How to Use NotebookLM for Work: Company Documents and Team Files

How to Use NotebookLM for Work: Company Documents and Team Files

To use NotebookLM for work, create one notebook per subject, upload only the sources you need, and ask questions that require an answer with a citation from the original passage. Before you upload any file, decide what kind of data may go in, under which account, and who reviews the output. The tool helps you summarize and query material your team already has. It does not replace human checking, and it does not make the privacy decision for you.

Key takeaways

• NotebookLM answers based on the sources you load into the notebook and shows where each passage came from, which makes checking easier.
• One notebook per topic (one contract, one product, one project) works better than a single notebook with everything mixed together.
• A summary is a starting point. Check the citations before you use an answer in a decision, a proposal or a message to a customer.
• Classify your data before uploading: personal data, confidential contracts and trade secrets each need an explicit decision.
• Start with a small pilot that has an owner, a written usage rule and a simple criterion for deciding whether to continue.

What is NotebookLM and where does it help a company?

NotebookLM is a Google tool where you create notebooks and add sources such as PDFs, text documents and web pages. You then talk to that material: ask for summaries, put questions to it, and get answers with citations that lead back to the original passage. The difference from a generic chatbot is the anchor. The answer comes from the sources you chose, not from what the model "remembers" from the internet. It is the same basic idea as retrieval-augmented generation: look in the right material first, and only then write the answer.

A note on where this article's claims come from. The general behavior described here (sources, citations, summaries) reflects how the tool is documented to work. Accepted formats, size limits, features and rules by account type change over time, so check Google's official help pages before you define your team's procedure. The routine and privacy recommendations are our implementation experience and common sense, not a guarantee from the vendor.

Inside a company, the most natural use is material that is long, stable and consulted repeatedly:

• procedure manuals and internal policies;
• contracts, amendments and commercial proposals;
• reports, studies and technical documentation;
• meeting minutes and notes;
• training and onboarding material.

The use is weak when information changes by the hour (inventory, schedules, order status) or when the answer must respect permissions per person. In those cases the problem is a systems problem, not a document-reading problem.

Step by step: building your first notebook

The most common mistake is uploading an entire folder and asking "what do we have on this?". The result is generic and hard to verify. A safer path:

• Step 1: pick a question your team keeps asking, such as "what is the procedure for X?" or "what does the contract say about Y?". If nobody repeats the question, nobody will use the notebook.
• Step 2: list the documents that answer that question and set the rest aside. Fewer sources, more clarity.
• Step 3: confirm the version. If there are two versions of a policy, upload only the current one, or name both unambiguously, for example with the date in the file name.
• Step 4: review the content before uploading. Remove unnecessary personal data, attachments with customer information and any credentials left in a document.
• Step 5: create the notebook with a name that states the topic and the owner, and use the corporate account your company has defined.
• Step 6: ask about ten questions whose answers you already know. Compare them with the citations. This test shows whether the tool reads that type of document well.
• Step 7: only then share it with the team, with the usage rule in writing and one person responsible for updating the sources.

Step 6 is usually skipped and is the most useful. Scanned PDFs, complex tables and badly formatted documents can be read incompletely, and it is better to find that out with known questions than in a real decision.

Case studies: documents, summaries and questions with sources

The three scenarios below are illustrative. They do not describe real customers or measured results. They show the format of use.

Illustrative scenario 1: onboarding. A services company has a procedures manual, an expense policy and a customer service guide. The HR lead creates a notebook with only those three documents. A new hire asks "how do I request reimbursement for a trip?" and gets an answer with the citation from the policy. While testing, HR notices that the manual and the policy say different things about a deadline. That is the unexpected benefit: the notebook exposes inconsistencies nobody had noticed. The fix happens in the original documents, not in the tool.

Illustrative scenario 2: supplier contract. An operations manager uploads a contract and its two amendments and asks about notice periods, each party's obligations and renewal conditions. The manager also asks the answer to say which document each rule comes from, because an amendment may have changed the original clause. The manager uses the result to prepare for a conversation with the legal team, not to decide alone. The tool speeds up reading. Interpreting the contract stays with the people qualified to do it.

Illustrative scenario 3: project meetings. A team keeps a notebook with the written minutes of a project's weekly meetings. The coordinator asks "what decisions were made about the delivery date, and who was made responsible for each point?". The answer comes with citations from the minutes. If the minutes come from recordings and transcripts, review the notice given to participants and the legal basis first, a topic we cover in recording meetings with AI and LGPD.

In all three cases the pattern is the same: short, chosen sources, a specific question, a checked citation, a human decision.

How to ask questions that come back with a reliable source

Answer quality depends heavily on the question. Some practices that lower the risk of error:

• Ask for the passage. "Quote the paragraph that supports this answer" forces the tool to show its basis.
• Allow "I did not find it". Add to the question: "if the documents do not answer this, say so clearly". This prevents made-up answers that fill the gap.
• Ask per document. "What does amendment 2 change compared with the original contract?" is better than an open question about everything.
• Compare sources. Ask the tool to point out differences between two policies or two versions.
• Click the citations. An answer where at least one citation has not been checked should not go to a customer, the board or the legal team.
• Separate fact from interpretation. First ask what the document says, then, in a separate question, what that means for operations.

There is also a security point. Documents from outside sources (third-party proposals, forwarded emails, web pages) can contain text written to manipulate a model, which is called prompt injection. The risk is lower in a research notebook than in an agent with access to tools, but it exists. Our guide to prompt injection protection for AI agents explains the problem, and the OWASP guidance on preventing prompt injection is a good public reference. In practice: treat external sources as untrusted, and never act on an answer without checking the original.

What privacy precautions should you take before uploading files?

The central point is that uploading a file is processing data. If the document contains personal data about customers, employees or candidates, Brazil's data protection law (LGPD) applies, including the principles of purpose and necessity: use the data for a defined purpose and only to the extent needed. ANPD, Brazil's data protection authority, is the official reference for guidance on the subject.

A checklist for the decision before upload:

• Classify the document: public, internal, confidential, with personal data, with sensitive personal data. Each class has its own entry rule.
• Use a corporate account, never an employee's personal account, so the company controls access and what happens when that person leaves.
• Read the data-use rules for the type of account you will use. They often differ between personal and corporate accounts, and the person who answers for checking them is the company's owner of the process, not the vendor.
• Understand where the data goes. If the service processes information outside Brazil, see what LGPD requires for international data transfer when using AI.
• Remove what is not needed: tax IDs, addresses, bank details and attachments that do not help answer the notebook's question.
• Do not upload passwords, access keys, tokens or documents containing credentials, not even "just for a test".
• Avoid health data, children's data or other sensitive data without a formal decision on legal basis and necessity.
• Check confidentiality clauses in third-party contracts before sending the content to any service.
• Control notebook sharing: who can view, who can edit, and for how long.
• Keep an inventory: a list of notebooks, owner, purpose, sources and the date of the next review.

If your company already has a general rule for AI tools, NotebookLM should be covered by it. Our article on a company policy for employee ChatGPT use works as a model: what to allow, what to ban and who approves exceptions. When the content truly cannot leave the company's environment, the alternative is a different architecture, such as the one described in running Ollama local models in a company, with its own operating and maintenance costs.

How to move from a test to a team routine

NotebookLM is easy to start with, and that is a risk: notebooks appear without owners, with old versions and files nobody remembers uploading. Organizing the use follows the same logic we apply in larger AI projects, in four moves.

• Map: which question the team repeats, where the answer lives today, how long it takes to find it and who checks it. This starting picture is what you compare against later.
• Limit: define which documents go in, which accounts are used and which people have access. The smaller the scope, the easier it is to audit.
• Pilot: choose one notebook and a small group, with a success criterion agreed beforehand, for example "the person finds the correct answer and checks the source without asking a colleague for help". Record errors and doubts.
• Hand over: deliver the notebook with an owner, an update rule and a written usage policy, and decide together whether to expand, adjust or stop.

For a broader way to structure risk, the NIST AI Risk Management Framework is a useful public reference, even though a small company is not required to follow it.

It is also worth knowing when NotebookLM stops being enough. If the need is to answer customers on WhatsApp, query data that changes in real time, respect per-user permissions or log decisions for audit, a research notebook is only the beginning. That calls for an agent with integrations, limits, handoff to a human and decision records, which is a different kind of project (see how to integrate AI into your company's WhatsApp). Often the NotebookLM pilot helps you discover exactly which documents and questions deserve that investment.

Frequently asked questions

Can NotebookLM be used with the company's Google account? Generally yes, and it is the recommended route compared with a personal account, because it lets the company control access. Availability, sharing and data-use rules vary by account type and can change. Ask your IT or privacy owner to check the current official documentation before releasing it to the team.

Can NotebookLM make mistakes or invent answers? Yes. Citations reduce the risk because they let you check the passage, but the tool can still misread a table, mix up versions or summarize imprecisely. So the rule is to check at least the main citation before using an answer in a proposal, a contract, external communication or a decision.

Can I upload contracts and customer data? It depends on the document's classification, the account used and what the contract and LGPD allow. Without a prior decision on purpose, necessity and legal basis, the prudent course is to remove unnecessary personal data and not upload material covered by confidentiality without authorization. When in doubt, consult your legal team or your company's data protection officer.

Does NotebookLM replace an AI agent on WhatsApp or a custom system? No. It is for querying and summarizing documents chosen by people on your team. A customer service agent needs integrations with your systems, limits on what it can do, handoff to a human and decision records, which requires a specific project. A notebook can be a good first step to map what knowledge such an agent would need.

Sources

• ANPD: Autoridade Nacional de Proteção de Dados
• AWS: What is retrieval-augmented generation
• OWASP: prompt injection prevention
• NIST AI Risk Management Framework