Your systems of record hold what someone remembered to type in. Your email holds what actually happened. Think of the commitment made on a Friday afternoon, the discount agreed as a one-off, the early warning that a delivery would slip, the approval given in a reply rather than a form. Most of the knowledge that runs a business lives in inboxes, messages and voice notes, and it is the source AI projects most often leave out. Turned into structured knowledge, lawfully and carefully, email is the richest input an AI that knows your business can have.
Your systems of record are only half the record
A CRM, an ERP or a contract repository records outcomes. The deal was won at this price. The invoice was raised for this amount. The contract was signed on this date. That is valuable, and it is exactly what AI projects usually start with.
But it is only half the record, and often the less interesting half. It rarely says why the price was what it was, what was promised to win the deal, which clause was verbally softened, or who first noticed the problem that became a complaint. Those things were written down, just not in the system. They were written in email.
Anyone who has had to reconstruct a disputed agreement knows the drill: the system says one thing, and the truth is somewhere in forty threads across five inboxes. People do this reconstruction by hand, slowly and expensively. It is precisely the kind of work AI should be doing, provided it can see the evidence.
What is actually in there
When you look at a business's email as a source of knowledge rather than a pile of messages, the same categories keep appearing.
Commitments and promises: what was agreed, by whom, by when. Decisions and approvals, often given in a one-line reply. Exceptions: the special terms, the one-off credit, the agreed deviation from the standard process. Early warnings: the first sign of a delay, a complaint or a customer at risk, usually long before anything is logged. Relationships: which of your people hold each customer and supplier relationship, which is often not what the CRM says.
And attachments. The latest version of a contract, a quote or a specification is frequently the one sent by email, not the one filed in the repository. An AI that cannot see email is often working from the second-latest version of the truth, and has no way of knowing it.
Why AI projects skip it
There are good reasons email gets left out, and none of them is permanent.
It is messy. Threads branch, quote each other, and bury the new content under signatures and disclaimers. It is voluminous, and most of it is noise. It is private, and handling it carelessly is a real legal and ethical risk. Permissions are complicated, because the same message may be visible to some people and not others. And there is an understandable reluctance to be the person who suggested pointing AI at everyone's inbox.
So projects start with the tidy systems of record and plan to "add email later". Later rarely comes, and the AI ends up confidently answering from half the story. This is one of the root causes I describe in your AI does not need a bigger model, it needs to know your business: the model is capable, but the knowledge it needs was never given to it.
From inbox to knowledge
The technique is not exotic. The pipeline looks broadly the same everywhere.
Messages are ingested with their permissions intact, and every fact extracted from them inherits those permissions, so the AI does not become a back door into mail someone could not already see. Threads are split into individual messages; quoted text is de-duplicated against the original message rather than simply discarded, and signatures and disclaimers are stripped out. The people, companies and contracts each message mentions are identified and linked to your entity registry, so an email from "Priya at Northgate" attaches to the right customer.
Then the useful content is extracted as structured facts: this commitment, made by this person, to this customer, due on this date, with a link back to the exact message. When a later message changes a commitment, the earlier one is marked as superseded rather than deleted. Low-confidence or high-stakes extractions go to a person for review.
The link back to the source message is not optional. It is what makes every answer checkable, and it is what turns an inbox into evidence.
Close the communication loop
Email is the obvious source, but the same idea applies to every channel where work actually gets reported: texts from the road, voice notes from someone driving between customers, messages in team chats.
The best operational systems make reporting from outside the office easy, then do the structuring themselves. It is the same principle behind the real-time operating pictures I built at national scale: gather the signals where they happen and structure them centrally. People should not have to fill in a form after every call. They should be able to send a voice note or a two-line email, and the system should capture it, attach it to the right customer or order, extract anything that matters, and flag anything that needs a decision.
The goal is closed communication chains: nothing reported disappears into an inbox, every commitment has an owner, and the business knows what is happening as it happens rather than at the end-of-month meeting. That is what operational situational awareness means in practice, and it is the foundation for timely decisions.
Do it lawfully and respectfully
Email contains personal data, so this has to be done properly. This is not legal advice, and you should take your own, but the shape of a responsible approach under UK GDPR is well established.
You need a lawful basis, usually legitimate interests, supported by a written assessment that balances your interests against those of everyone in the emails, including the customers and suppliers who wrote them, and a check that reusing correspondence this way is compatible with the purpose it was collected for. The Data (Use and Access) Act 2025 added a short list of "recognised" legitimate interests that skip the balancing test, such as crime prevention, safeguarding and emergencies. Using business email to build AI knowledge is not on that list, so the full assessment still applies. Most projects of this kind are likely to need a data protection impact assessment. Process only what the purpose requires: start with shared, role-based mailboxes tied to a business process, filter out personal, HR and special category material, and have a documented way of handling what the filters miss. Keep access aligned with existing permissions and set retention limits. If a third-party AI provider processes the mail, you need a processor contract, clarity on where the data goes and an assurance it is not used for training. Update your privacy notices, and be ready for objections and subject access requests, which will now cover the extracted facts too.
And draw one bright line. Use email to understand the business, never to monitor individuals, which is also the thrust of the ICO's guidance on monitoring workers (ICO, 2023). The moment it becomes a surveillance tool, you lose the trust that makes people write things down honestly in the first place.
Where it pays first
Three situations tend to repay the effort quickly.
Disputes. When a customer or supplier contests an invoice, a delivery or a term, the question is always what was actually agreed, and when. A structured, sourced record of commitments turns a week of inbox archaeology into a short, defensible answer. I spent six days under cross-examination defending a reconstruction built from raw data as an expert witness in the Hong Kong High Court. Evidence that links every claim to its source is the kind that holds up.
Handovers. When someone leaves, their knowledge of each account usually leaves with them. Their email history, structured and linked to the accounts, can stay.
Customer and supplier history. Before a renewal, a negotiation or a difficult call, the full picture of a relationship is usually spread across many threads. Assembled and summarised with sources, it gives whoever picks up the phone the whole story in minutes.
How to start
Pick one shared mailbox connected to one process that matters, such as accounts receivable, customer service or supplier management. Agree the lawful basis and complete the impact assessment first.
Take three months of mail. Extract the commitments, decisions and exceptions, link them to the entities in your registry, and compare the result with what your system of record says. The gap between the two is the measure of what your AI has been missing. It is rarely small, and it is the most persuasive number you will find for doing the rest.
That comparison sits naturally inside a knowledge audit, because the first question in any audit is where your knowledge actually lives, not where it is supposed to.
If you suspect the most important knowledge in your business is sitting in inboxes, I would be glad to talk through how to use it safely. Let's talk.
Related: What is an entity registry, and why does your AI need one? · Your AI does not need a bigger model. It needs to know your business · Shadow AI is your next audit finding
