Internal AI Assistant: Company Knowledge on Demand

Internal AI assistant for your team: how it serves company knowledge with a cited source, what co-determination requires and how you start a pilot area.

In plain language

Many firms already use AI. EU law requires staff to know how to work with it. An internal assistant answers questions from the company's own knowledge. Each document shows how long it is valid and who is in charge of it. What may go in is decided by the firm before it is read in. The works council has a say if the system could check how people work. So there are no reports about single people. A team with many questions is a good place to start, but it does not replace training.

July 31, 2026 15 min read By XICBOT

Key points

41 percent (Bitkom) of companies with 20 or more staff use AI, up from 17 percent (Bitkom) a year earlier. In a separate survey, 66 percent (Bitkom) rate their employees' AI skills as low, while Article 4 of the EU AI Act has required staff AI literacy since 2 February 2025.
Internal sources change constantly and carry graded confidentiality. Every document therefore needs a validity date, a named responsible role, an access group, a version and a link to the original, and the permission filter runs before the answer is generated, not after.
Under section 87(1) no. 6 of the German Works Constitution Act the works council co-determines as soon as a system can objectively monitor conduct or performance (Federal Labour Court); intent is irrelevant. A toleration agreement with audit rights bridges the pilot.
Person-level analysis stays off the table: no rankings, response times or usage rates per employee. Reporting happens aggregated per department and only above a minimum case count fixed in the works agreement.
Upkeep belongs to the departments: sales maintains terms, engineering maintains instructions, HR maintains forms. An expiry monitor flags sources lapsing within 30 days, and the guiding metric is the share of questions left without a sourced answer.
Pilot with one team that fields many questions, such as inside sales, service intake or installation planning: 30 to 50 real test questions with an expected source, then four to six weeks of operation without adding sources. It replaces neither onboarding nor expertise.

Why the topic turns inward in 2026

The starting position has shifted markedly within a single year. In the survey on the digitalisation of the German economy, for which 604 companies (Bitkom) with 20 or more employees were interviewed, 41 percent (Bitkom) actively use artificial intelligence; a year earlier the figure was 17 percent (Bitkom). Another 48 percent (Bitkom) are planning or discussing adoption. Statistically, almost every company is now dealing with the subject, and the question is no longer whether but where to begin. Anyone who moves that decision outward without need overlooks the fact that the first use case does not have to be the most visible one.

The effect among adopters is pronounced: 77 percent (Bitkom) of AI-using companies report an improved competitive position, 52 percent (Bitkom) a measurable contribution to business success, and 66 percent (Bitkom) intend to expand their use further. A second data set sharpens the picture. In the IW Future Panel with 1,038 companies surveyed (IW Cologne), 37.0 percent (IW Cologne) state that they use AI, and the distribution by size is unambiguous: 66.3 percent (IW Cologne) of companies with 250 or more employees, but only 35.6 percent (IW Cologne) of those with up to 49. Small and mid-sized firms are not held back by interest, but by the entry point.

What is revealing is how shallow adoption still is. Only 6 percent (IW Cologne) of companies use AI across several business areas, while 64.4 percent (IW Cologne) of AI-using firms work with generative AI or natural language processing and 29.3 percent (IW Cologne) of all companies surveyed use free AI tools. In plain terms: in many companies individual employees are already typing questions into some freely available chat window without that being approved or supervised. An internal assistant solves this not through a ban but through a better offer, one that knows the company's own documents. How an assistant trained on a specific business differs from an off-the-shelf bot is set out in the comparison of a custom assistant versus a standard chatbot.

The core in one sentence

An internal AI assistant is not a new system. It is the same assistant with a different knowledge base, a permissions model in front of it and an analytics approach that deliberately says nothing about individual people.

How the internal assistant differs from the customer-facing one

Externally, the content inventory is edited, agreed and comparatively stable. Internally it is the opposite: price tiers change each quarter, installation guides gain addenda, goodwill rules sometimes exist only as an email agreement, and part of the knowledge sits in people's heads rather than in files. Confidentiality is added on top. Field service may see a purchasing condition, an HR case never. These three differences, lower structure, higher rate of change and graded confidentiality, shape the entire setup.

Criterion	Customer assistant	Internal assistant
Content	Edited, public texts	Working documents, price tiers, process descriptions
Rate of change	Rare and planned	Continuous, sometimes at short notice
Confidentiality	Everyone may see everything	Roles and rights required per source
Consequence of an error	Poor experience, lost enquiry	Wrong quote, wrong installation, wrong commitment
Legal framework	Consumer law, AI Act transparency	Additionally co-determination and employee data protection
Measure of success	Enquiries, deals, relieved support	Answers found, fewer follow-up questions in the team
Who maintains it	Marketing and sales	The department, with a named owner

The higher rate of change creates a requirement that is optional externally and mandatory internally: every source needs metadata. Without a validity date and a named owner, nobody can decide six months later whether a document still applies. The following fields therefore belong to every ingested document before the first user asks anything.

Valid until

A date from which the content counts as outdated. If it is missing, the document moves onto the review list after a set period instead of into the next answer.
Responsible role

A named role, not a department. Only then is there someone who decides, when asked, whether the rule still holds.
Approved audience

Which roles may see the source. The filter acts before the answer, not after it, so confidential passages never enter the context in the first place.
Version and status

A version marker prevents two editions of the same guide from producing answers in parallel and contradicting each other.
Supersedes document

A reference to the replaced edition. Without it, old price lists remain in the knowledge base as silent competition.
Citation in the original

The path to the source file, so the answer stays verifiable and nobody has to maintain a second filing system.

The visible consequence of these fields is the citation under every answer. Internally it matters more than externally, because a wrong piece of information costs money directly here: a quote with the wrong discount, an installation following the old guide, a goodwill commitment that no longer exists. If the answer states which document and which status it came from, a person can decide in two seconds whether to rely on it. How answers are technically tied to sources, and why this is the most effective measure against invented information, is described in the article on preventing hallucinations; which content belongs in a knowledge base at all is covered in the text on building a knowledge base.

Concrete use cases by company size

The benefit depends less on the industry than on how often knowledge is passed between people. The more shifts, field appointments and stand-ins there are, the more expensive each follow-up question becomes. It is telling that 84.5 percent (IW Cologne) of companies that use or plan to use AI name relief from routine work as their goal, while only 15.3 percent (IW Cologne) of AI-using firms apply AI in customer service. Expectations already point inward; only implementation lags behind.

Onboarding new employees: most questions arise in the first weeks, and they almost always reach the same two or three experienced colleagues. An assistant that knows processes, responsibilities and forms absorbs a large share of them, without anyone feeling they are constantly interrupting.
Field service with a phone in the car: between two appointments there is no time to click through a shared drive. The questions concern availability, conditions and warranty periods, and the answer has to arrive in one sentence. How spoken input simplifies this case is shown in the article on voice input in AI chat.
Shift handovers: what was noticed on the early shift gets lost on the way to the late shift. An assistant with access to handover logs and fault reports answers the question about the state of a machine without anyone having to make a call.
Stand-in situations: holidays, illness and parental leave freeze knowledge. The assistant does not replace the person, but it answers the standard questions that would otherwise wait, and names the responsible stand-in.
Quotation under internal rules: discount tiers, minimum quantities, surcharges for special colours and exceptions for framework contracts rarely live in one place. This is exactly where an assistant pays off that states the rule and supplies the citation.
Complaints and goodwill: who may commit to what, above which amount management decides, which deadlines apply. A photo of the rating plate or the damage speeds up the assessment further, as described in the article on image upload in AI chat.

Company size mainly shifts the order of priorities. In small companies with up to around 50 employees, onboarding and stand-ins are the most urgent cases, because individual people carry entire fields of knowledge there. In the mid-size range, quotation dominates, because that is where most rules meet. From around 250 employees onwards the shift handover becomes interesting, because it happens systematically and can be measured. Usage rates match that pattern at 35.6 percent (IW Cologne) in small and 66.3 percent (IW Cologne) in large companies: the gap is a question of organisation, not of technology.

The most expensive sentence in a company is not the wrong answer. It is the question that goes to the same colleague three times a day because nobody knows where the rule is written down.

Project experience

Taking co-determination seriously instead of avoiding it

As soon as an assistant is introduced inside a company, this stops being a purely technical matter. Under Section 87 (1) no. 6 of the German Works Constitution Act, the works council has a co-determination right regarding the introduction and use of technical devices designed to monitor the conduct or performance of employees (Works Constitution Act). What matters is how that wording is interpreted: according to settled case law it is sufficient that a technical device is objectively suitable for monitoring conduct or performance (Federal Labour Court). Whether the employer intends any such evaluation is irrelevant. The scope is therefore very broad and will regularly be triggered when standalone AI systems are introduced (Bitkom).

There is one practically relevant exception: if the employer gains no access to employee data through the use, the objective suitability for monitoring is missing; the Hamburg labour court decided this for the use of a general chat service via the browser (Bitkom, decision of 16 January 2024, 24 BVGa 1/24). For an internal assistant with sign-in, roles and logging the situation is exactly the reverse: the very features that are needed technically establish co-determination. Further provisions may apply alongside, for instance Section 87 (1) no. 1 on conduct within the workplace, or Section 87 (1) no. 5 where a tool draws up holiday schedules (Bitkom). Independently of this, the works council must be informed in good time and comprehensively under Section 80 (2) of the Works Constitution Act (Works Constitution Act).

Inform early instead of justifying later: the works council is involved before the selection, not after the pilot has started. That costs two weeks and can save months.
Disclose logging: which events are stored, for how long, and who has access. Works councils generally ask to inspect log data and are in principle entitled to do so, while the principle of data minimisation applies to them as well (Bitkom).
Limit analysis explicitly: the works agreement defines whether and to what extent the system may be used for performance or conduct monitoring, and sets out corresponding limits (Bitkom).
Regulate input used as training data: whether staff input may later be evaluated for performance monitoring is unresolved; an explicit commitment that this will not happen is therefore worth considering (Bitkom).
Plan for training: since 2 February 2025, employers must take measures under Article 4 of the AI Regulation to ensure their staff have sufficient AI literacy (Regulation (EU) 2024/1689). There is catching up to do: 66 percent (Bitkom) of companies with 20 or more employees rate their workforce’s AI skills as low.
Allow an interim step: if a full works agreement cannot be reached quickly, a tolerance agreement with monitoring and audit rights for the works council can enable pilot operation (Bitkom).

Employee data protection applies in parallel. The European Court of Justice held the previous national special provision for employee data to be incompatible with Union law, so the general legal bases of the General Data Protection Regulation apply (Bitkom, judgment of 20 March 2023, C-34/21). Processing is only permitted where it is necessary for the respective purpose and thus objectively indispensable (Bitkom, judgment of 9 January 2025, C-394/23). For an internal assistant this means a clear purpose limitation: it serves the retrieval of knowledge, not monitoring. Where processing takes place and how long logs are kept belongs in the record of processing activities; the basics are on the page about data protection and hosting and in the article on GDPR in AI chat. Which transparency duties the AI Regulation triggers in chat is described in the text on AI Act labelling requirements.

What is deliberately not analysed

An internal system inevitably produces data: who asked what and when, which source answered, how long a dialogue lasted. Technically, a per-person statistic could be built from that. This is precisely the point where a sensible project tips over. As soon as staff suspect that their questions are being counted, they stop asking, and the knowledge base loses its most important feedback channel. Self-restraint is therefore not a concession to the works council but the condition for the system being used at all.

No rankings of individuals by number, type or quality of questions.
No response or handling times attributed to individual employees.
No usage rates per person, neither as a metric nor as a by-product of a report.
No evaluation of input as training data for performance or conduct monitoring.
No forwarding of individual dialogues to managers outside an agreed occasion.
Analysis is exclusively aggregated: topics without a hit, outdated sources, knowledge gaps per area.

In practice this means reports at area level and with minimum case numbers. If an analysis falls below a defined threshold, it is not shown, because otherwise a single person could be reconstructed from three cases. That threshold belongs in the works agreement, not in a verbal assurance. The professional value remains untouched: for maintaining the knowledge base, the information that twelve questions about the goodwill limit went unanswered is worth many times more than the information about who asked them.

The one metric that counts

The benefit is not measured by the number of questions but by the share of questions that were left without a sourced answer. That rate falls as the knowledge base improves and rises as documents age. It says nothing about individual people and everything about the state of internal knowledge.

Operations: who maintains the knowledge base

An internal assistant is not a project with a completion date but an operational asset. The most common reason why an initially praised system convinces nobody six months later is not the model but a knowledge base that lags behind the business. The effort involved is manageable, but it has to belong to someone. In practice a split by department works best: sales maintains conditions, engineering maintains instructions, HR maintains forms and deadlines. IT provides the framework but does not decide on content.

Expiry monitor

A list of all documents whose validity date ends within the next 30 days. It goes to the responsible role, not to a distribution list.
Questions without answers

All enquiries for which no sourced answer was found, aggregated by topic. This is the most important worklist for the editorial side.
Contradiction report

A button under every answer that lets staff flag an error. The report reaches the responsible role, not a shared mailbox.
Role maintenance

Joiners, leavers and moves between departments change access rights. Without a regular reconciliation, silent access accumulates.
Quarterly review

Once a quarter the departments review the ten most used sources. That does not replace ongoing maintenance but catches creeping errors.
Aggregated report

One report per area with hit rate, open topics and expired sources. Without personal reference and with a minimum case number.

The benefit can be measured without any monitoring. Four figures are meaningful: the share of questions with a sourced answer, the number of active sources with a valid date, the number of reported contradictions and the topics that repeatedly stay without a hit. These values describe the state of knowledge, not the behaviour of people. How chat histories can be evaluated methodically without sliding into per-person statistics is described in the article on evaluating chat histories; the feature overview is on the page about conversation analytics.

From the pilot area to regular operation

The most effective scope is a single area with clearly delimited knowledge and a measurable pain point. Equipping an entire company at once sounds efficient but produces a knowledge base nobody can review any more, and a permissions catalogue that would have to be finished before the first benefit appears. The following sequence has proven itself in this order.

Define the pilot area: a team with a high question frequency and a manageable document inventory, typically inside sales, service intake or installation planning.
Review the document inventory: what really exists, what is duplicated, what is outdated. This review regularly reveals that several editions of the same rule are in circulation.
Define roles and rights: two to four roles are enough at the start. Every source receives an approved audience before it is ingested.
Involve the works council: clarify participation, the scope of logging and the limits of analysis, either as a works agreement or initially as a tolerance agreement with audit rights.
Accept test cases: 30 to 50 real questions from the pilot area's daily work, each with an expected source. What a structured acceptance looks like is shown in the article on going live with an AI assistant.
Run for four to six weeks: no expansion, no new sources. Measure the hit rate, open topics and reported contradictions.
Decide and roll out: only then does the second area follow, with the lessons from the first. Connecting existing systems follows the same technical integration as externally, which does not differ fundamentally for internal cases.

The cost side is more sober than many expect. The largest item is rarely the technology but the review and preparation of the document inventory, and that effort occurs once. After that, ongoing maintenance dominates, measured in hours per month rather than in project budgets. For classifying effort against value, the article on cost, benefit and return provides the calculation paths. The fact that 62.7 percent (IW Cologne) of companies name the hard-to-assess benefit and 61.9 percent (IW Cologne) the necessary staff training as obstacles argues precisely for this limited scope: a pilot area answers both questions with numbers rather than assumptions.

XICBOT builds the knowledge base for internal assistants from what is already there: documents, handbooks, price lists, process descriptions and, in the Custom package, connected systems. That includes roles for the logins to the customer area, hosting in Germany and answers with a source reference. Building knowledge base and training follows the same principle as for a customer assistant. The knowledge base keeps no visibility per role: whatever has been ingested is available to every assistant in the account, which is why the approved audience of a source is settled before it is ingested. Where special cases are needed beyond that, such as spoken input in field service or a photo of a rating plate, they can be added as a custom function without rebuilding the running assistant. What makes sense for your company is something we clarify in an initial conversation about your internal assistant.

A realistic expectation

An internal assistant replaces neither onboarding nor expertise. It shortens the path to information that already exists in the company and makes visible where it is missing. The gain does not appear on day one but at the moment when the knowledge base is more current than the folder on the shared drive.

NoteSources and studies

This article is based on data from: Bitkom e. V. (press release on the study on the digitalisation of the German economy of 11 March 2026, a representative survey of 604 companies with 20 or more employees conducted by Bitkom Research in calendar weeks 2 to 6 of 2026: AI use, planning, competitive position, investment intentions and obstacles), Bitkom e. V. (press release „Erstmals nutzt die Mehrheit der Unternehmen KI“ of 14 September 2026, a representative survey of 603 companies with 20 or more employees conducted by Bitkom Research in calendar weeks 28 to 33 of 2026: assessment of staff AI skills), Bitkom e. V. (guide „Künstliche Intelligenz und Mitbestimmung — Eckpfeiler einer Betriebsvereinbarung für den KI-Einsatz im Unternehmen“, February 2026, including the decisions discussed there of the Hamburg labour court of 16 January 2024, 24 BVGa 1/24, of the Hesse regional labour court of 5 December 2024, 5 TaBV 4/24, and the judgments of the European Court of Justice of 20 March 2023, C-34/21, and of 9 January 2025, C-394/23), the German Works Constitution Act (Section 87 (1) no. 6 and, in addition, Section 87 (1) nos. 1 and 5 and Section 80 (2)), the settled case law of the German Federal Labour Court on co-determination regarding technical devices (objective suitability for monitoring conduct or performance), the Institut der deutschen Wirtschaft Köln (IW report „Wettbewerbsfaktor Künstliche Intelligenz“ by Barbara Engels, Marc Scheufen and Edgar Schmitz of 4 July 2025, based on the IW Future Panel with 1,038 companies surveyed) as well as Regulation (EU) 2024/1689 on artificial intelligence (Article 4 on AI literacy and Article 26 (7) on informing workers' representatives). The figures quoted may change and can differ depending on the source and the point in time. This article gives a professional overview and does not replace individual legal or data protection advice.

Frequent questions

What distinguishes an internal AI assistant from one on the website?

The technology is the same; the content and the framework are not. Internal sources are less structured, change more often and are partly confidential, which is why a permissions model belongs in front of the answer: each role should see only the sources approved for it. Metadata per document is added, meaning a validity date, a responsible role and an approved audience. Legally, co-determination and employee data protection come into play, which do not apply to a purely customer-facing assistant. Success is also measured differently, namely by the share of questions with a sourced answer rather than by enquiries or deals.

Does the works council have to be involved even if nobody intends to monitor staff?

As a rule, yes. Under Section 87 (1) no. 6 of the German Works Constitution Act there is a co-determination right for technical devices designed to monitor conduct or performance, and according to settled case law the objective suitability for doing so is already sufficient (Federal Labour Court). The employer's intention is irrelevant. An internal assistant with sign-in, roles and logging typically meets that criterion. In practice, early involvement is the faster route anyway, because the scope of logging and the limits of analysis can then be defined jointly rather than negotiated later.

Which analyses make sense and which should be excluded?

Aggregated analyses at area level are useful and unproblematic: topics without a hit, outdated sources, reported contradictions and the overall hit rate. Rankings of individuals, response times per employee and usage rates per person should be excluded. In addition, a minimum case number is advisable, below which no analysis is displayed, so that nobody can be reconstructed from a handful of cases. Whether input may later be evaluated as training data for performance monitoring is legally unresolved; an explicit commitment that this will not happen is therefore common (Bitkom).

How do you prevent someone from seeing content they are not authorised to see?

The permissions filter acts before answer generation, not afterwards. Every source carries an approved audience, and only sources matching the asker's role enter the context of a request. Hiding passages after the fact is not an equivalent solution, because the content has already been processed by then. Maintaining the roles themselves is part of it: joiners, leavers and department moves have to be reconciled regularly, otherwise silent access accumulates over months. Protection against manipulative input belongs to this as well, so that permissions cannot be undermined through the dialogue.

How do you spot outdated content in the knowledge base?

Through metadata rather than memory. Every document receives a validity date and a responsible role; from that comes a list of sources expiring within the next 30 days. The second route is feedback from daily work: a button under every answer that reports a contradiction delivers the most precise hints, because it is triggered exactly where the rule no longer fits. The third route consists of questions that repeatedly stay without a sourced answer; they reveal gaps that nobody has reported yet.

How large should the pilot area be and how long does it run?

A single team with a high question frequency and a manageable document inventory is enough, typically inside sales, service intake or installation planning. Four to six weeks of operation without expansion provide enough data for a decision, provided 30 to 50 real test questions with an expected source were accepted beforehand. It is important not to add new sources or widen the user group during that period, because otherwise it becomes impossible to attribute an improvement or deterioration. The second area follows afterwards, with the lessons from the first.

Ask it yourself, Assistant of this website

Automated assistant

Settings