AI knowledge management for mid-sized companies: AI only finds what's in the system.

Experience builds up over years of daily work and isn't written in any process description. Day to day, nobody notices it. You notice it when a case sits untouched during vacation cover because only one person knows how it runs, or when new hires keep asking the same colleagues. A sick day comes with no handover, and at succession everything that was never written down retires along with the person. Employees quickly hear this kind of project as a plan to make them replaceable. It's the opposite. Whoever is the only one who knows a workflow answers the same questions every week and has a hard time taking a vacation. Once the knowledge is in the system, it takes over that repetitive work, and the person's experience counts where judgment is needed.

The usual shortcut is an AI search across everything that already exists: drives, folders, the wiki, inboxes and old systems. It works, technically. With RAG, the answer draws on passages a search has found first, usually through embeddings in a vector database, which also catches matches phrased in different words. Ask about a return and you also get the document on customer complaints. But if two versions of the same instruction sit in two places, the answer can come from the wrong one, and whatever was never written down is simply missing. That's why at SUMAX we moved away from the old CRM and the Excel sheets to a system of our own. Only once knowledge sits in one place can a stand-in, a new hire and AI work with it.

One example from summer 2026. For one client we have recurring localization and review work. We moved it into a module of its own, with a clear goal: all the process knowledge should sit in one place instead of in individual heads and scattered spreadsheets. The module builds on the foundation all our tools share, meaning users, permissions and access. And like all our tools, it was built with the people who use it. For us, the foundation for everyone comes first, then a tool for one specific task, then bundled tools like our client archives. A knowledge management system for the whole company in one go has no place in that order. It grows one workflow at a time.

A knowledge system also pools confidential material, such as client contracts or HR records. An AI search without permissions turns that into a shortcut for everyone. OWASP lists this risk separately in its Top 10 for applications built on language models and recommends access controls that reach all the way into the vector database. That's why at SUMAX users, permissions and access keys came first for everyone, with security from the start, so not everyone can get at everything. Tools for single tasks only came after that. For a knowledge search, this means every answer is built only from documents the person asking could open themselves. Which personal data may go in at all is a question for AI governance.

If an answer is missing, people ask. If an outdated answer comes with a source, people believe it. A language model can't tell on its own whether an instruction is from yesterday or from years ago. So every entry needs a valid-from date, and upkeep needs time in the working day of the team that knows the workflow. In line with that, the ISO 30401 standard treats knowledge management as a management system that gets reviewed and improved continuously. For personal data, Article 5 of the GDPR already requires it to be accurate and, where necessary, kept up to date. Prompts are process knowledge too and belong in the same place, with versions and test examples. The source in the answer makes checking fast. An answer only gets passed on after that check.

You start with a list of the most important workflows in one department. Each workflow gets four entries: who can fully explain it today, where it lives (a head, a spreadsheet, an old system or a folder), when someone last reviewed it, and roughly what it costs per year, as an order of magnitude. Then I ask three questions about each workflow. Does the knowledge depend on a single person? Has nobody reviewed it in years? Is it part of one of the most expensive workflows? Where two or three apply, that's where the work starts. That one workflow moves into one place, gets permissions and a valid-from date, and the person who knows it checks the AI's first answers. Then comes the next workflow on the list.