The business that remembers
- Felix Langrock
- 1 October 2026
- BCCG Commentary
Why AI knowledge systems are the biggest lever small firms have had in years, and the one question to settle before signing.
A joinery with nine employees. What the business knows lives in four places: in the master craftsman’s head, in the timber supplier’s voice messages, in a folder of quotes going back to 2019, and on the phone the apprentice uses to photograph the sites. When a customer asks what guarantee came with her staircase, the answer takes a day. Not because nobody knows it, but because nobody can find it.
This is where a class of software that has grown out of the large language models
over the past two years comes in: AI knowledge systems. They read what a business already has, meaning invoices, quotes, emails, voice messages, photos and calendars, and connect it into a memory that can be asked questions. “What does a staircase in beech cost?” “What guarantee do we give on our work?” “When did we last deliver to the Berger family?” The answer arrives in seconds, with the source document beside it.
What that changes for a small firm
Large companies have systems, departments and consultants for questions like
these. Small and medium-sized firms have so far had a choice between an ERP project that takes two years and bends the business to fit the software, and the status quo. Knowledge systems turn that around. Four features make the difference:
No data entry. The system does not require the business to type its work into forms. It reads the voice message, the scanned delivery note and the Excel price list as they are. Getting started costs no reorganisation, only access to the inbox.
Answers with evidence. Unlike a chatbot that merely sounds plausible, a knowledge system shows, for every answer, which document it came from. For a trade business that is the difference between a gimmick and a tool you can base a commitment on.
Drafts, not decisions. The latest generation of these systems works with agents that make proposals of their own accord: a quote for the oak staircase, a reply to the Berger family, a note that the 2024 price list has expired. None of it leaves the building until the owner has approved it. The business gets an assistant that prepares the work, not a machine that acts.
Knowledge that stays. When the master craftsman retires, or the office manager
who has “kept everything in her head” for fifteen years hands in her notice, the knowledge stays with the firm. For the succession question that, on the IfM Bonn’s estimate, around 37,000 German businesses face every year, that is not a side effect. It is the point.
All of this without an IT department or a server in the basement, at a running cost
rather than a project budget. The lever that large companies have been paying dearly for over the past decade has become available to a nine-person firm.
The customers’ customers
The very feature that makes these systems valuable, connecting everything with
everything, raises a data protection question that no off-the-shelf privacy notice
answers.
A firm’s invoices, emails and voice messages are full of people: customers, suppliers, their employees, the neighbour who complained about the noise. These people deal with the business, not with the software provider. They do not know the system exists, and they have no channel to whoever runs it. The GDPR calls the business the controller and the provider the processor. The business remains responsible even though the technology runs elsewhere.
Two things are new. First, the GDPR requires the purpose of any processing to be
“specified” and “explicit” in advance (Article 5(1)(b)). A knowledge system, at the moment it reads a document, does not yet know which question will be asked later. The purpose only comes into being at the query. Second, and more important in practice: erasure. Invoices the business has to keep for eight years anyway. The erasure question arises for everything else: the voice message, the note on the complaint, the photo from the site. Take such a note out of a folder and it is gone. Take it out of a knowledge system and you have removed a document. But the system has long since built connections from that document: the Berger family, oak staircase, complaint in March. Whether those connections disappear with the document is decided by the architecture of the system, not by the delete button.
So when a customer demands erasure of her data under Article 17 GDPR, and no retention duty stands in the way, the business must be able to answer a question only its provider can answer for it: after the deletion, does the system still know anything about this person?
Three questions before you sign
None of this argues against using these systems. It argues for asking three questions before the contract rather than after it.
1. Who carries what? A data processing agreement under Article 28 GDPR is mandatory, not a formality. Among other things it must settle what happens to the data when the contract ends, and it should make clear where the data are held and who has access.
2. The erasure test. Have the provider demonstrate what happens when a customer is deleted, then ask the system about that customer. If it still answers, the erasure has not been carried out. Put that test into the contract as an acceptance criterion. Whether passing it is legally sufficient is an open question. Failing it is certainly not.
3. The approval gate. No quote, no email, no price change leaves the business
without a human click. That is not just good management. It takes off the table the question whether a machine is deciding about people, something the GDPR permits under Article 22 only in narrow circumstances, and it is the reason the owner sleeps at night.
Add a fourth, unspectacular point: the privacy notice given to customers has to mention the new processing. A few sentences are enough. Their absence is the most common mistake.
On both sides of the Channel
For British-German businesses there is some reassurance. The UK’s Data (Use and Access) Act 2025 has loosened the UK GDPR in places, but it has left both the right to erasure and the division of roles between controller and processor untouched. A firm in Manchester deploying a knowledge system asks itself the same three questions as one in Magdeburg, and anyone with customers on both sides is subject to both regimes anyway. The answers can be worked out once and used twice.
The lever is real. A business that can question its own knowledge works differently: faster, less dependent on individual heads, on evidence rather than instinct. The question is not whether small and medium-sized firms will adopt these systems. The question is whether they ask the three questions first.
Felix Langrock
Vice-President, Anglo-German Law Society e.V.
Felix Langrock reads law in Berlin (LL.B., King’s College London), is Vice-President of the Anglo-German Law Society e.V. and co-founder of a Berlin company building AI knowledge systems for small and medium-sized businesses. The Anglo-German Law Society is a member of the BCCG.