- RAG connects a language model to your documents: answers come from your knowledge, not the internet.
- Quality stands and falls with source preparation - not with model size.
- GDPR-compliant is feasible: EU hosting or fully on-premise with open-source models.
The problem: knowledge in folders and heads
Every company has it: the folder jungle of quotes, contracts, manuals and minutes - and the two colleagues who are the only ones who know where anything is. The result: the same questions asked again and again, the same documents hunted again and again.
A language model alone does not solve this. ChatGPT does not know your contracts - and should not. Enter RAG.
How RAG works
RAG stands for retrieval-augmented generation - in plain words: look it up first, answer second. The flow in three steps:
- 1. Prepare: your documents are split into sections and stored as searchable vectors - once, and on every change.
- 2. Retrieve: for a question, the system pulls the most relevant sections from your corpus.
- 3. Answer: the language model formulates the answer exclusively from those passages - ideally with source references.
The decisive difference to a plain chatbot: the model is not trained on your data. Your documents stay in your infrastructure - the model only sees the sections matching the current question.
Where RAG projects actually fail
Rarely at the model, almost always at the data. Outdated document versions, scanner PDFs without a text layer, knowledge that only exists in email threads: an assistant can only answer as well as the corpus allows.
From our document projects we know: the OCR and preparation step deserves more attention than model selection. If you process scanned documents, you need a reading layer that survives handwriting and crooked scans - only then is the model discussion worth having.
"Data foundation first, model second. Reverse the order and you build a very expensive random generator."
DUNA engineering principle
Privacy: the good news
RAG can be built GDPR-friendly: EU hosting, processing agreements in place, no training-data leakage - and for sensitive cases open-source models run fully on-premise. The architecture question is answered by protection needs, not hype.
The realistic entry
A pilot with one clearly scoped knowledge domain - FAQ, product data, process documentation - stands in two to four weeks. After that, numbers decide: how often is it asked, how often is the answer right, how much search time disappears. What proves itself gets expanded.
