What is data classification?
Data classification, often called information classification, means sorting information by how much protection it needs, so the right safeguards can be chosen.
A common scale runs from public information via internal to sensitive and highly sensitive. Each level has rules for where the information may be stored and who may see it.
Classification makes it easier to decide which AI tools may be used. Public information can often go to a public service. Sensitive information needs to stay in an environment you control.
Many organisations already classify information for their systems. What is often missing is applying it to AI.
How it works
Classification is often based on confidentiality, integrity and availability. How serious would it be if the information got out, became wrong or could not be reached? The answers give a level, and the level sets the protection required. For AI it is mostly about confidentiality, but integrity matters too when answers feed into decisions.
Why it matters
Classification makes the AI question manageable. Instead of assessing every tool against every document, it is enough to decide which levels a tool may handle. That gives staff simple rules and makes it possible to say yes to AI where the risk is low.
What to keep in mind
An AI answer can deserve a different classification from the documents it draws on. A compilation of many internal details can be more sensitive than each detail alone.
The classification also needs to travel with documents connected to an AI service, so access control can build on it.
What it means for you
Link your AI policy to your information classification. Then staff know what may be typed in where.
Common questions
What does data classification have to do with AI?
It decides which information may be used in which tool. Without classification, it is hard to know what an AI service may read.
Do we have to classify everything before starting with AI?
No. Start with the information the AI tool will use. The work can grow from there.
Who decides the classification?
The owner of the information, supported by the security or data protection function.
Related terms
Read more
All terms Updated