Data Classification for AI-Enabled Work: Classify the Use, Not Just the File

Inventory information at the field and context level

Record the source system, data owner, fields used, subject population, geographic or contractual constraints, retention, and approved audience. Note derived data and combinations that create a new risk. Identify whether the tool will summarize, infer, classify, generate, or act. A classification copied from a folder should be treated as a starting point, not the complete decision.

NIST SP 800-60 Volume 1 provides guidance for mapping information types and systems to security categories based on confidentiality, integrity, and availability impacts (NIST SP 800-60). Its federal methodology can inform structured questions, but organizations must use their own current policy and obligations.

Sources: [1]

Create a use-aware data card

The card includes the information type, source classification, approved purpose, permitted model or service, transformation, destination, access group, retention, verification owner, and stop condition. Add a “combination effect” field for joins and a “derived output” field for inferences. Link every entry to the governing policy version and system configuration.

NIST’s AI RMF emphasizes mapping the context of an AI use and documenting risks to people and organizations across the lifecycle (NIST AI RMF). That supports evaluating the specific task and affected parties rather than assuming one tool-wide label resolves every use.

Sources: [2]

Worked artifact: support-ticket analysis

Imagine a synthetic project that clusters customer support tickets to identify recurring product issues. Individual tickets are labelled internal, but they include names, account identifiers, free-text health details, and contract complaints. The proposed external AI service is approved for general internal text but not for those fields.

The data card removes direct identifiers, excludes health-related text, limits the dataset to a defined period, and sends only approved fields to a controlled workspace. The output is an aggregate theme table with minimum group sizes and a human review for re-identification clues. The stop condition is any output that exposes a person, account, or excluded category. The packet records the query, field list, transformation, sample checks, owner, and deletion date.

Verify permissions and outputs separately

Check access using the actual account and configuration, not a policy description alone. Inspect source extracts for excluded fields, test transformations on boundary cases, and review outputs for unexpected reconstruction. Confirm that logs, caches, exports, and collaboration features follow the same decision. Reopen the card when the model, service, data, purpose, destination, or audience changes.

Handle uncertainty explicitly

If a field’s classification or contractual status is unclear, hold or reduce the use until the owner resolves it. Do not use AI-generated labels as the only classification evidence. Record who made the final determination and the source they applied.

Test the card against realistic escape routes

Run a small exercise using copy and paste, file upload, connected storage, export, collaboration links, logs, and support access. A restriction that applies only to the initial upload may fail when a user exports the result or shares the conversation. Check the actual service configuration and account permissions rather than assuming the marketing description reflects the deployed state.

Review derived outputs separately from raw inputs. A summary, cluster label, or prediction may reveal sensitive information even when direct identifiers were removed. Record the audience and retention of the derived artifact, and set a deletion or reclassification action when its use ends.

Keep a decision log for denied uses as well as approved ones. The log should state the proposed purpose, missing authority or control, safer alternative, and review condition. This prevents repeated requests from being approved informally after the original context has been forgotten.

This method is educational. It does not establish legal compliance or security-control effectiveness. Current policies, contracts, jurisdiction-specific advice, technical configuration, and operating evidence remain authoritative.