It's 9pm, the proposal is due tomorrow, and a senior is searching Slack for the deck
Here is the scene every consulting firm knows. A new opportunity lands. A senior consultant opens the shared drive looking for the right case study, the current rate card, and the SOW template that matches this engagement type. They find four versions of the case study, two of which still carry a former client's name they're not allowed to cite. The rate card they grab is from the last fiscal year. So instead of trusting any of it, they ping a principal at 9pm, the principal rebuilds half the proposal from memory, and the firm's best people spend their evenings being a human search engine for their own collateral.
That is not a document shortage. Consulting firms have the opposite problem: a sales enablement library so deep that nobody can find the current, approved, citeable version fast enough to use it in front of a prospect. And the firms big enough to feel this pain are exactly the ones now adopting AI. The Census Bureau reported in May 2026 that adoption is materially higher in larger firms, including 32% of firms with 100 to 249 employees and 37% of firms with at least 250 employees. A 60-person practice has enough accumulated proposals, decks, and case studies to drown in, but not enough governance to keep them trustworthy. That gap is the whole problem.
The dangerous answer isn't "no result" — it's a confident wrong one
Point a generic chatbot at that shared drive and you have made the problem worse, not better. A search box that returns nothing is annoying. A retrieval system that confidently surfaces the deprecated case study — the one naming a client you're contractually barred from referencing, or quoting a result the firm no longer stands behind — is a liability you've now automated. In a sales library, the unit of risk is the approved version, the permission boundary, and the citation.
So governance comes before retrieval, not after. Before anything gets indexed, the work is unglamorous: kill the obsolete proposal versions, separate restricted client material from reusable collateral, and tag every asset by engagement type, owner, effective date, and whether it's cleared for external use. CISA's guidance on securing the data used to train and operate AI systems maps cleanly onto this: access control, source approval, and logging are prerequisites, not enhancements. Then structure the assistant on the NIST AI Risk Management Framework — map the proposal workflow, measure whether retrieved collateral is current and citeable, assign an owner for the library, and manage changes as rate cards and case studies get updated. The assistant answers only from approved materials, shows the source and its effective date, flags when no cleared version exists, and routes the gap to a named owner instead of inventing a result. That's the architecture of a real AI knowledge system, not a demo.
Write the twenty questions before you write a check to a vendor
Don't start with tooling. Start with a retrieval test set. List the twenty questions your consultants actually ask the library: "What's the current rate card for a fixed-fee implementation?" "Do we have a case study in this vertical we're cleared to share?" "Which SOW template matches a staff-aug engagement?" For each one, identify the single approved source. Then score whether the system returns that source — and whether it correctly refuses to surface restricted material. That test set is your acceptance criteria; if a tool can't pass it, the demo doesn't matter.
This discipline is also why most pilots stall. Deloitte's 2026 enterprise research found only 25% of leaders moved 40% or more of their AI pilots into production — the difference is almost always a named production owner versus a demo sponsor who disappears once the applause stops. Once retrieval is stable, measure the things that pay for the system: senior interruptions avoided, proposal turnaround time, and the share of collateral pulled that was current and cleared. When you evaluate vendors, treat privacy, retention, and data-use terms as gating criteria, not fine print. The build mechanics are in our guide to building an internal knowledge assistant, and the AI Transformation Blueprint is how a working sales-library system becomes the first proof point in a broader operating roadmap.
