Company knowledge your staff can ask, with permissions and sources

Staff stop hunting for the right document and stop interrupting the colleague who always knows. In most companies the knowledge exists but is scattered: as a practice example from the Mittelstand-Digital Zentrum Chemnitz puts it, it is spread across different documents, help pages and internal descriptions. Add file shares, old tickets and personal inboxes, and new staff ask around while experts answer the same questions again and again.

Companies are moving on this. In Bitkom's 2026 survey of companies with 20 or more employees, 22% of the companies that use AI use it for internal knowledge management, up from 11% in 2025. The same survey shows what holds AI users back: data protection requirements (66%) and the concern that company data falls into the wrong hands (45%). A knowledge assistant has to answer both at once: useful answers, and data that stays where it belongs.

Most companies are not there yet. In the IAB establishment panel published in May 2026, 90% of establishments that use AI use free tools, 16% use purchased models trained on their own data and 6% their own models. Bitkom's president Ralf Wintergerst summed up the gap in September 2026: whoever only buys a licence has bought AI but has not changed anything yet.

• New staff find procedures, price rules and past solutions themselves, so onboarding takes less of senior colleagues' time.
• Experts answer fewer repeated questions and have that time for the hard cases.
• Knowledge held by colleagues close to retirement is captured, connected and findable before they leave, which matters more as the skills shortage makes them hard to replace.
• Service, sales and the help desk give the same answer to the same question, taken from the current document.
• Management gets one measured system in daily use instead of licences nobody checks.

The assistant answers the questions your staff ask every day, from the documents and systems that already hold the answers. Each answer cites the passage it comes from, with a link to the document, so the reader can check it. If the sources do not contain an answer, the assistant says so instead of guessing.

Public examples show the pattern. The Mittelstand-Digital Zentrum Chemnitz describes, in an undated practice example, a prototype at InVIDO GmbH, a maker of custom furniture: it searches internal documents, software notes and help-centre content and answers with sources, and it runs on premises because company data was not to go to an external cloud. The stated aim is to noticeably reduce recurring customer enquiries and internal research effort. No measured result has been published. The trade press (ZfK, 2026) reported that Stadtwerke Pforzheim uses assistants for its operations manuals in electricity, district heating, gas, telecoms and water, which route each question to the right division. Cloudsail was involved in neither project.

• Policies and procedures from SharePoint or the intranet: "Which travel policy applies, and what does it say about rail travel?"
• Work instructions, quality manuals and process descriptions from file shares and DMS such as d.velop or ELO.
• Past solutions from tickets in Jira, ServiceNow or your help desk: "Has a customer had this fault before, and what fixed it?"
• Product and price questions from product sheets and price lists, with stock and order data read live from SAP or your ERP.
• Specifications, technical documentation and earlier project files for engineering and R&D.
• HR questions from policies and works agreements, with personnel files kept out.

People stay responsible for the content and for every decision taken on an answer. The assistant finds and quotes. It does not decide.

• Each source has an owner who decides what goes in, what is outdated and which version counts.
• Answers on safety, legal, price or HR matters name the responsible department, and the user confirms with them before acting.
• Feedback such as "wrong", "outdated" or "missing" goes to the document owner, who fixes the source rather than the model.
• Experts review the test questions and the expected answers before go-live.
• The assistant does not assess employees or applicants. Screening and ranking job applicants is a high-risk use under the AI Act, with strict duties for the company that deploys it, and it is not part of this system.

We connect your sources, carry their permissions through and run the model where your data is allowed to be: on your own servers or in your own cloud account.

The core is retrieval: the assistant first searches your documents and then answers only from what it found, with the source shown. This is often called RAG, retrieval-augmented generation. Documents such as manuals, policies and past tickets go into a search index, split so that tables and conditions stay together. Data that changes constantly, such as stock, prices or orders, is read live from SAP or your ERP through approved tools instead of being copied.

• Sources: SharePoint and Microsoft 365, file shares, Confluence or other wikis, DMS such as d.velop or ELO, ticket systems such as Jira or ServiceNow, and ERP data from SAP.
• Permissions: the rights from SharePoint, file shares and your identity provider, such as Entra ID or Active Directory, are stored with every document and applied to every search, so nobody gets an answer from a document they cannot open.
• Freshness: update jobs pick up new, changed and deleted documents, and superseded versions are marked so the current one wins.
• Hosting: on your own servers with an open-weight model, a model whose weights you can run yourself, or in your own cloud account in an EU region.
• An LLM gateway, one controlled access point to all models with keys, budgets and logs, so you see cost per team and can change the model later.
• Where staff use it: a chat in Microsoft Teams or the intranet, a side panel in the ticket tool, or an interface for other systems.

If your knowledge lives mostly in Microsoft 365 and processing in Microsoft's cloud is acceptable to you, Microsoft 365 Copilot may be enough, and we will tell you so. Copilot works inside Microsoft 365 and its permissions. In Bitkom's 2025 study, 70% of the companies that use AI used ChatGPT and 28% used Copilot, so many teams already have one of these tools.

Both need clean permissions. If a SharePoint folder is open to everyone by mistake, any assistant will find it, so the permission check comes first either way. The two can also run side by side: Copilot for office work, your own assistant for the sources Copilot cannot reach. An own assistant is worth building when one of these applies:

• Important answers live outside Microsoft 365: on file shares, in SAP, in Jira or ServiceNow tickets, or in d.velop or ELO.
• Data must stay on your own servers or in your own cloud account, with a model you choose.
• You need answer quality measured on your own questions before go-live and after every change, with citations checked.
• You want to see cost per question and per team, and to switch models without switching the whole tool.

Before go-live we test the assistant on your own questions and show you how often it answers correctly, cites the right source and stays out of documents a user may not see. That result decides whether it goes live.

After go-live we track use, unanswered questions and feedback per team. Where you want a business case, we measure the time spent searching before and after, on your own teams.

• A test set of real questions from your staff, with the expected answer and source agreed with your experts.
• Retrieval checks: does the right document come back, and is it the current version.
• Citation checks: does the cited passage support the answer.
• Permission tests: test users with different rights ask the same questions, and any answer drawn from a forbidden document fails the test.
• Refusal tests: questions the sources cannot answer must not be answered.
• An acceptance threshold agreed in writing before the acceptance test, and the same tests after every change to sources, prompts or model.

Your data stays where you decide: on your own servers or in your own cloud account, with documents, index and logs in your own storage. We write down what is stored, where it is processed and who can read the logs, for your data protection officer. The decision is yours, advised by your data protection officer and lawyers. This describes the technical side and is not legal advice.

A knowledge assistant can record who asked what. That makes it objectively capable of monitoring behaviour, so the works council's co-determination right under Section 87(1) no. 6 of the Works Constitution Act (BetrVG) usually applies, whatever the intent. Bitkom's 2026 guide on AI and co-determination recommends that a works agreement states who may access which data and how access is logged. We design the logging with the works council: pseudonymised user IDs, an agreed retention period, no evaluation per person, and raw logs readable only by named roles.

Start small: one group of users and the questions they ask most. A company-wide knowledge project can wait. We agree a fixed price for each step in writing after the first call.

• Pick the team where searching costs the most: service, sales back office, the help desk or new staff.
• Collect real questions from that team and note where the answers live today.
• Check the permissions on those sources, and fix over-shared folders before anything is indexed.
• Agree the acceptance threshold, then build, test and go live for that team.
• Add sources and teams one by one, each with its own tests.