What data can go into AI tools?

Ground rules your team follows every time they use ChatGPT, Claude, Copilot, or anything else. Pick what's true today; you can tighten later. Blank fields stay flagged on your dashboard.

Data classification levels you use

Pick the labels your organization already uses. If you're not classifying yet, choose the levels you'll adopt.

Learn more

Public = fine to share externally. Internal = team-only. Confidential = restricted to a named group. Restricted = strictest handling, small named audience.

PII-tagged means the record contains Personally Identifiable Information. PHI-tagged means Protected Health Information and must follow HIPAA handling if you're a covered entity.

Data types NEVER allowed in AI tools

Hard-stop categories your team shouldn't paste into any AI prompt. This is the enforceable line.

×Personally Identifiable Information (PII) ×Protected Health Information (PHI) ×Payment / cardholder data (PCI) ×Government IDs / SSN / passport # ×Client confidential / NDA-covered ×Attorney-client privileged ×Trade secrets / IP under development ×Passwords / API keys / access tokens

Data types allowed with restrictions

OK to use in AI tools but only after review, redaction, or under specific policy conditions.

!Internal employee data !Financial forecasts / non-public results !Strategy / roadmap documents !Vendor contracts / MSAs !Customer lists / segmentation data !Proprietary source code

Policy notes (optional)

Anything specific to your industry, regulation, or existing policies you want captured now.

Framework hooks: This maps to NIST AI RMF MAP-3.1 (data mapping), ISO/IEC 42001 clause 6.2 (AI system requirements), and Colorado AI Act §6-1-1704 (high-risk data restrictions). Populating this module now saves your team from re-discovering these rules per audit.

← Back ·