AI assistants such as Microsoft 365 Copilot or a RAG chatbot only find what your folders let them find. On a typical share with "Angebot_final_v3_NEU.docx" next to five older copies, the assistant quotes the wrong version with full confidence. This use case is the unglamorous groundwork: one source of truth per document, a naming rule, clear draft/final/archive areas. Simple scripts and a small local model do the sorting, people decide.
Problem & value
- Who has it: every SMB with a file server, SharePoint or Nextcloud that has grown for 10+ years. Folders follow people, not processes; copies are made to "be safe"; nobody knows which contract template is current.
- Today: a "tidy-up weekend" that never finishes, or nothing at all. Staff find files by memory or by asking colleagues.
- Why AI helps: hashing finds exact duplicates without AI; a small language model proposes document type, topic and version status from name and content, so humans only confirm. The restructured result is what makes Copilot, enterprise search and RAG (PREP-013) return the right file.
- Value: fewer wrong answers from assistants, less search time, a solid base for every later AI use case. We have no reliable cross-company figure for time savings; measure your own baseline (see KPIs).
- Boundary: deleting old content by retention rules is KNOW-025; permissions clean-up is PREP-023. This use case structures what remains.
Variants
- Windows file server to SharePoint/Teams migration: restructure first, then migrate (otherwise the mess moves to the cloud).
- Existing SharePoint tenant before a Copilot rollout: fewer sites, one hub per area, metadata instead of deep folder trees.
- Nextcloud / Google Workspace: same method, other tooling.
- Public sector: records plan (Aktenplan) as target structure; staff council involved.
- Private use: a family archive or home-office folder; local tools only.
How it works
- crawl (path, owner, dates, size, hash)
- exact duplicates (hash) + near-duplicates (name similarity / embeddings)
- classify: document type, topic, status draft/final/obsolete (small LLM or rules)
- propose target path + normalised file name
- human review per area (data owner approves in a spreadsheet)
- scripted move/rename with log and rollback list
- archive area + index for search/RAG
- AI components: a small LLM (about 7-8B, e.g. Mistral or Qwen class) reading the first page of each file, plus an embedding model for near-duplicate grouping. Most of the work is deterministic: hashes, date rules, file-name patterns.
- Human-in-the-loop: nothing is moved or deleted without approval by the data owner of the area; the move script writes a log so every move can be reversed.
Data preparation
Which data: file metadata and, for classification, the first lines of text of each file. Content leaves your network only in Path B.
Where it lives: Windows file shares, SharePoint/OneDrive, Teams, Nextcloud, local "Desktop" folders and e-mail attachments.
Typical gaps: duplicates and "final_final" versions, names without date or subject, folders named after people, orphaned files of departed staff, scans without text (PREP-006), shadow stores in Excel and USB drives (PREP-003), no named owner per area (PREP-004).
Steps and realistic effort for a company with about 50 staff and 1-3 TB:
1. Inventory with a crawler or PowerShell (Get-ChildItem, hash with Get-FileHash) or the open-source tool fclones for duplicates: 1-2 days.
2. Agree on 8-15 top-level areas by process (Sales, Projects, HR, Finance ...) and a naming rule such as YYYY-MM-DD_Customer_Type_vNN: 1-2 workshops, 1 day.
3. Name one data owner per area and let them mark archive candidates: 2-4 hours per owner.
4. Run classification and proposals, then review: 3-5 days in total, spread over weeks.
5. Move in batches with log; keep the old share read-only for 4 weeks: 1-2 days.
6. Add document metadata (PREP-010) and run the data readiness check (GUIDE-003).
Tools: PowerShell, fclones, Excel/Power Query for the review sheet, n8n or Power Automate for the move workflow, Paperless-ngx for scanned material, Ollama for the local model.
Share of effort: high. Realistically 70-80 percent of the work is workshops, decisions and reviewing, not technology.
Implementation paths
Which path for whom
- SMB - Path C: file shares hold contracts, HR and customer data, so a local model on a CPU server (HW1) is attractive, and the same Ollama + n8n setup later serves tagging (PREP-010) and RAG (PREP-013). It fits because the method needs scripts and judgement, not a product no vendor sells as such.
- Enterprise - Path B: large estates need volume, integration with Purview/SharePoint admin tooling and cloud APIs in an EU region; a central team runs it.
- Public - Path C: sensitive records and procurement rules favour self-operated tooling.
Path A - Buy (off-the-shelf)
- Microsoft 365: SharePoint Advanced Management (content management assessment, data access governance reports) and Purview for labels help find and rank sites; Restricted Content Discovery can hide not-yet-reviewed sites from Copilot and organisation-wide search while the clean-up runs [1]. It requires SharePoint Advanced Management (available with a Copilot licence or as an add-on), applies to SharePoint sites (not OneDrive) and does not change permissions. Microsoft offers EU Data Boundary options.
- Dedicated tools: content-analytics vendors for file shares (e.g. Varonis, Netwrix, Egnyte) exist, mainly aimed at larger estates and priced accordingly.
- Choose A when you are already on Microsoft 365 with Copilot and need reporting more than moving.
Path B - Build on cloud APIs
- Classification via an EU-hosted API (e.g. Mistral, a French EU provider; Azure OpenAI in an EU region; Aleph Alpha) with n8n or Power Automate. Needs an AVV (Art. 28 GDPR) and a check of what content is sent. Suits enterprises with a clean data classification (PREP-024).
Path C - Self-host (open source)
- Stack: fclones (MIT licence [2]), Python or PowerShell crawler, Ollama with a small model, embeddings such as bge-m3, n8n self-hosted for the review and move workflow, Paperless-ngx [3] for the scanned part.
- Hardware: HW1 is enough: classification of the first page of 100,000 files runs in hours to a few days on a modern CPU server; a 16 GB GPU only speeds it up.
- Ops effort: low once finished, the tooling can be switched off after the project.
Path D - Custom training
Not needed. A fine-tuned classifier only pays off for a very large, uniform estate and needs several hundred labelled files per class.
State of the art (2026)
- Assistants now search whole tenants, so structure and freshness of content directly decide answer quality; vendors therefore ship governance features alongside Copilot [1].
- Small local models classify document type and status well on clean text; they fail on scans without OCR, on very short files and on company-specific jargon (PREP-015).
- Limits: "which version is final" is often not in the file. Dates and file names help, but the owner must decide. Near-duplicate detection produces false positives (similar offers for different customers), so never auto-delete.
Shared resources & combinations
- Same local stack (llm-small, embedding-text, workflow-automation) serves PREP-010 tagging, PREP-013 knowledge base and PREP-020 label harvesting.
- Prerequisite for PREP-023 (permissions) and KNOW-025 (retention); start with PREP-001 and PREP-003 for the overview.
Effort, cost & KPIs
- Path A: days to configure reports; licence costs for Copilot/SAM dominate.
- Path B: 1-2 weeks of build plus review time; API cost is small for first-page classification.
- Path C: about 2-4 weeks calendar time for a 50-person company, 10-15 person-days of IT/consulting plus owner time.
- KPIs: share of files in the target structure, duplicate share removed, files without owner, time to find a document (stopwatch test with 10 typical questions), share of correct assistant answers on a test set (PREP-018).
People & change
Involve: management sponsors and sets the rule "one place per document". Department leads and data owners decide per area. IT executes. End users must be heard early, because everyone has personal folder habits. DPO is consulted because HR and customer folders appear in the crawl (GUIDE-005).
Works council: depends. Crawling owners, edit dates and activity logs is objectively suited to monitor behaviour (§87(1) no. 6 BetrVG), so inform and agree early, state that metadata is used for structure and not performance, and consider an expert (§80(3)). §90(1) no. 3 applies if AI changes work processes. Public bodies involve the Personalrat (GUIDE-004).
AI literacy: Art. 4 AI Act requires measures that support staff's AI literacy; a one-hour session on the new rules and what the assistant can and cannot know is enough here (GUIDE-006).
Communication and pilot: pilot with one department that feels the pain; show before/after search times; name AI champions; offer a "I can't find my file" channel for the first month (GUIDE-008, GUIDE-009).
Concerns: "my files vanish" (old share stays read-only, move log), "more control over me" (no individual evaluation).
Risks, regulation & compliance
- EU AI Act: minimal risk; Art. 4 literacy measures only. See GUIDE-014.
- GDPR: file names and contents often contain personal data; purpose is internal organisation. Restrict the crawler to a service account, run locally where possible, AVV for any cloud API, DPIA usually not needed unless HR files are classified at scale (GUIDE-005).
- Records law: GoBD and tax retention still apply; archiving must keep original, unchanged and findable.
- Risks: mass moves breaking links, macros and shortcuts (test, batch, log), classification errors on sensitive folders (exclude HR/legal from automation), restructuring that exposes oversharing (fix via PREP-023).
Getting started
- Pick one area (for example Sales) and run a hash-based duplicate report with fclones.
- Hold a one-day workshop on target areas and the naming rule; appoint data owners.
- Test a local model on 200 files from that area and let the owner correct the proposals.
- Move in a batch with log, keep the old location read-only, measure search time before and after.
- Roll out area by area, then continue with PREP-010.
Sources
- Microsoft Learn - Restrict discovery of SharePoint sites and content (Restricted Content Discovery) - https://learn.microsoft.com/en-us/sharepoint/restricted-content-discovery
- fclones - duplicate file finder (MIT licence) - https://github.com/pkolaczk/fclones
- Paperless-ngx - https://github.com/paperless-ngx/paperless-ngx
- Ollama - https://ollama.com
- n8n - workflow automation - https://n8n.io
- Regulation (EU) 2024/1689 (AI Act) - https://eur-lex.europa.eu/eli/reg/2024/1689/oj