Document AI promises to read documents, extract fields and speed up processes. For a small or medium-sized business that is attractive: less typing, fewer e-mails, less repetitive work. But there is a trap. If the AI starts deciding without context, the company gains speed and loses control.
The goal should not be to replace the process. It should be to put the AI inside it: the machine reads and proposes, the process says what is expected, and a person decides when the reading is not enough. That is what governed AI means.
What an SME actually needs
Most SMEs do not need a model laboratory. They need to answer five questions about every case:
- Did we receive the right document?
- Were the key data extracted — the tax number, the date, the amount?
- Is anything missing?
- Did somebody approve it?
- Did the operation go ahead — was the payment released, the contract registered, the customer activated?
These are questions about the process, not about the model, which is why AI on its own cannot answer them. What answers them is a layer of governance around the AI: processes that declare the expected documents, states that say where each case stands, permissions that say who sees what, human review where it is needed, and a history that stays.
Where the black box appears
The black box appears when the system only says "approved", "extracted" or "processed" without explaining the source. Which document did the value come from? How confident was the reading? Did anyone validate it? Was the document inside the right dossier? Did the reader have permission for that source?
Without those answers, the AI stops being an assistant and becomes a risk: a wrong value that went through because it looked plausible, a document of the wrong type accepted because it had the right words, a confidential detail read by somebody who should not have seen it.
How to avoid it: six design rules
A well-designed Document AI should:
- Work on expected documents, not loose files. A loose file has no type, no obligation and no validity; an expected document — a signed contract, a proof of address — has all three. It is the difference between a folder and a dossier, explained in What a dossier actually is.
- Show extracted values with their source. Each value appears next to the document it was read from, so that a person can compare it with the original. A value without a source is a claim; with a source, it is evidence.
- Use confidence as a review signal. The model knows when it is unsure, and that number should decide who looks, not decorate a screen. One threshold per document type — below it, a person is asked — is enough for most cases.
- Stop when a person is needed. An uncertain reading, an unexpected document type or a process rule that demands validation should hold the case in a review queue instead of letting it flow on to a payment.
- Respect access and confidentiality. The AI reads what the person asking is allowed to read, and nothing else. A sensitive field — a bank account number, a medical detail — must be excludable from the AI altogether, not merely hidden at the end.
- Leave a history of decisions. Who approved, who returned, for what reason and when. Without it, the second audit starts from zero.
In short:
| The black box says | Governed AI shows |
|---|---|
| "Processed" | Which document was read, and as part of which case |
| A value | The value, the source document and the confidence of the reading |
| Nothing, and moves on | A stop for review when confidence is low |
| A final state | Who decided, when and why |
None of the six rules calls for a better model. They call for a process around the model — and that is the part an SME already knows how to do.
The role of DOK Genius
DOK Genius uses document AI inside dossiers. A process declares the expected documents, the fields to fill, the approvers and the confidentiality rules. The AI does not read "some PDF": it reads one piece of a governed case, and knows which piece.
The six rules above are decisions taken in the process, not in code. Each expected document says whether the AI should read it and the confidence threshold below which a person is called; a field marked as sensitive stays out of the AI altogether. When confidence is low or the document is not the expected one, the dossier stops in Quality Review: the reviewer sees the result next to the document, approves, returns it with a reason or rejects it — and the human decision always wins. Those decisions stay in the audit trail. Confidentiality per document is on the roadmap.
That is what makes the automation useful for SMEs: fast enough to remove manual work, controlled enough to support decisions. What the product does today is under features; the plans are on pricing.
FAQ
Does an SME really need document AI?
It does if it receives documents from third parties — invoices, contracts, certificates — and somebody reads them to copy data somewhere else. That work is repetitive, error-prone and invisible. What an SME does not need is to train models: it needs automatic reading with context, and a point where a person decides.
What does "human-in-the-loop" mean in practice?
That the machine proposes and a person decides, but only when needed. Reviewing everything cancels the automation; reviewing nothing passes the risk to whoever comes next. The middle ground is a queue where cases with low confidence or an unexpected document type come to a stop, and where every decision is recorded with its reason.
Can the AI's confidence be trusted?
It is a signal, not a guarantee. A value at 98% confidence can be wrong and one at 60% can be right. So it should decide who looks — and the lowest confidence in a case matters more than the average.
How do you stop the AI reading what it should not?
By applying access before the reading, not after it. Whoever consults a result sees only what they would be allowed to open, and the dossier records who decided what. Filtering the answer at the end is too late, because the content has already been read — the reasons are in Why your AI assistant answers with the wrong document.