How to Deploy a Chatbot and Voicebot in a Large Company

“Who is accountable when the bot gives an employee or a customer the wrong information?” The answer depends on work done before the platform and the language model are chosen. The standard today is RAG (retrieval-augmented generation): the bot first retrieves fragments of company documents and only then composes an answer, so the model is the last link in the chain.

A deployment in a large organization breaks down into stages, and the first ones do not touch technology:

1. Inventory of sources and one authoritative document named for each area.
2. A control set of questions with answers approved by subject-matter owners.
3. A permission filter at the document retrieval stage.
4. No-answer paths and a path for escalation to a human.
5. A baseline measured before launch.
6. Content owners with a review rhythm.

Applies to MS Teams SharePoint intranet website chat call center

The knowledge base decides quality

A bot answers only as well as the content it reaches. In a large company the same procedure often exists in several versions: in SharePoint, on the intranet and in an old email attachment. The model will not resolve a contradiction between versions on the organization’s behalf, and it will not report it either.

Two actions pay back the most. The first is an inventory of sources with one authoritative document named for each area, before anything is indexed. The second is a control set of questions, usually 100 to 200, with answers approved by subject-matter owners. The set works as a regression test after every change to content, prompt or model.

Permissions in four steps

In a large company the same question can have different correct answers depending on who asks: an employee at headquarters, a franchisee or an external customer.

1. Review sharing before indexing. A folder shared with the whole organization for years becomes searchable with one sentence. Check: a list of broadly shared folders, reviewed by their owners.
2. Filter at retrieval. Separate indexes or hard filters by role that apply before anything reaches the model. Check: a question outside the asker’s permissions returns neither a document fragment nor an answer.
3. Log retrieved fragments. Record answers and the content the system pulled from the base. Check: you can trace where a specific answer came from.
4. Penetration test. Attempts to extract content outside permissions, repeated because both the model and the base change. Check: a report of attempts and a list of fixes.

An instruction in the prompt such as “do not disclose internal information” does not replace step two. It is a suggestion that an ordinary, politely worded question can get around. Microsoft 365 Copilot follows this principle and shows only content the asker already has access to.¹

Three no-answer paths

Each path is closed the same way: a specific question in the control set, a counter of how often the path fires in the logs and a review of that counter whenever the prompt or model changes. Without the counter “I don’t know” disappears from answers within the first month, because nobody likes a bot that doesn’t know and nobody measures how often it guessed.

Escalation to a human

One of five signals triggers a handover to a person:

1. Low retrieval confidence.
2. Two failed attempts to answer the same question.
3. An explicit request from the person.
4. A tone that points to a complaint.
5. Topics excluded by policy, such as billing, HR matters or security.

Metrics and their traps

Measurement is introduced in three steps: first a written definition of a case closed in the automated channel, then your own baseline measured for several weeks before launch and, from the first week of operation, a manual review of a sample. Platform vendors’ benchmarks vary widely and rarely define the metric they count.

Upkeep in four elements

Bot logs grouped into topic clusters show what people actually ask, in their own words and in their own order. It is the best list of content to fix an organization can have.

Four layers of the voice channel

The latency budget stands apart. In conversation between people the gap between turns has a median of 100 ms, and averages across ten studied languages range from 7 ms for Japanese to 469 ms for Danish.² A bot that answers after a second falls entirely outside that range and the caller hears it, even without being able to name it.

Three sources of benefit

Consistency works both ways: an error in the content multiplies across the whole channel, and a fix in the document takes effect immediately and everywhere. A generative model never produces the same sentence twice, so the consistency concerns the source, not the wording of the answer.

Disclosing that it is AI

The person must know they are talking to artificial intelligence, and the information must be given clearly and distinctly at the latest at the first interaction. The obligation covers systems intended to interact directly with natural persons and follows from Article 50 of Regulation (EU) 2024/1689, known as the AI Act. The provision will apply from 2 August 2026.³

The European Commission is preparing guidelines on Article 50. In March 2026 it published the second draft of a code of practice on marking and labelling AI-generated content.⁴ The exact scope of obligations should be confirmed with legal counsel.

Six steps in order

1. Choose an area. High volume and reasonably tidy content. Check: you can name the five most frequent cases in that area.
2. Control set of questions. 100 to 200 questions with answers approved by subject-matter owners, before the first line of code. Check: the set includes questions for the three no-answer paths.
3. Escalation path. Designed together with the service team before production traffic starts. Check: the team knows it and has commented on it.
4. Baseline measurement. For 2 to 4 weeks. Check: the numbers are recorded together with the definition of each.
5. Launch. Production traffic in the chosen area.
6. Content owner. A named person with time reserved in their calendar. Check: the first review already has a date.

Organizations that follow this order carefully deploy more slowly and a year later still have a system that answers correctly. We run area selection, path design and the first deployment as part of the AI Automations & Agents package.

Frequently asked questions