The PTO Policy Exists in Four Places. Three Are Wrong.
Here is the real shape of internal knowledge in a 120-person company. The current PTO policy lives in an HR PDF from this March. An older version is still pinned in a Slack channel. A summary of it sits in a 2024 onboarding deck. And a manager's personal interpretation is in a doc titled "team notes." Ask any AI search tool "how much PTO do I get after three years," and the question that decides everything is not whether it can read the documents. It is which one it answers from.
That is the difference between a chat pilot and a workflow you can trust. ChatGPT Business gives a team a shared workspace and will happily summarize whatever documents you upload to it. What it does not do on its own is know that the March PDF supersedes the onboarding deck, that the Slack version is dead, or that "team notes" was never an authoritative source in the first place. It answers from what is in front of it, fluently, whether or not that source is the live one.
For internal knowledge search at this company size, freshness and authority are the whole game. RSM's middle-market survey, San Francisco Fed research, and the OECD's work on smaller firms all point to the same thing: AI pays off for companies this size when it removes interruptions without creating new risk. A search tool that returns last year's expense limit with total confidence does not remove an interruption. It buries one — until someone files the wrong reimbursement and finance has to unwind it.
Two Hard Questions: Who Can See It, and Which Version Is Live
If you only test one thing before choosing a tool, test this: ask a question where the right answer is gated by permission, and a question where two versions of the document disagree. Both break the naive version, and both are common in a company with a few hundred people and no formal document hierarchy.
Permission is the sharper edge. Internal search that reads across a shared drive can surface a comp band, a customer's contract terms, a security incident write-up, or a board memo to someone who was never meant to see it — and the answer looks completely legitimate because the AI cited a real document. CISA's AI data-security guidance exists precisely because retrieval is where the leak happens, not generation. ChatGPT Business with reviewed enterprise data controls is a reasonable home for a narrow, low-sensitivity source set — a product FAQ, a public-facing playbook. It is the wrong home for anything where "who is asking" changes the correct answer.
Version conflict is what pushes you toward a custom workflow. The thing a build buys you is not a smarter model — it is plumbing the chat tool does not have: retrieval that respects each person's existing access, a way to mark one document as canonical and suppress the rest, a citation on every answer so the reader can check the source date themselves, and a route to a named owner when the sources disagree. NIST's AI Risk Management Framework is a useful checklist here for accountability and monitoring, but the operating rule is simpler. Pick one document per topic that is allowed to answer. Everything else is reference, not authority. If you cannot say which version is canonical for PTO, expense limits, or the refund policy, no tool will untangle that for you — and a fluent tool will make the mess harder to spot.
Run It on One Domain. Watch the Questions That Get No Answer.
Pick a single, contained domain to start — product documentation or one policy area, not the whole intranet. The reason to go narrow first is that the most valuable signal from a knowledge-search pilot is not the answers it gets right. It is the questions it can't answer or routes to a human. Each one is a hole in your source base: a policy that exists only in someone's head, an SOP that contradicts itself, a topic three teams describe three ways. Deloitte's State of AI in the Enterprise 2026 frames the move from pilot to production as the hard part; for knowledge search, production-readiness shows up as a shrinking list of unanswered questions over time.
Track five numbers from week one: how often people accept the answer instead of re-asking a coworker, what share of answers carry a working citation, how many stale-source flags fire, how many questions escalate to an owner, and which questions keep coming back unanswered. That last column is your content backlog. If "how do I request a security exception" gets asked nine times in a month and never resolves cleanly, the fix is a document with a named owner — not a better prompt.
The honest decision at the end of a pilot is one of three: keep it in ChatGPT Business because the domain is small and safe, build the custom workflow because permissions and version control actually decide trust, or pause and clean up the sources before automating anything. Make that call on acceptance rate, citation coverage, and stale-source flags — not on how good the demo felt. When you're ready to map which domain to do first and what it takes to do it right, that's the work behind the AI roadmap.
