AI and business documents: knowing where your PDFs are is not enough

When a platform extracts, organises and reuses information from our documents, we need to understand more than where it stores the files. We need to know what it does with their content.

The simplest picture of artificial intelligence is still a conversation: I write a question and receive an answer.

But business tools can do considerably more.

We can upload documents, connect folders and add entire archives to platforms that read them, classify them and turn them into a searchable source of information.

That makes it possible to find background material, compare contracts, reconstruct what happened in a matter or prepare reports using the organisation's documentation.

It is an extraordinarily useful capability. But it changes what we need to check before signing up.

The document is only the starting point

Imagine adding two hundred case files to a platform.

The system may store the original PDFs, extract their text, convert it into a format such as Markdown and divide it into chunks. It may then add that content to databases and create indexes to find it.

Some systems use numerical representations — vectors — that allow searches by meaning, not just exact words. A query about “early termination” might therefore retrieve a passage about “ending the contract before it expires”.

When the system retrieves those passages and provides them to a model to prepare an answer, we are looking at a common form of RAG: retrieval-augmented generation.

We do not need to master the terminology to understand the consequence.

The PDF is still a file, but its information may be moving through several parts of the system.

It may appear as extracted text, retrievable chunks, summaries, answers or new documents. These are not always complete copies, but they are new ways of retaining or using the content.

That is why asking “where are my PDFs stored?” is no longer enough.

The information multiplies

A confidential clause does not stop being confidential when it becomes text. A business strategy remains sensitive when it appears in a summary. And an answer can bring together information that was previously scattered across many documents.

That reorganisation is precisely what makes the tool valuable.

But it also means we need to understand how, where and for what purposes the extracted information is processed, not just where the original is stored.

What is retained? What is sent to the model? What can each user retrieve? Is the content used for other purposes? What happens to the derived material when we delete the document?

We should not assume that deleting the visible PDF automatically removes everything the system has created from it.

Two things to examine before signing up

The first is what the platform actually does.

We need a comprehensible explanation of the information's journey: from receiving the document to delivering an answer, including extraction, storage, search systems and the external services it uses.

The second is what commitments the provider makes.

What it may use that information for, how it protects personal and confidential data, who can access it, how long it retains it and how deletion is handled.

A technical explanation does not replace the contract. Nor does a contract, by itself, explain how the system works.

We need both.

Who sits in between matters too

Many specialised platforms use models from other companies.

That intermediary may be the one receiving the documents, extracting the text, organising the knowledge base and deciding what information to send to the model.

Knowing the AI provider's terms is therefore not enough. We also need to know what the platform we have contracted with directly does and what obligations it accepts.

That does not make the intermediary a problem. It may provide highly valuable features and controls. But it is part of our information's journey and needs to be included in the assessment.

A one-off query is not a permanent archive

Uploading three documents for a one-off task does not create the same exposure as keeping two hundred complete case files on a platform for years.

The volume, retention period, people with access and amount of information that can be connected all change.

That is why a successful trial with a few PDFs is not enough to decide to incorporate the organisation's entire archive.

First, the service needs to be assessed: due diligence proportionate to what we are going to entrust to it.

Sharing less is also an option

In some cases, it is worth considering anonymisation or pseudonymisation before sending the information, provided it can be done properly without destroying what the task needs.

Not as a substitute for the provider's obligations, but as an additional protection.

Even when everyone fulfils their commitments, it may be sensible to avoid giving them information they do not need. Especially when the content will be transformed and distributed across different components of the system.

Use the capability, understand the journey

This is not about fearing the cloud or distrusting AI services on principle.

It is about understanding what we are contracting for.

We used to ask where the documents would be stored. Now we also need to ask what will be built from the information they contain.

Because we are not simply entrusting a few PDFs. We are authorising a way of processing, organising and using our organisation's knowledge.