Internal knowledge assistant

• Staff ask a question in the tools they already use and get a short answer in seconds, with links to the exact paragraphs it came from.
• Answers only draw on documents the person asking can already open. The search platform enforces this at query time, from their real identity.
• When the sources don't cover a question, the assistant says 'I don't know' and points to the owner, instead of guessing.
• Each source has a named owner, who sees the questions it couldn't answer and the documents most often cited.
• Outdated and duplicate documents surface quickly, because people now notice when an answer cites them.
• HR casework, legal matters and personal files stay out of scope unless they're permission-trimmed and the DPO agrees.

• ICOUK GDPR: data minimisation and purpose limitation
  →

  Index only what staff need to do their jobs. Sources that are mostly personal data, such as HR casework, grievances, legal matters and personal drives, stay out unless there's a clear need, they're permission-trimmed, and the DPO agrees. A DPIA covers the sources, the logs and the retention periods before the pilot.

• ICOUK GDPR security, and access control
  →

  The assistant must never become a way round your permissions. Retrieval is filtered by the signed-in user's identity and groups, enforced by the search platform at query time, not by instructions in a prompt. Permissions are synced from each source on a short schedule, and changes such as a leaver or a moved file are tested.

• ICOSubject access (UK GDPR Article 15, as amended by the Data (Use and Access) Act 2025)
  →

  Questions staff ask, answers that mention a person, and logs are all personal data that can fall within a subject access request. The Act confirms you only need a reasonable and proportionate search, but you still need to be able to search the logs by person. Keep logs for a set period, and don't keep conversation histories longer than you need.

• ICOStorage limitation and retention
  →

  The index follows each source's retention: when a document is deleted or expires, it leaves the index on the next sync. Logs of questions and answers have their own short retention period, agreed with information governance.

• NCSC / DCMSPrompt injection through documents
  →

  The NCSC's December 2025 advice is that prompt injection may never be fully fixed, so reduce what a successful attack can do. A document can carry hidden instructions. The assistant treats every document as data, has no tools that act or send, and can only see what the user can see. DSIT's AI Cyber Security Code of Practice names indirect prompt injection as a risk to design for.

• ICOFreedom of Information Act 2000 (public bodies)
  →

  If you're a public authority, the ICO's guidance is that AI prompts and outputs you hold are subject to FOI, and retained chat histories must be searched when a request covers them. Short, defined retention keeps this manageable. Official outputs go into your records system, not the chat log.

On a phone, the table shows the platform you pick. Sovereign / on-prem means open, portable components you can run in your own data centre or with a UK or European provider; IONOS is shown as one example, and others exist. What sovereign cloud means →

• A permissions clean-up before go-live: find files shared with everyone or with large groups, and fix them at source.
• A named owner for every source, who reviews unanswered questions and the most-cited documents each month.
• A list of out-of-scope sources, agreed with the DPO and HR, and reviewed when anyone asks to add one.
• A weekly sample of answers checked by source owners, plus tests with test accounts that should be refused.
• Retention periods for logs and conversation histories, agreed with information governance, and a way to search them for subject access and, for public bodies, FOI requests.
• Staff told what the assistant can see, that answers cite their sources, and to check the source for anything important.

1. 3–4 weeks

   Discovery

   List the sources, owners and their permissions, find overshared content, collect 100 real questions, and measure the baseline.

2. Gate · must be true to passSources and owners agreed, oversharing report reviewed, DPIA started, out-of-scope list signed off by the DPO.

3. 4–6 weeks

   Pilot

   Two or three well-owned sources, such as IT and finance policies, for 200 staff. Test every answer against the question set, and test permissions with test accounts.

4. Gate · must be true to passCitation rate and wrong-answer rate within agreed limits, zero permission leaks in testing, and DPO and security sign-off.

5. 4 weeks

   Production

   Open to all staff for the pilot sources, with monitoring, support, owner reporting and a rollback plan.

6. Gate · must be true to passMonitoring, support model, rollback plan, retention settings and staff guidance in place.

7. Ongoing

   Scale

   Add sources one at a time, each with an owner, a permissions check and a set of test questions.

8. Gate · must be true to passEach new source passes the same gate.

R ResponsibleA AccountableC ConsultedI Informed· not involved

Where I'd fit

1. 1

   Goes wrong

   The assistant surfaces a salary file from a folder shared with everyone years ago.

   How the design avoids it

   An oversharing review and clean-up in discovery, and sensitive sources out of scope until they're fixed.

2. 2

   Goes wrong

   Permissions are checked in the prompt ('only answer if the user is in HR'), and a clever question gets round it.

   How the design avoids it

   Retrieval filtered by the platform from the user's verified identity. The model never sees what the user can't.

3. 3

   Goes wrong

   Someone leaves or changes team, but the index still serves them old documents until the next weekly sync.

   How the design avoids it

   Short permission syncs, leaver and mover tests, and sources withheld when their permissions are too stale.

4. 4

   Goes wrong

   Answers sound confident but come from an old policy, or from nowhere.

   How the design avoids it

   Every answer cites its source, 'I don't know' is an accepted answer, and owners retire outdated documents.

5. 5

   Goes wrong

   A document with hidden text tells the assistant to reveal or do something.

   How the design avoids it

   No tools that act or send, documents treated as data, and the user's own permissions as the outer limit.

1. By end of 2026
   In-UK processing for Microsoft 365 Copilot

   Microsoft's April 2026 update says it expects local processing of Copilot interactions in the UK by the end of 2026. If you're weighing a packaged option, check where prompts are processed as well as stored, and record it in the DPIA.

2. Under way
   UK AI security code aligning with ETSI EN 304 223

   ETSI published its baseline AI security standard, based on the UK code, in December 2025, and the government said it would update its code to match. Map your controls for prompt injection, logging and least privilege to it now.

3. Ongoing
   Knowledge platforms are changing fast

   Amazon Q Business closed to new customers on 31 July 2026; Bedrock Managed Knowledge Base became generally available in June 2026; parts of Azure's document-level access control are still in preview. Keep identity, permission sync and source owners in your own design, so the index can change underneath.

4. Late 2026–2028
   The Cyber Security and Resilience Bill

   Medium and large managed service providers come into regulation, with faster incident reporting. Expect your IT and AI suppliers to face new duties, and update contracts and supplier assurance to match.