-dropped work doesn't get dropped.

If you'd like to see this run against your own ledger, you can book a walk-through at /demo.