AI knowledge bases and RAG systems

Every established business is sitting on a body of knowledge that is technically available and practically unreachable: contracts, procedures, past proposals, support history, specifications, years of email. People know the answer exists somewhere and it is faster to ask a colleague than to find it. That is the problem retrieval-augmented generation actually solves.

The technique is straightforward in principle — find the relevant passages, give them to a model, have it answer using only those passages, and cite what it used. The difficulty is entirely in retrieval quality, access control and knowing when to refuse.

Why this is worth doing properly

Most RAG systems that disappoint do so at the retrieval stage rather than the generation stage. If the right passage is not returned, no model can produce the right answer, and the failure looks like the model being stupid when in fact it was never shown the material. Chunking strategy, hybrid keyword-plus-semantic search and reranking do more for answer quality than model choice.

The second failure is access control. A knowledge assistant that indexes everything and answers everyone will eventually tell a junior employee what the leadership team earns. Permissions have to be enforced at retrieval time, filtering the candidate set by the asker’s entitlements, not applied afterwards as a filter on the answer.

The third is staleness. A knowledge base indexed once and never updated confidently returns superseded procedures, which is worse than returning nothing because it carries the authority of a system. Re-indexing has to be automatic and tied to the source of truth.

Where this work usually goes wrong

Indexing everything indiscriminately

Dumping an entire shared drive in produces a corpus full of drafts, duplicates and obsolete versions, and retrieval surfaces them with the same confidence as current material. Curating what goes in is most of the work.

Permissions applied after retrieval

Filtering the generated answer rather than the retrieved set means confidential content has already been read by the model and can leak through paraphrase. Entitlements belong in the retrieval query.

No refusal behaviour

A system that always produces an answer will confidently invent one when retrieval fails. It has to be able to say that it could not find the material, and that behaviour must be tested explicitly.

Answers without citations

Without a link back to the source passage, users cannot verify and will either trust it blindly or abandon it. Citations are what make the system usable for anything consequential.

Semantic search alone

Pure vector search is poor at exact terms — part numbers, clause references, product codes. Hybrid retrieval combining keyword and semantic matching is markedly better for most business corpora.

What this covers

Business knowledge bases

A curated corpus of the material that actually answers recurring questions, rather than an unfiltered document dump.

Retrieval-augmented generation systems

Retrieval, reranking and grounded generation with citations back to source passages.

Document search and question-answering

Natural-language questions answered from your documents, with the passage used shown alongside.

Vector database implementation

pgvector, Qdrant or equivalent, sized and indexed for your corpus and query volume.

Internal company chatbots

Staff-facing assistants that respect existing permissions and escalate rather than guess.

Employee knowledge assistants

Answering procedural and policy questions, which typically absorbs a large share of internal support load.

Customer-facing knowledge assistants

External assistants restricted to published material, with a clear handoff to a human.

Website chatbot integration

Embedded assistants grounded in your documentation rather than improvising from general knowledge.

PDF and document processing

Extraction, chunking and structure-aware parsing, including scanned documents requiring OCR.

CRM and database-connected assistants

Answers that combine document retrieval with live records, so responses reflect current state.

Role-based access controls

Entitlements enforced at retrieval, so users only ever see material they were already permitted to read.

Private company-data integrations

Connections to internal systems with credentials scoped narrowly and access logged.

Knowledge-base maintenance and updating

Automatic re-indexing tied to the source of truth, so answers do not silently go stale.

How the work runs

1. Curate the corpus

   Decide what is authoritative, what is superseded and what should never be indexed. This is a business decision requiring someone who knows the material, and it determines the ceiling on answer quality.

2. Build the question set

   Collect real questions people actually ask, with correct answers. This is the evaluation set, and it is what makes retrieval tuning measurable rather than impressionistic.

3. Engineer retrieval

   Chunking tuned to document structure, hybrid keyword and semantic search, and reranking. We measure retrieval quality separately from answer quality, because conflating them hides where the problem is.

4. Enforce permissions at retrieval

   Entitlement filters applied to the candidate set before anything reaches the model, mirroring the access rules that already exist in your systems.

5. Ground and cite

   Answers constrained to retrieved material, with citations, and an explicit refusal path when retrieval returns nothing relevant.

6. Automate re-indexing

   Pipelines that pick up changes from the source systems, so the knowledge base reflects current documents without anyone remembering to refresh it.

What you receive

• Curated and structured corpus
• Real question set with correct answers
• Retrieval pipeline with measured quality scores
• Grounded generation with citations and refusal behaviour
• Role-based access enforced at retrieval
• Chat interface, embedded or internal
• Automatic re-indexing pipelines
• Evaluation results and monitoring

You probably need this if

• The same questions get asked internally every week.
• Institutional knowledge lives with two people who are always busy.
• Support agents search a wiki that nobody has updated in a year.
• You tried a chatbot and it made things up.
• Your documents cannot be uploaded to a third-party service.

What we build and work with

Chosen for operational simplicity — a retrieval stack nobody can maintain is a retrieval stack that goes stale.

PostgreSQL with pgvector

Vector storage alongside your relational data, which avoids running a separate database for most corpus sizes.

Qdrant

A dedicated vector store where corpus size or filtering complexity genuinely warrants it.

Hybrid retrieval with reranking

Keyword and semantic search combined, then reranked, which materially outperforms either alone on business documents.

Document parsing and OCR

Structure-aware extraction from PDFs, including scanned material, since layout carries meaning in contracts and specifications.

Ollama or hosted models

Local inference where the corpus cannot leave your infrastructure, commercial APIs where it can.

Retrieval evaluation harness

Scored retrieval quality against the real question set, measured independently of generation.

Access-control integration

Entitlements read from your existing identity system rather than maintained separately.

What changes once this is in place

Answers with sources attached

Every response cites the passage it used, so people can verify rather than trust blindly.

Internal questions stop routing to people

Recurring procedural questions get answered by the system, returning time to whoever was fielding them.

Confidential material stays confidential

Permissions enforced at retrieval, so the assistant cannot surface what the asker was never entitled to read.

The system admits ignorance

Explicit refusal when retrieval finds nothing relevant, tested as a behaviour rather than hoped for.

Knowledge stays current

Automatic re-indexing from the source of truth, so superseded procedures stop being quoted with authority.

How this differs by market

The work is the same craft everywhere. What changes is the law, the language and the buying culture — and those change enough to matter.

European Union

An internal knowledge base indexing employee-authored documents is processing personal data, which brings retention limits and access rights. Where the corpus cannot lawfully leave the EU, local inference or EU-region hosting is the answer, and it needs deciding before the corpus is built.

Nordics

Works council and employee-representation consultation is a genuine requirement in several Nordic countries before deploying systems that process employee-generated content. Building the system first and consulting afterwards causes avoidable delay, and factoring it into the timeline is simply realistic planning.

United States and Canada

Sector rules dominate: legal and healthcare corpora carry privilege and HIPAA considerations that constrain both hosting and logging. Retention of query logs deserves particular thought, because those logs record what employees asked.

United Arab Emirates

Bilingual corpora are common and Arabic retrieval quality varies considerably by embedding model, so it should be measured against your own documents rather than assumed. Financial services entities in DIFC and ADGM carry additional expectations around where data is processed.

Not legal advice. Regulatory summaries on this site describe how we scope and build, and are current to our latest review. Verify the operative text with qualified counsel in the relevant jurisdiction before relying on it.

How we know it worked

We measure retrieval and generation separately. Retrieval is scored on whether the correct passage appears in the returned set; generation on whether the answer is correct and properly grounded in it. Conflating the two hides which half is failing.

Both are reported against the real question set with its size stated. We also track refusal rate, because a system that never refuses is inventing answers and one that refuses constantly is not retrieving properly.

Post-launch we monitor questions that produced refusals or low-confidence answers, since those are the most reliable indicator of gaps in the corpus rather than defects in the system.

Estimates are labelled as estimates. Any figure on this site that describes a range is a planning estimate with its assumptions stated, not a measured client outcome. We do not publish client results without the client's permission and a date.

Related services

Sectors where this is usually the lead engagement

These are the industries where this discipline is typically the first thing a client buys rather than something added later. The link goes to a page written for that sector specifically, with a paragraph on this service and on every other one.

• Legal Services — A sector where the work is documents and judgement, the advertising is regulated, and confidentiality constrains every architecture decision.
• Financial Services & Banking — Among the fastest-growing categories of digital investment, and the one where a marketing claim can be a regulatory breach.
• Professional Services — The second-largest sector for digital transformation spending, selling something that only exists as the time of people who are hard to replace.
• Accounting & Tax — A profession being reshaped twice at once — by e-invoicing mandates arriving across Europe, and by the automation of the compliance work that used to pay for everything.
• Insurance — A document-heavy business where the product is a promise, the marketing is regulated, and renewal retention quietly decides profitability.
• Architecture & Design — Work won on portfolio and relationship, delivered on drawings, and quietly lost on unrecovered fee variations.
• Pharma & Life Sciences — Where data integrity is a regulatory obligation, promotion to the public is largely prohibited, and every system that touches quality must be validated.
• Agriculture & Agritech — A sector where subsidy compliance, buyer requirements and new supply chain regulation all demand data that farms have never systematically collected.
• Medical Devices — Where the documentation is the product as far as a regulator is concerned, and post-market surveillance never ends.
• Marine & Shipping — Assets moving between jurisdictions, crews whose certificates expire, and emissions reporting that has become a financial obligation.
• Public Sector — Where accessibility is law, procurement is formal, and the service has to work for everyone rather than for a target segment.

It appears on all thirty sector pages, because every one of them carries a paragraph on all twenty-two services. This list names only the sectors where it tends to lead.

Where we deliver this

This service is delivered across the European Union, the Nordic countries, North America and the United Arab Emirates. The craft does not change; the law, the language and the buying culture do. Consent regimes, invoicing mandates and payment conventions differ enough between markets that a campaign or a system built for one frequently cannot be used unchanged in another.

Each country page sets out what actually differs there and what it means for scope — all 32 countries and 10 cities are listed here. A few of the markets we work in most:

• Germany
• Netherlands
• France
• Sweden
• United States
• United Arab Emirates