Private AI in practice: use cases for companies and law firms

Employees paste documents into public AI chats because they have no other tool. The company doesn't know what data has gone outside.

The assistant uses permissions from Active Directory or Microsoft 365. HR sees HR documents, sales reps their own contracts, and management the reports.

Documents containing personal data must not go to tools without a data processing agreement and control over processing.

Before analysis, the system can mask national ID numbers (PESEL), account numbers, addresses and names. Processing takes place entirely on the company's infrastructure.

When using public AI tools, there is no record of who asked what and on what basis a decision was made.

Every query, the sources used and the answer are logged on the company's server. An administrator can review and export them for audits.

Before signing a contract, someone has to read it in full and compare it with the terms the company usually accepts.

The assistant compares the contract with the company's standards and flags deviations: liability, penalties, payment terms, governing law. The responsible person makes the decision.

The other party sends back an amended contract without tracked changes. It has to be read again from scratch.

The system compares versions, shows all changes and briefly describes what they mean, e.g. a shifted deadline or a changed liability cap.

Old documents are scans without text. They cannot be searched or used in the knowledge base.

Local OCR turns scans into searchable text and adds them to the index with the date, document type and counterparty.

Answering a question about a customer's history requires checking several systems and exporting to Excel.

The assistant pulls data from the ERP and CRM via API and answers in one place: orders, complaints, commercial terms, open receivables.

Company knowledge sits in folders, email threads and attachments that only their author knows about.

Selected libraries, drives and mailboxes are indexed with permissions preserved. New documents are added to the index automatically.

Purchase invoices from KSeF have to be described and assigned to projects or accounts by hand.

An n8n workflow downloads invoices from KSeF, and the local model suggests a description and assignment. The accountant approves, and the data never leaves the server.

Using external AI services requires analysing where and by whom data is processed.

With an on-premise implementation, data is processed on the company's infrastructure. I document data flows for the record of processing activities.

Companies don't know whether their AI use cases are subject to new obligations and how to document them.

At the start, we describe each use case, its purpose and risk level. For internal use cases, we prepare documentation and AI literacy training.

There are no rules on what may be pasted into AI tools and who is responsible for the output.

We prepare a policy: what data can be processed, who approves outputs, how to report errors. The assistant reminds users of the rules in the interface.