--- title: "What Is RAG? Enterprise Search Over Internal Documents (2026)" url: https://alicelabs.ai/en/insights/what-is-rag description: "What is RAG? How retrieval-augmented generation gives Swedish companies cited, permission-aware answers from internal documents: architecture, GDPR, costs." lang: en --- Alice Labs (https://alicelabs.ai/en/) Services What we do (https://alicelabs.ai/#welcome)About Alice (https://alicelabs.ai/#who-we-are)Case (https://alicelabs.ai/en/case)Insights (https://alicelabs.ai/en/insights)Contact (https://alicelabs.ai/#email-form) AI Implementation Definition Fresh Last reviewed: 29 September 2026 · 8d ago # RAG (Retrieval-Augmented Generation) /ræɡ/ RAG is an AI architecture that retrieves relevant passages from an external knowledge source, such as a company's internal documents, and passes them to a large language model so that its answer is grounded in, and can cite, those sources. Knowledge is updated by re-indexing documents, not by retraining the model. Also known as: Retrieval-Augmented Generation · Retrieval-augmented generation · RAG pipeline · RAG architecture · Grounded generation · Permission-aware enterprise search ## TL;DR Quick Answer Cited by AI > RAG retrieves passages from your own documents, filters them by the user's permissions and lets an LLM answer from them with citations. Image: Linus Ingemarsson - Author at Alice Labs (https://alicelabs.ai/images/linus-ingemarsson.png) Written by Linus Ingemarsson: https://www.linkedin.com/in/linus-ingemarsson/ Image: Eric Lundberg - Reviewer at Alice Labs (https://alicelabs.ai/images/eric-lundberg.png) Reviewed by Eric Lundberg: https://www.linkedin.com/in/eric-lundberg-3530451bb/ Published April 16, 2026 · Updated September 29, 2026 11 min read ## In context Internal policy search "'Instead of opening five SharePoint sites, employees ask the assistant which travel policy applies and get an answer that links to the exact section of the current policy document.'" Permission-aware retrieval "'The RAG index stores each document's access list, so a question from someone outside HR never retrieves chunks from HR-only folders, even if the question matches them perfectly.'" Architecture decision "'Our content already lives in Microsoft 365 and permissions are clean, so we started with Copilot and only built a custom Azure AI Search pipeline for the engineering archive that Copilot does not reach.'" RAG vs fine-tuning "'We chose RAG over fine-tuning because our product documentation changes every week and every answer has to point to its source.'" ## Related terms RAG vs fine-tuning: https://alicelabs.ai/en/insights/rag-vs-fine-tuning Vector database: https://alicelabs.ai/en/insights/what-is-vector-database Security trimming AI Agent: https://alicelabs.ai/en/insights/what-is-an-ai-agent AI knowledge base: https://alicelabs.ai/en/ai-knowledge-base ## Key points - RAG answers questions from your own documents: it retrieves relevant passages first and lets the language model write an answer grounded in them, with citations. - In enterprise search the hard part is not the model but retrieval quality and permissions. Every chunk in the index must carry the access rights of its source document. - Microsoft 365 Copilot and the Microsoft Search API only return content the signed-in user can already access, so overshared SharePoint sites become overshared AI answers. - Restricted SharePoint Search is retiring (no new enablement from 31 July 2026). Microsoft points to Restricted Content Discovery, SharePoint Advanced Management and Purview instead. None of them change permissions. - For Swedish companies, GDPR applies as soon as indexed documents contain personal data. IMY's guidance on GDPR and AI is the starting point; EU Data Boundary and region choice cover where data is processed. - Measure RAG on three things before rollout: does retrieval find the right passages, is the answer faithful to them, and do the citations point to the right source. 01 / 10 Section ## What is RAG, in one paragraph? In short RAG is a pattern where an AI system searches a knowledge source, usually internal documents, for relevant passages and gives them to a language model that answers from them and cites them. A language model only knows its training data, not your travel policy or last quarter's board decision. RAG adds a search step before the answer: the system retrieves the most relevant passages from your documents and places them in the model's context, so the answer rests on your sources. The term comes from a 2020 paper by Lewis et al. at Facebook AI Research. For Swedish companies the most common use is internal knowledge search: employees ask questions in Swedish or English across SharePoint, Teams, Confluence, file shares, intranets and ticket systems, and get a short answer with links to the documents it came from. The same pattern powers customer-facing assistants and AI agents (https://alicelabs.ai/en/ai-agents) that need company knowledge to act. 02 / 10 Section ## How does RAG work, step by step? In short RAG ingests documents, chunks them, embeds each chunk, indexes chunks with metadata and permissions, retrieves the best chunks per question and generates an answer citing them. Every RAG system follows the same seven steps, whatever product or framework it uses: 1. **Ingest.** Connectors read documents from source systems and extract text, together with metadata such as owner, date and the document's access list. 2. **Chunking.** Documents are split into passages small enough to be precise but large enough to keep their meaning, usually along headings, each keeping a reference to its parent document. 3. **Embeddings.** An embedding model converts each chunk into a vector representing its meaning, so a question and a matching passage end up close even with different wording. For Swedish content, test multilingual models on your own documents. 4. **Index.** Vectors, original text, metadata and permissions are stored in a search index or vector database (https://alicelabs.ai/en/insights/what-is-vector-database), usually with hybrid search (vectors plus keywords) because product codes and names are poorly served by vectors alone. 5. **Retrieval.** The system embeds the question, applies filters (permissions first), runs the search and often re-ranks the top results. 6. **Generation.** The best chunks go into the prompt with instructions: answer only from the sources, and say so when they do not answer the question. 7. **Citations.** Each claim links to the document it came from, so users can verify and the organization can audit. When a document is updated, deleted or its permissions change, the index must follow, or the assistant answers from outdated or no longer permitted content. 03 / 10 Section ## RAG vs fine-tuning vs long context: which should you use? In short Use RAG for large, changing document sets with citations. Use fine-tuning to change behavior or format, not to add facts. Use long context for a few whole documents at once. These three approaches are often presented as alternatives, but they solve different problems. A deeper comparison is in RAG vs fine-tuning (https://alicelabs.ai/en/insights/rag-vs-fine-tuning). | Approach | What it changes | Good for | Weak at | | --- | --- | --- | --- | | RAG | What the model sees per question | Large, changing document sets, citations, per-user permissions | Questions that need reasoning over an entire corpus at once | | Fine-tuning | The model's weights | Tone, output format, domain-specific behavior | Adding or updating facts, traceability, access control | | Long context | How much text is sent in one prompt | Analyzing a handful of known documents in full | Searching thousands of documents, cost and latency per question | They combine well: RAG can retrieve whole documents into a long context, and a fine-tuned model can be the generator. But only retrieval can enforce who sees which document, so internal search starts with RAG. 04 / 10 Section ## How does permission-aware retrieval and security trimming work? In short Security trimming removes every result the user may not open before the model sees it. Copilot and the Graph Search API run as the signed-in user; in a custom index, each chunk must carry its document's access list. An enterprise assistant must never answer from a document the asker cannot open. How that is enforced depends on where retrieval happens. - **Microsoft 365 Copilot and Microsoft Graph.** Microsoft states that Copilot only surfaces organizational data to which the user has at least view permission, and the Microsoft Search API in Microsoft Graph runs in the context of the signed-in user with delegated permissions, with results scoped by the access control on each item. Retrieval through Graph is security trimmed by design. - **The oversharing problem.** Trimming enforces the permissions you have. A site open to "Everyone except external users" will be used, which is why Copilot projects often start with a permissions review. - **Restricted SharePoint Search is being retired.** It limited organization-wide search and Copilot to an allow list of up to 100 sites, but was never a security boundary. Since 31 July 2026 new enablement is blocked, and Microsoft points to Restricted Content Discovery, SharePoint Advanced Management and Microsoft Purview. Restricted Content Discovery hides selected sites from organization-wide search and Copilot but, like its predecessor, does not change permissions. - **Custom RAG on Azure AI Search.** The generally available option is a security filter: store user or group IDs on each chunk and filter every query by the caller's identities. Native enforcement of SharePoint ACLs, ADLS Gen2 ACLs and Purview sensitivity labels with the user's Entra token is available in preview as of September 2026. Permission changes only take effect after they are synced to the index. - **Other platforms.** Glean enforces source-system permissions on every result, and Elastic offers document level security (beta) for connectors including SharePoint Online. Always test with users from different departments. A Swedish-language walkthrough of the SharePoint case is in our article on AI search in SharePoint without exposing documents users lack access to (https://alicelabs.ai/sv/insights/ai-sok-sharepoint-behorigheter). Image: Linus Ingemarsson (https://alicelabs.ai/images/linus-ingemarsson.png) Image: Eric Lundberg (https://alicelabs.ai/images/eric-lundberg.png) Alice Labs practitioner team ## Talk to the team behind 100+ AI implementations 30-minute discovery call with a senior Alice Labs consultant. No slide deck, no sales pitch — just a scoping conversation. Book a Discovery Call 05 / 10 Section ## Which RAG architecture fits: Copilot, Azure AI Search, a vector database, Glean or Elastic? In short Copilot fits content in Microsoft 365 with little engineering. Azure AI Search or a vector database fits when you need control. Glean and Elastic fit knowledge spread across many non-Microsoft systems. There is no single best stack. The right choice follows from where your documents live, how much control you need and who will operate the system. Note that the Microsoft 365 app is now called the Microsoft Copilot app, while the licensed product is still Microsoft 365 Copilot. | Option | Fits when | Permissions | Trade-off | | --- | --- | --- | --- | | Microsoft 365 Copilot | Most knowledge is in SharePoint, OneDrive, Teams and Outlook | Inherited from Microsoft 365 via Microsoft Graph | Little control over chunking, ranking and evaluation; per-user licenses | | Azure AI Search (custom RAG) | You need your own assistant, sources outside M365 or strict answer rules | Security filters (GA); native SharePoint ACLs and Purview labels (preview) | Requires engineering, monitoring and an owner | | Own vector database | Specific hosting, cost or model requirements; product-embedded search | You build it: ACL sync and query filters | Most control and most responsibility | | Glean | Knowledge spread across many SaaS tools | Enforces source-system permissions on results | Verify hosting region; customer-hosted option in your own GCP or AWS | | Elastic | You already run Elasticsearch or need strong keyword plus vector search | Document level security for supported connectors (beta) | Cluster operations and relevance tuning in-house | Many organizations end up with two layers: Copilot for everyday work and a dedicated RAG knowledge base for a domain such as support or engineering documentation. 06 / 10 Section ## What do GDPR and EU data residency mean for RAG in Swedish companies? In short If indexed documents contain personal data, GDPR applies to the whole pipeline. IMY's guidance on GDPR and AI is the Swedish reference; EU Data Boundary or EU regions govern processing location. Internal documents almost always contain personal data. The Swedish Authority for Privacy Protection (IMY) states in its guidance on GDPR and AI that GDPR applies when personal data is processed in developing or using AI. For RAG, that means: - **Scope the index.** Decide which sources are indexed and why. Leaving HR case folders out is often easier than protecting them afterwards. - **Know every processor.** Search service, embedding model and language model may be different providers, each needing a data processing agreement. - **Check where processing happens.** Microsoft states that Copilot is an EU Data Boundary service for EU customers, but also notes that Anthropic models offered in Copilot are currently excluded from the EU Data Boundary. Azure services let you choose EU regions such as Sweden Central. For Glean and other SaaS tools, confirm the hosting region in the contract. - **Deletion and retention.** Erasure must reach chunks and embeddings, and question logs need their own retention rule. - **Impact assessment.** Broad indexing of employee data may call for a DPIA. Involve your data protection officer early. This is not legal advice, but the checklist Swedish legal and IT teams typically work through. Alice Labs practitioner team ## Planning internal AI search over your documents? Alice Labs builds permission-aware AI knowledge bases for Swedish companies, on Microsoft 365 Copilot or a custom RAG stack with processing in the EU. See the AI knowledge base service 07 / 10 Section ## How do you evaluate a RAG system? In short Evaluate retrieval quality, faithfulness and citations, plus permission tests, on a fixed set of real questions from your own organization. A RAG system is ready when it passes tests you wrote before building it: - **Retrieval quality.** For each test question, is the passage that contains the answer among the top results? Measure this separately from the answer. - **Faithfulness.** Does every statement in the answer follow from the retrieved passages, and does the assistant say "I can't find this" when they do not? - **Citations.** Does each citation point to a passage that actually supports the claim, in the current version of the document? - **Permissions.** Run the same questions as users with different access and confirm restricted content never appears. Build the test set from real employee questions, in Swedish and English if both are used. Frameworks such as RAGAS automate parts of the scoring; human review of a sample is still needed. Re-run it after every change. 08 / 10 Section ## What are the most common RAG mistakes? In short Indexing before cleaning permissions, duplicate versions, vector-only search, no evaluation and no owner after launch. - **Indexing before cleaning permissions.** RAG makes oversharing visible in seconds. - **Duplicate and outdated versions.** Five copies of a policy in different folders produce contradictory answers. Mark authoritative sources and archive the rest. - **Vector search only.** Article numbers, abbreviations and Swedish compound words often need keyword search as well. - **Losing structure.** Tables, headings and scanned PDFs break when text extraction is naive. - **No "I don't know".** Without an instruction and a test for it, the model fills gaps with plausible text. - **No owner.** Someone must own the sources, the sync and the test set after launch. 09 / 10 Section ## What drives the cost of a RAG system? In short Sources, document volume and change rate, permission complexity, model usage, licenses or service tier, and ongoing operations. Costs vary too much for a single figure, but the drivers are predictable: - **Sources and connectors.** Each system with its own format and permission model adds integration work. - **Volume and change rate.** More documents and frequent updates mean more embedding, indexing and storage. - **Permission complexity.** Unique item-level permissions and nested groups are harder to sync than site-level access. - **Usage.** Every question costs model tokens for the retrieved context and the answer; re-ranking and agentic multi-step retrieval add more. - **Licenses or service tiers.** Per-user licenses for Copilot or Glean versus capacity-based pricing for Azure AI Search or Elastic. - **Operations.** Monitoring, evaluation and content ownership recur and are easy to leave out of the business case. Alice Labs practitioner team Book a Discovery Call 10 / 10 Section ## How does Alice Labs build RAG for internal knowledge search? In short Questions first, then a source and permission audit, an architecture choice, a build with permission-aware retrieval and citations, and evaluation before launch. Alice Labs is a Swedish AI consultancy in Stockholm. When we build an AI knowledge base (https://alicelabs.ai/en/ai-knowledge-base) or internal AI search for Swedish companies, the work follows the same order: 1. **Questions first.** Collect real questions and turn them into the test set. 2. **Source and permission audit.** Map where answers live, which versions are authoritative and where access is too broad. 3. **Architecture choice.** Copilot where it is enough, a custom pipeline on Azure AI Search or another index where control requires it, processed in the EU. 4. **Build with guardrails.** Permission filters in every query, citations on every answer, and an explicit "not found" behavior. 5. **Evaluate, launch, hand over.** Pass the tests, pilot, then hand over ownership of sources, sync and evaluation. The Swedish service page is AI-kunskapsbas (https://alicelabs.ai/ai-kunskapsbas). When the assistant should also act, for example create tickets or update records, the next step is an AI agent (https://alicelabs.ai/en/ai-agents) with RAG as one of its tools. ## About the Authors & Reviewers Written by Image: Linus Ingemarsson - CEO & Co-Founder, Alice Labs at Alice Labs (https://alicelabs.ai/images/linus-ingemarsson.png) Linus Ingemarsson (https://www.linkedin.com/in/linus-ingemarsson/) CEO & Co-Founder, Alice Labs CEO & Co-Founder at Alice Labs. Author of 7 research reports on AI adoption, governance and labor markets cited across EU, OECD and US benchmarks. - 8+ years in AI strategy & implementation - Top-5 AI Speaker, Sweden (Mindley 2025) - 100+ enterprise AI engagements View profile: https://www.linkedin.com/in/linus-ingemarsson/ Linus Ingemarsson on LinkedIn: https://www.linkedin.com/in/linus-ingemarsson/ Email Linus Ingemarsson: linus@alicelabs.ai Reviewed by September 29, 2026 Image: Eric Lundberg - Co-Founder, Alice Labs at Alice Labs (https://alicelabs.ai/images/eric-lundberg.png) Eric Lundberg (https://www.linkedin.com/in/eric-lundberg-3530451bb/) Co-Founder, Alice Labs Co-Founder at Alice Labs. Builds AI automation, agent workflows and integration systems that hold up in real business operations. - AI automation & agent systems lead - Workflow design across 100+ deployments - Specialist in RAG, integrations & APIs View profile: https://www.linkedin.com/in/eric-lundberg-3530451bb/ Eric Lundberg on LinkedIn: https://www.linkedin.com/in/eric-lundberg-3530451bb/ Email Eric Lundberg: eric@alicelabs.ai Reviewed for technical accuracy, methodology and source integrity. · All claims trace to public sources cited in-line. ## Frequently Asked Questions ### What is RAG in simple terms? RAG lets an AI assistant look things up in your documents before answering. It finds relevant passages, gives them to the language model and returns an answer based on them, with source links. ### How do companies in Sweden use RAG? Mostly for internal knowledge search: employees ask in Swedish or English across SharePoint, Teams and document archives and get cited answers. Other uses are support assistants and AI agents. ### What is security trimming in RAG? Security trimming removes every result the user may not open before the model sees it. In Microsoft 365, retrieval runs as the signed-in user. In a custom index, each chunk stores its document's access list and queries are filtered by identity. ### Does Microsoft 365 Copilot use RAG? In effect, yes. Copilot retrieves content through Microsoft Graph and grounds answers in content the user can access. It inherits Microsoft 365 permissions, so overshared sites are available to it too. ### Can Restricted SharePoint Search protect sensitive sites from Copilot? Not for new deployments: new enablement is blocked from 31 July 2026, and it was never a security boundary. Microsoft recommends Restricted Content Discovery, SharePoint Advanced Management, Purview and fixing permissions. ### Does Azure AI Search support SharePoint permissions for RAG? Yes. Security filters with user or group IDs per document are generally available. Native SharePoint ACL and Purview label enforcement is in preview as of September 2026. ### Is RAG GDPR compliant? It can be, depending on setup: which documents are indexed, legal basis, processing agreements, processing location and deletion of embeddings. IMY's guidance on GDPR and AI is the Swedish starting point. ### What is the difference between RAG and fine-tuning? RAG gives the model documents at question time; fine-tuning changes its weights to adjust behavior. For internal search RAG is the default, since knowledge changes, answers need citations and access must follow permissions. ### Do you need a vector database for RAG? You need an index with vector search, not necessarily a standalone vector database. Azure AI Search and Elasticsearch combine vector and keyword search, which most enterprise RAG needs. ### How long does it take to build a RAG system? A prototype is quick. Production depends on sources, the state of permissions and evaluation strictness. The permission audit and test set usually take longer than the pipeline. Previous in AI Implementation ### Why AI Projects Fail: 7 Root Causes & How to Avoid Them https://alicelabs.ai/en/insights/why-ai-projects-fail Next in AI Implementation ### What Is MLOps? Machine Learning Operations Explained https://alicelabs.ai/en/insights/what-is-mlops ## Further reading - Microsoft Learn: Data, Privacy, and Security for Microsoft Copilot (https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy)· learn.microsoft.com - Microsoft Learn: Restricted SharePoint Search (https://learn.microsoft.com/en-us/sharepoint/restricted-sharepoint-search)· learn.microsoft.com - Microsoft Learn: Azure AI Search document-level access control (https://learn.microsoft.com/en-us/azure/search/search-document-level-access-overview)· learn.microsoft.com - Glean: Deployment models (https://docs.glean.com/get-started/prepare/about-deployment)· docs.glean.com - RAGAS: Evaluation framework for RAG pipelines (https://docs.ragas.io/)· docs.ragas.io ## Related services AI knowledge base for companies How Alice Labs builds permission-aware internal AI search and knowledge bases.: https://alicelabs.ai/en/ai-knowledge-base AI-kunskapsbas (Swedish) Tjänstesidan för AI-kunskapsbas och intern AI-sökning på svenska.: https://alicelabs.ai/ai-kunskapsbas AI agents When the assistant should act, not just answer, RAG becomes a tool for an agent.: https://alicelabs.ai/en/ai-agents ## Related reading comparison ### RAG vs Fine-Tuning When to use retrieval, when to fine-tune and when to combine them. 8 min https://alicelabs.ai/en/insights/rag-vs-fine-tuning glossary ### What Is a Vector Database? The index behind semantic search and RAG, explained. 7 min https://alicelabs.ai/en/insights/what-is-vector-database glossary ### What Is an AI Agent? RAG is a core tool for AI agents that need company knowledge. 7 min https://alicelabs.ai/en/insights/what-is-an-ai-agent ## Sources 1. Lewis et al. — Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks (arXiv:2005.11401, 2020) (https://arxiv.org/abs/2005.11401)(accessed 2026-09-29) 2. Microsoft Learn — Data, Privacy, and Security for Microsoft Copilot (permissions, EU Data Boundary, no training on Graph data) (https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy)(accessed 2026-09-29) 3. Microsoft Learn — Use the Microsoft Search API to query data (requests run as the signed-in user, results scoped by access control) (https://learn.microsoft.com/en-us/graph/api/resources/search-api-overview)(accessed 2026-09-29) 4. Microsoft Learn — Restricted SharePoint Search (retiring, 100-site allow list, not a security boundary) (https://learn.microsoft.com/en-us/sharepoint/restricted-sharepoint-search)(accessed 2026-09-29) 5. Microsoft Learn — Restrict discovery of SharePoint sites and content (Restricted Content Discovery) (https://learn.microsoft.com/en-us/sharepoint/restricted-content-discovery)(accessed 2026-09-29) 6. Microsoft Learn — Document-level access control in Azure AI Search (security filters, SharePoint ACLs, Purview labels) (https://learn.microsoft.com/en-us/azure/search/search-document-level-access-overview)(accessed 2026-09-29) 7. Elastic — Document level security in Elastic connectors (https://www.elastic.co/docs/reference/search-connectors/document-level-security)(accessed 2026-09-29) 8. IMY — Vägledning om GDPR och AI (guidance on GDPR and AI) (https://www.imy.se/verksamhet/dataskydd/innovationsportalen/vagledning-om-gdpr-och-ai/)(accessed 2026-09-29) Next scheduled review: 2026-12-29 Alice Labs practitioner team Book a Discovery Call Share Share on LinkedIn (https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Falicelabs.ai%2Fen%2Finsights%2Fwhat-is-rag)Share on X (https://twitter.com/intent/tweet?url=https%3A%2F%2Falicelabs.ai%2Fen%2Finsights%2Fwhat-is-rag&text=What%20Is%20RAG%3F%20Enterprise%20Search%20Over%20Internal%20Documents%20(2026)) ## Get in Touch! The lab usually responds within 24 hours. Need help with AI? Get in touch (https://alicelabs.ai/en/ai-consulting-services#contact-form) ## Structured data ```json [ { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://alicelabs.ai/#organization", "name": "Alice Labs", "alternateName": [ "Alice Labs AB", "AliceLabs" ], "legalName": "Alice Labs AB", "identifier": "559443-5470", "foundingLocation": { "@type": "Place", "name": "Stockholm, Sweden" }, "url": "https://alicelabs.ai", "logo": { "@type": "ImageObject", "@id": "https://alicelabs.ai/#logo", "url": "https://alicelabs.ai/images/alice-logo.png", "contentUrl": "https://alicelabs.ai/images/alice-logo.png", "width": 2000, "height": 2027, "caption": "Alice Labs" }, "image": { "@id": "https://alicelabs.ai/#logo" }, "description": "Alice Labs är en svensk AI-byrå som hjälper företag implementera AI - från strategi till skalning.", "slogan": "From AI strategy to measurable results.", "foundingDate": "2023", "email": "hej@alicelabs.ai", "telephone": "+46734157476", "address": { "@type": "PostalAddress", "streetAddress": "Hammarbybacken 27", "addressLocality": "Stockholm", "postalCode": "120 30", "addressCountry": "SE" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hej@alicelabs.ai", "telephone": "+46734157476", "areaServed": [ "SE", "EU" ], "availableLanguage": [ "Swedish", "English" ] } ], "areaServed": [ { "@type": "Country", "name": "Sweden" }, { "@type": "Place", "name": "Europe" } ], "knowsAbout": [ "AI strategy", "AI implementation", "AI agents", "AI automation", "Generative AI", "AI governance", "AI training", "Machine learning", "Large language models", "RAG", "AI consulting", "Digital transformation", "AI search optimization", "LLMO", "AI for enterprise" ], "founder": [ { "@id": "https://alicelabs.ai/#linus" }, { "@id": "https://alicelabs.ai/#eric" } ], "sameAs": [ "https://www.linkedin.com/company/alicelabsai", "https://www.trustpilot.com/review/alicelabs.ai", "https://www.wikidata.org/wiki/Q140369570" ] }, { "@type": "Person", "@id": "https://alicelabs.ai/#linus", "name": "Linus Ingemarsson", "givenName": "Linus", "familyName": "Ingemarsson", "jobTitle": "Co-Founder", "description": "Co-founder of Alice Labs. Architects AI agent systems and automation in production for clients across financial services, media, and the public sector.", "url": "https://alicelabs.ai/en/linus-ingemarsson", "sameAs": [ "https://www.linkedin.com/in/linus-ingemarsson/", "https://www.wikidata.org/wiki/Q140369914" ], "knowsAbout": [ "AI agents", "agent orchestration", "AI implementation", "LangGraph", "RAG systems", "AI strategy", "enterprise AI", "AI search optimization", "LLMO", "Nordic AI ecosystem" ], "worksFor": { "@id": "https://alicelabs.ai/#organization" } }, { "@type": "Person", "@id": "https://alicelabs.ai/#eric", "name": "Eric Lundberg", "givenName": "Eric", "familyName": "Lundberg", "jobTitle": "Co-Founder", "description": "Co-founder of Alice Labs. Designs AI automation systems and agent workflows that remove repetitive work and make day-to-day operations more reliable.", "url": "https://alicelabs.ai/en/eric-lundberg", "sameAs": [ "https://www.linkedin.com/in/eric-lundberg-3530451bb/", "https://www.wikidata.org/wiki/Q140369978" ], "knowsAbout": [ "AI automation", "agent workflows", "AI integrations", "process automation", "knowledge systems", "AI engineering", "enterprise AI", "Nordic AI ecosystem" ], "worksFor": { "@id": "https://alicelabs.ai/#organization" } }, { "@type": "Person", "@id": "https://alicelabs.ai/#alice", "name": "Alice Holmgren", "givenName": "Alice", "familyName": "Holmgren", "jobTitle": "CEO", "description": "CEO of Alice Labs. Leads strategy and growth across the Nordic AI consulting market.", "url": "https://alicelabs.ai/en/alice-holmgren", "knowsAbout": [ "AI strategy", "AI consulting leadership", "business development", "Nordic AI ecosystem", "enterprise AI adoption", "AI program management" ], "worksFor": { "@id": "https://alicelabs.ai/#organization" } }, { "@type": [ "LocalBusiness", "ProfessionalService" ], "@id": "https://alicelabs.ai/#localbusiness", "name": "Alice Labs", "description": "AI-konsult i Stockholm. Vi hjälper företag implementera AI - från strategi till skalning. Boka möte för en kostnadsfri AI-genomgång.", "url": "https://alicelabs.ai", "logo": { "@id": "https://alicelabs.ai/#logo" }, "image": { "@id": "https://alicelabs.ai/#logo" }, "telephone": "+46734157476", "email": "hej@alicelabs.ai", "priceRange": "$$$", "currenciesAccepted": "SEK, EUR, USD", "paymentAccepted": "Invoice", "address": { "@type": "PostalAddress", "streetAddress": "Hammarbybacken 27", "addressLocality": "Stockholm", "postalCode": "120 30", "addressRegion": "Stockholms län", "addressCountry": "SE" }, "geo": { "@type": "GeoCoordinates", "latitude": 59.3018, "longitude": 18.1003 }, "areaServed": [ { "@type": "City", "name": "Stockholm" }, { "@type": "City", "name": "Göteborg" }, { "@type": "City", "name": "Malmö" }, { "@type": "City", "name": "Uppsala" }, { "@type": "Country", "name": "Sweden" } ], "openingHoursSpecification": [ { "@type": "OpeningHoursSpecification", "dayOfWeek": [ "Monday", "Tuesday", "Wednesday", "Thursday", "Friday" ], "opens": "08:00", "closes": "18:00" } ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "AI-tjänster", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI-konsult" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI-strategi" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI-implementation" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI-utbildning" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI-agenter" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI-automation" } } ] }, "knowsAbout": [ "AI-konsult", "AI-strategi", "AI-implementation", "AI-utbildning", "AI-agenter", "AI-automation", "Generative AI", "Machine learning", "RAG", "Large language models", "AI governance" ], "parentOrganization": { "@id": "https://alicelabs.ai/#organization" }, "sameAs": [ "https://www.linkedin.com/company/alicelabsai" ] }, { "@type": "WebSite", "@id": "https://alicelabs.ai/#website", "url": "https://alicelabs.ai", "name": "Alice Labs", "alternateName": [ "Alice Labs AB" ], "description": "AI consulting, implementation and training for businesses.", "publisher": { "@id": "https://alicelabs.ai/#organization" }, "inLanguage": [ "sv-SE", "en-US" ], "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://alicelabs.ai/?q={search_term_string}" }, "query-input": "required name=search_term_string" } } ] }, { "@context": "https://schema.org", "@graph": [ { "@type": "DefinedTermSet", "@id": "https://alicelabs.ai/en/insights/what-is-rag#article", "headline": "What Is RAG? Retrieval-Augmented Generation for Internal Document Search", "description": "What is RAG? How retrieval-augmented generation gives Swedish companies cited, permission-aware answers from internal documents: architecture, GDPR, costs.", "url": "https://alicelabs.ai/en/insights/what-is-rag", "datePublished": "2026-04-16", "dateModified": "2026-09-29", "expires": "2026-12-29", "author": { "@id": "https://alicelabs.ai/#linus" }, "reviewedBy": { "@id": "https://alicelabs.ai/#eric" }, "dateReviewed": "2026-09-29", "publisher": { "@type": "Organization", "name": "Alice Labs", "url": "https://alicelabs.ai", "logo": { "@type": "ImageObject", "url": "https://alicelabs.ai/images/alice-logo.png" } }, "image": { "@type": "ImageObject", "@id": "https://alicelabs.ai/en/insights/what-is-rag#hero-image", "url": "https://alicelabs.ai/images/og/og-home.jpg", "contentUrl": "https://alicelabs.ai/images/og/og-home.jpg", "width": 1600, "height": 900, "caption": "What Is RAG? Enterprise Search Over Internal Documents (2026)", "creator": { "@id": "https://alicelabs.ai/#organization" }, "representativeOfPage": true, "license": "https://alicelabs.ai/terms" }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://alicelabs.ai/en/insights/what-is-rag" }, "inLanguage": "en", "articleSection": "ai-implementation", "keywords": "what is rag, retrieval augmented generation, rag enterprise search, rag internal documents, rag sweden, rag sharepoint, security trimming, permission-aware retrieval, azure ai search rag, microsoft 365 copilot rag, rag gdpr, rag vs fine tuning", "about": [ { "@type": "Thing", "name": "What is RAG, in one paragraph?", "url": "https://alicelabs.ai/en/insights/what-is-rag#what-is-rag" }, { "@type": "Thing", "name": "How does RAG work, step by step?", "url": "https://alicelabs.ai/en/insights/what-is-rag#how-rag-works" }, { "@type": "Thing", "name": "RAG vs fine-tuning vs long context: which should you use?", "url": "https://alicelabs.ai/en/insights/what-is-rag#rag-vs-fine-tuning" }, { "@type": "Thing", "name": "How does permission-aware retrieval and security trimming work?", "url": "https://alicelabs.ai/en/insights/what-is-rag#permission-aware-retrieval" }, { "@type": "Thing", "name": "Which RAG architecture fits: Copilot, Azure AI Search, a vector database, Glean or Elastic?", "url": "https://alicelabs.ai/en/insights/what-is-rag#architecture-choices" }, { "@type": "Thing", "name": "What do GDPR and EU data residency mean for RAG in Swedish companies?", "url": "https://alicelabs.ai/en/insights/what-is-rag#gdpr-eu-data-residency" }, { "@type": "Thing", "name": "How do you evaluate a RAG system?", "url": "https://alicelabs.ai/en/insights/what-is-rag#evaluation" }, { "@type": "Thing", "name": "What are the most common RAG mistakes?", "url": "https://alicelabs.ai/en/insights/what-is-rag#common-mistakes" }, { "@type": "Thing", "name": "What drives the cost of a RAG system?", "url": "https://alicelabs.ai/en/insights/what-is-rag#cost-drivers" }, { "@type": "Thing", "name": "How does Alice Labs build RAG for internal knowledge search?", "url": "https://alicelabs.ai/en/insights/what-is-rag#how-alice-labs-builds-rag" } ], "mentions": [ { "@type": "Organization", "name": "Alice Labs", "url": "https://alicelabs.ai" }, { "@type": "Product", "name": "Microsoft 365 Copilot", "url": "https://www.microsoft.com/microsoft-365/copilot" }, { "@type": "Product", "name": "Microsoft Graph", "url": "https://learn.microsoft.com/en-us/graph/overview" }, { "@type": "Product", "name": "SharePoint", "url": "https://www.microsoft.com/microsoft-365/sharepoint" }, { "@type": "Product", "name": "Azure AI Search", "url": "https://learn.microsoft.com/en-us/azure/search/" }, { "@type": "Product", "name": "Glean", "url": "https://www.glean.com" }, { "@type": "Product", "name": "Elasticsearch", "url": "https://www.elastic.co" }, { "@type": "Organization", "name": "Integritetsskyddsmyndigheten (IMY)", "url": "https://www.imy.se" }, { "@type": "Organization", "name": "Meta AI", "url": "https://ai.meta.com" }, { "@type": "Place", "name": "Sweden", "url": "https://www.wikidata.org/wiki/Q34" }, { "@type": "Person", "name": "Linus Ingemarsson", "url": "https://www.linkedin.com/in/linus-ingemarsson/" }, { "@type": "Person", "name": "Eric Lundberg", "url": "https://www.linkedin.com/in/eric-lundberg-3530451bb/" } ], "hasPart": [ { "@type": "WebPageElement", "isAccessibleForFree": true, "name": "What is RAG, in one paragraph?", "url": "https://alicelabs.ai/en/insights/what-is-rag#what-is-rag", "description": "RAG is a pattern where an AI system searches a knowledge source, usually internal documents, for relevant passages and gives them to a language model that answers from them and cites them." }, { "@type": "WebPageElement", "isAccessibleForFree": true, "name": "How does RAG work, step by step?", "url": "https://alicelabs.ai/en/insights/what-is-rag#how-rag-works", "description": "RAG ingests documents, chunks them, embeds each chunk, indexes chunks with metadata and permissions, retrieves the best chunks per question and generates an answer citing them." }, { "@type": "WebPageElement", "isAccessibleForFree": true, "name": "RAG vs fine-tuning vs long context: which should you use?", "url": "https://alicelabs.ai/en/insights/what-is-rag#rag-vs-fine-tuning", "description": "Use RAG for large, changing document sets with citations. Use fine-tuning to change behavior or format, not to add facts. Use long context for a few whole documents at once." }, { "@type": "WebPageElement", "isAccessibleForFree": true, "name": "How does permission-aware retrieval and security trimming work?", "url": "https://alicelabs.ai/en/insights/what-is-rag#permission-aware-retrieval", "description": "Security trimming removes every result the user may not open before the model sees it. Copilot and the Graph Search API run as the signed-in user; in a custom index, each chunk must carry its document's access list." }, { "@type": "WebPageElement", "isAccessibleForFree": true, "name": "Which RAG architecture fits: Copilot, Azure AI Search, a vector database, Glean or Elastic?", "url": "https://alicelabs.ai/en/insights/what-is-rag#architecture-choices", "description": "Copilot fits content in Microsoft 365 with little engineering. Azure AI Search or a vector database fits when you need control. Glean and Elastic fit knowledge spread across many non-Microsoft systems." }, { "@type": "WebPageElement", "isAccessibleForFree": true, "name": "What do GDPR and EU data residency mean for RAG in Swedish companies?", "url": "https://alicelabs.ai/en/insights/what-is-rag#gdpr-eu-data-residency", "description": "If indexed documents contain personal data, GDPR applies to the whole pipeline. IMY's guidance on GDPR and AI is the Swedish reference; EU Data Boundary or EU regions govern processing location." }, { "@type": "WebPageElement", "isAccessibleForFree": true, "name": "How do you evaluate a RAG system?", "url": "https://alicelabs.ai/en/insights/what-is-rag#evaluation", "description": "Evaluate retrieval quality, faithfulness and citations, plus permission tests, on a fixed set of real questions from your own organization." }, { "@type": "WebPageElement", "isAccessibleForFree": true, "name": "What are the most common RAG mistakes?", "url": "https://alicelabs.ai/en/insights/what-is-rag#common-mistakes", "description": "Indexing before cleaning permissions, duplicate versions, vector-only search, no evaluation and no owner after launch." }, { "@type": "WebPageElement", "isAccessibleForFree": true, "name": "What drives the cost of a RAG system?", "url": "https://alicelabs.ai/en/insights/what-is-rag#cost-drivers", "description": "Sources, document volume and change rate, permission complexity, model usage, licenses or service tier, and ongoing operations." }, { "@type": "WebPageElement", "isAccessibleForFree": true, "name": "How does Alice Labs build RAG for internal knowledge search?", "url": "https://alicelabs.ai/en/insights/what-is-rag#how-alice-labs-builds-rag", "description": "Questions first, then a source and permission audit, an architecture choice, a build with permission-aware retrieval and citations, and evaluation before launch." } ], "speakable": { "@type": "SpeakableSpecification", "cssSelector": [ "[data-speakable='true']", "[data-snippet='true']", "[data-section-answer='true']", ".quick-answer", "h1" ] } }, { "@type": "BreadcrumbList", "@id": "https://alicelabs.ai/en/insights/what-is-rag#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://alicelabs.ai/en" }, { "@type": "ListItem", "position": 2, "name": "Insights", "item": "https://alicelabs.ai/en/insights" }, { "@type": "ListItem", "position": 3, "name": "ai-implementation", "item": "https://alicelabs.ai/en/insights/ai-implementation" }, { "@type": "ListItem", "position": 4, "name": "What Is RAG? Enterprise Search Over Internal Documents (2026)", "item": "https://alicelabs.ai/en/insights/what-is-rag" } ] }, { "@type": "Person", "@id": "https://alicelabs.ai/#eric", "name": "Eric Lundberg", "jobTitle": "Co-Founder", "worksFor": { "@id": "https://alicelabs.ai/#organization" }, "knowsAbout": [ { "@type": "DefinedTerm", "name": "AI automation", "url": "https://www.wikidata.org/wiki/Q1322483" }, { "@type": "DefinedTerm", "name": "Workflow automation", "url": "https://www.wikidata.org/wiki/Q120427660" }, { "@type": "DefinedTerm", "name": "Retrieval-Augmented Generation", "url": "https://www.wikidata.org/wiki/Q117761563" }, { "@type": "DefinedTerm", "name": "Enterprise AI implementation" } ], "sameAs": [ "https://www.linkedin.com/in/eric-lundberg-3530451bb/", "https://www.wikidata.org/wiki/Q140369978" ] }, { "@type": "Person", "@id": "https://alicelabs.ai/#linus", "name": "Linus Ingemarsson", "jobTitle": "CEO & Co-Founder", "worksFor": { "@id": "https://alicelabs.ai/#organization" }, "knowsAbout": [ { "@type": "DefinedTerm", "name": "AI agent orchestration", "url": "https://www.wikidata.org/wiki/Q98678395" }, { "@type": "DefinedTerm", "name": "AI strategy" }, { "@type": "DefinedTerm", "name": "AI search optimization (LLMO)" }, { "@type": "DefinedTerm", "name": "Enterprise AI strategy" }, { "@type": "DefinedTerm", "name": "AI consulting leadership" } ], "sameAs": [ "https://www.linkedin.com/in/linus-ingemarsson/", "https://www.wikidata.org/wiki/Q140369914" ] }, { "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "What is RAG in simple terms?", "acceptedAnswer": { "@type": "Answer", "text": "RAG lets an AI assistant look things up in your documents before answering. It finds relevant passages, gives them to the language model and returns an answer based on them, with source links." } }, { "@type": "Question", "name": "How do companies in Sweden use RAG?", "acceptedAnswer": { "@type": "Answer", "text": "Mostly for internal knowledge search: employees ask in Swedish or English across SharePoint, Teams and document archives and get cited answers. Other uses are support assistants and AI agents." } }, { "@type": "Question", "name": "What is security trimming in RAG?", "acceptedAnswer": { "@type": "Answer", "text": "Security trimming removes every result the user may not open before the model sees it. In Microsoft 365, retrieval runs as the signed-in user. In a custom index, each chunk stores its document's access list and queries are filtered by identity." } }, { "@type": "Question", "name": "Does Microsoft 365 Copilot use RAG?", "acceptedAnswer": { "@type": "Answer", "text": "In effect, yes. Copilot retrieves content through Microsoft Graph and grounds answers in content the user can access. It inherits Microsoft 365 permissions, so overshared sites are available to it too." } }, { "@type": "Question", "name": "Can Restricted SharePoint Search protect sensitive sites from Copilot?", "acceptedAnswer": { "@type": "Answer", "text": "Not for new deployments: new enablement is blocked from 31 July 2026, and it was never a security boundary. Microsoft recommends Restricted Content Discovery, SharePoint Advanced Management, Purview and fixing permissions." } }, { "@type": "Question", "name": "Does Azure AI Search support SharePoint permissions for RAG?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. Security filters with user or group IDs per document are generally available. Native SharePoint ACL and Purview label enforcement is in preview as of September 2026." } }, { "@type": "Question", "name": "Is RAG GDPR compliant?", "acceptedAnswer": { "@type": "Answer", "text": "It can be, depending on setup: which documents are indexed, legal basis, processing agreements, processing location and deletion of embeddings. IMY's guidance on GDPR and AI is the Swedish starting point." } }, { "@type": "Question", "name": "What is the difference between RAG and fine-tuning?", "acceptedAnswer": { "@type": "Answer", "text": "RAG gives the model documents at question time; fine-tuning changes its weights to adjust behavior. For internal search RAG is the default, since knowledge changes, answers need citations and access must follow permissions." } }, { "@type": "Question", "name": "Do you need a vector database for RAG?", "acceptedAnswer": { "@type": "Answer", "text": "You need an index with vector search, not necessarily a standalone vector database. Azure AI Search and Elasticsearch combine vector and keyword search, which most enterprise RAG needs." } }, { "@type": "Question", "name": "How long does it take to build a RAG system?", "acceptedAnswer": { "@type": "Answer", "text": "A prototype is quick. Production depends on sources, the state of permissions and evaluation strictness. The permission audit and test set usually take longer than the pipeline." } } ] }, { "@context": "https://schema.org", "@type": "DefinedTerm", "name": "RAG (Retrieval-Augmented Generation)", "description": "RAG is an AI architecture that retrieves relevant passages from an external knowledge source, such as a company's internal documents, and passes them to a large language model so that its answer is grounded in, and can cite, those sources. Knowledge is updated by re-indexing documents, not by retraining the model.", "alternateName": [ "Retrieval-Augmented Generation", "Retrieval-augmented generation", "RAG pipeline", "RAG architecture", "Grounded generation", "Permission-aware enterprise search" ], "inDefinedTermSet": { "@type": "DefinedTermSet", "name": "Alice Labs AI Glossary", "url": "https://alicelabs.ai/en/glossary" } }, { "@context": "https://schema.org", "@type": "Dataset", "name": "What Is RAG? Retrieval-Augmented Generation for Internal Document Search", "description": "What is RAG? How retrieval-augmented generation gives Swedish companies cited, permission-aware answers from internal documents: architecture, GDPR, costs.", "url": "https://alicelabs.ai/en/insights/what-is-rag", "datePublished": "2026-04-16", "dateModified": "2026-09-29", "creator": { "@type": "Organization", "name": "Alice Labs", "url": "https://alicelabs.ai" }, "license": "https://creativecommons.org/licenses/by/4.0/", "isAccessibleForFree": true, "keywords": [ "what is rag", "retrieval augmented generation", "rag enterprise search", "rag internal documents", "rag sweden", "rag sharepoint", "security trimming", "permission-aware retrieval", "azure ai search rag", "microsoft 365 copilot rag", "rag gdpr", "rag vs fine tuning" ] }, { "@context": "https://schema.org", "@type": "ItemList", "name": "Related articles", "itemListElement": [ { "@type": "ListItem", "position": 1, "url": "https://alicelabs.ai/en/insights/rag-vs-fine-tuning", "name": "RAG vs Fine-Tuning" }, { "@type": "ListItem", "position": 2, "url": "https://alicelabs.ai/en/insights/what-is-vector-database", "name": "What Is a Vector Database?" }, { "@type": "ListItem", "position": 3, "url": "https://alicelabs.ai/en/insights/what-is-an-ai-agent", "name": "What Is an AI Agent?" } ] }, { "@context": "https://schema.org", "@type": "ItemList", "name": "Table of Contents", "numberOfItems": 10, "itemListOrder": "https://schema.org/ItemListOrderAscending", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "What is RAG, in one paragraph?", "url": "https://alicelabs.ai/en/insights/what-is-rag#what-is-rag" }, { "@type": "ListItem", "position": 2, "name": "How does RAG work, step by step?", "url": "https://alicelabs.ai/en/insights/what-is-rag#how-rag-works" }, { "@type": "ListItem", "position": 3, "name": "RAG vs fine-tuning vs long context: which should you use?", "url": "https://alicelabs.ai/en/insights/what-is-rag#rag-vs-fine-tuning" }, { "@type": "ListItem", "position": 4, "name": "How does permission-aware retrieval and security trimming work?", "url": "https://alicelabs.ai/en/insights/what-is-rag#permission-aware-retrieval" }, { "@type": "ListItem", "position": 5, "name": "Which RAG architecture fits: Copilot, Azure AI Search, a vector database, Glean or Elastic?", "url": "https://alicelabs.ai/en/insights/what-is-rag#architecture-choices" }, { "@type": "ListItem", "position": 6, "name": "What do GDPR and EU data residency mean for RAG in Swedish companies?", "url": "https://alicelabs.ai/en/insights/what-is-rag#gdpr-eu-data-residency" }, { "@type": "ListItem", "position": 7, "name": "How do you evaluate a RAG system?", "url": "https://alicelabs.ai/en/insights/what-is-rag#evaluation" }, { "@type": "ListItem", "position": 8, "name": "What are the most common RAG mistakes?", "url": "https://alicelabs.ai/en/insights/what-is-rag#common-mistakes" }, { "@type": "ListItem", "position": 9, "name": "What drives the cost of a RAG system?", "url": "https://alicelabs.ai/en/insights/what-is-rag#cost-drivers" }, { "@type": "ListItem", "position": 10, "name": "How does Alice Labs build RAG for internal knowledge search?", "url": "https://alicelabs.ai/en/insights/what-is-rag#how-alice-labs-builds-rag" } ] } ] }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://alicelabs.ai/en" }, { "@type": "ListItem", "position": 2, "name": "Insights", "item": "https://alicelabs.ai/en/insights" }, { "@type": "ListItem", "position": 3, "name": "AI Implementation", "item": "https://alicelabs.ai/en/insights/ai-implementation" }, { "@type": "ListItem", "position": 4, "name": "RAG (Retrieval-Augmented Generation)" } ] } ] ```