Skip to content

A worked example for letting staff search internal documents

One job taken through the check. The brief below is exactly what the check produces.

Your brief

The job: Let staff search our internal documents

Done now by: Everyone, by searching shared drives and asking colleaguesEvery week or moreWorked out on 5 October 2026

Is this worth testing?

Worth testing.

A job this frequent gives a test enough cases to judge it by.

Test first

Software you already have

Nobody has tried the software you already have, and it's the least new work. Test it first.

All four routes

  • Software you already haveCheck firstTest a product you already have against your answers.
  • An app built on an outside AI serviceIf a gap remainsWorth a look only for a named gap, and only if sending work to an outside AI service is allowed.
  • A dedicated cloud setupNo need shown yetShow why a separately hosted setup is needed before you commission one.
  • Hardware in your buildingNo need shown yetShow why it has to run in your building, and who could keep it running.

Do you need a DPIA?

Plan for a DPIA.

It will use personal data. The ICO says most AI use with personal data is likely to be high risk, which makes a DPIA a legal requirement.

Use the DPIA template

Not legal advice. Your data protection officer or adviser decides.

The data rules

  • Personal data about staff or customers goes in.
  • Each person should only see what they can open today.
  • An outside AI service may be used, once someone has reviewed it.
  • UK processing is preferred, but it isn't a rule.

Settle these first

  • Agree a short AI policy before the test. People already use AI at work without one.Use the AI policy template
  • Test that each person only sees what they're allowed to see.
  • Get a security review before anything goes live.
  • Name who will look after support, changes and running costs.

The first test

  1. 1Time "Let staff search our internal documents" as it's done now, for a week or two.
  2. 2Pick one person to run the test and one to check every output.
  3. 3Use your own recent documents, with the access rules above in place.
  4. 4Run it for four weeks, then compare the time taken and the quality.
  5. 5Keep going only if it saves time and the work is as good.

What success looks like

Answers only use documents the person could already open, and show where each answer came from.

From Pilot Sheet, pilotsheet.co.uk. It doesn't rank suppliers or judge anyone's security.

The answers behind it

Change one answer and the brief changes with it.

What would you like AI to do?
Let staff search our internal documents
Who does it now?
Everyone, by searching shared drives and asking colleagues
How often does the job come up?
Every week or more
What information would go into it?
Names or other personal data about staff or customers
Who should be able to see what?
Each person should only see what they can open today
Can the work go to an approved outside AI service?
Possibly, once someone has reviewed it
Does it have to be processed in the UK?
We'd prefer it, but it isn't a rule
Does it have to work offline?
No
Where do your email and files live?
Microsoft 365
Has anyone tried the AI features in software you already pay for?
Not yet
Does anyone use ChatGPT, Microsoft 365 Copilot or similar for work already?
Yes, but we haven't agreed any rules
Who will look after it once it's live?
Nobody yet
Who will check its work before anyone relies on it?
We have someone in mind
What would count as success?
Answers only use documents the person could already open, and show where each answer came from.