ai:data
What data employees can put into AI tools: a classification guide.
By Loan Laux · November 13, 2026 · 8 min read
An AI data classification policy tells staff which classes of company data may go into which AI tools. It is decided once and inherited by every tool the company adopts: each tool gets a ceiling, the highest class it may receive, and the question at the moment of pasting becomes whether the data's class sits at or below that ceiling.
This guide is for the IT, security and data-protection leads who write that rule down, with worked examples by team.
Build the AI data classification policy on the scheme you already have.
Your security team may already label data by class: public, internal, confidential and regulated, or its own names for them. Our enterprise AI governance framework starts with that classification in its "Data classification" section and gives each class an AI-handling rule. This policy turns those rules into something staff can apply alone, without asking.
Keep the class names people already know, and add one AI column: the tools each class may go into. One owner, one review cycle, one set of labels. A separate AI scheme means two vocabularies, and on the day they disagree nobody knows which one wins.
Give every AI tool a ceiling.
Sort the tools staff can reach into three groups, then give each tool the highest class it may receive. Three facts set the ceiling: whether the vendor keeps or trains on what is sent; where processing happens, which can differ from where data is stored (our post on AI data residency in the UAE shows how one deployment setting moves it); and who can read the logs. Read them from the vendor's data-use page and your contract, and record the date, because vendors update these pages.
- Consumer accounts. Individual plans, free or paid, signed up by the employee, with no admin view and no company contract. OpenAI's help centre (read 13 November 2026) says content from its plans for individuals (Free, Plus and Pro) may be used to train its models unless the user turns that off. Ceiling: public.
- Enterprise accounts under contract. A business plan with an admin console and a data processing agreement. OpenAI's enterprise privacy page (updated 8 January 2026) says it does not train on ChatGPT Business, Enterprise or API data by default. Microsoft's Copilot privacy page (updated 3 November 2026) says prompts, responses and data accessed through Microsoft Graph are not used to train foundation models. Ceiling: internal or confidential, set by processing location and log access.
- Internal deployments. Models the company calls through its own cloud account or runs on its own hardware, behind its own sign-in and logging. Ceiling: what the security team allows for any system with the same hosting and access controls.
The check before you paste.
The policy works or fails when someone has a document open and a chat box next to it. Give staff a check short enough to run there, and print it on the approved-tools page:
01:
What class is this?
The highest class of anything in the text, attachments included. A public template filled in with a customer's details takes the class of the customer data.
02:
What is this tool's ceiling?
Look it up on the approved-tools page, which lists each tool, the account type and its ceiling. A tool missing from the page has a ceiling of public.
03:
Can I bring it under the ceiling?
Remove what pushes it over: names, account numbers, amounts, client identifiers. If the task still works on the stripped text, use that. If not, it needs a tool with a higher ceiling.
04:
Still unsure?
Ask before pasting, in a named channel that someone answers the same working day.
Worked examples by team.
These use the four classes of the governance framework. Your class names and ceilings will differ; the reasoning carries over. Whatever the class, credentials such as keys and passwords never go into a prompt.
| What staff want to paste | Class | Where it can go |
|---|---|---|
| A customer support ticket | Confidential: it names a customer and an account | An enterprise account once the name and account number are removed; as written, only a tool cleared for confidential data |
| An HR file on one employee | Regulated where it holds health or biometric data, confidential otherwise | Only a workflow approved for HR data, with a named owner; never a consumer account |
| A signed contract | Confidential | An enterprise account cleared for confidential data, or an internal deployment |
| Source code | Internal or confidential, set by the repository | The coding assistant the company licenses, on the repositories its licence covers |
| Board papers | Confidential or higher until published | An internal deployment, or no AI tool until the board secretary clears it |
Personal data: what the texts say.
Personal data runs across classes and carries its own law. We describe the texts and leave their reading for your company to your counsel.
In the UAE, Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (in force since 2 January 2022) defines personal data as data relating to a natural person who is identified, or can be identified directly or indirectly. It defines sensitive personal data separately, covering data that reveals a person's family, ethnic origin, political or philosophical opinions, religious beliefs, criminal record or biometric data, or relates to their health. Article 2 lists what it does not apply to, among them government data and government entities, health and banking data that have their own legislation, and free-zone companies with their own data protection legislation. Article 5 says personal data is to be limited to what is necessary for the purpose, and Articles 22 and 23 cover transfers outside the country.
NIST AI 600-1, the Generative AI Profile of the AI Risk Management Framework (July 2024), lists data privacy among the risks of generative AI, including leakage and unauthorized disclosure of personal or sensitive data. The OWASP Top 10 for LLM Applications 2025 lists Sensitive Information Disclosure as LLM02, naming personal data, financial details, health records, confidential business data, security credentials and legal documents.
For the policy, we class a record by the highest class of anything in it, and give sensitive personal data a ceiling of its own.
When someone gets it wrong.
Someone will paste a contract into a personal account. Decide in advance what happens next: a same-day report in a named channel, and nothing more asked of the person who made it. If reports lead to blame, the next one is not made.
On a report, IT records which data, which class, which tool and account, and when. On an enterprise account, admins can act: OpenAI says ChatGPT Business workspace admins can view, export and delete conversations, and Microsoft says admins can find Copilot interactions through Content search or Microsoft Purview. On a consumer account only the user can act, so they delete the conversation and note when. The data protection lead then decides, with counsel, whether a notification duty applies.
Each report should change one thing: a tool's ceiling, a line on the approved-tools page, or the wording of the check.
Checking the policy works.
A published policy shows what staff were told. Three things show what they do: the tools in real use, compared with the approved-tools page; a sample of enterprise-account conversations, read for data above the tool's ceiling; and the reports since the last review, with what changed after each.
An AI workflow audit covers the first of these: we interview your team, shadow a live project, and audit the tools already in place. Our step-by-step workflow audit method is public if you would rather run it in-house.
Do it yourself, or bring us in.
Everything above can be done in-house by the leads who already own the classification: add the AI column, publish the approved-tools page with ceilings and dates, teach the check, and name the reporting channel.
Outside help fits when the page is live and people still reach for tools it does not list, because the approved tool cannot do the job. An audit takes two weeks and ends in a written, sequenced roadmap that fits your security review, procurement and data-residency rules.
Frequently asked questions.
Can staff use ChatGPT with company data?
It depends on the account and the class. OpenAI says content from its plans for individuals may be used for training unless the user turns that off, so treat those accounts as public-only. For ChatGPT Business and Enterprise, OpenAI says it does not train on business data by default; the ceiling then depends on your contract, processing location and log access.
Is an enterprise account enough for confidential data?
It is where the decision starts. The contract settles training and retention; you still need to know where prompts are processed and who can read them. Connected sources matter too: Microsoft says Copilot surfaces only the organizational data a user has at least view permission for, so loose file permissions widen what it can reach.
Do we need a separate classification for AI?
No. Add an AI column to the classification you already run, listing the tools each class may go into. Two schemes drift apart.
Who owns the AI data classification policy?
Whoever owns the existing classification, working with the data protection lead and IT. One named owner keeps the approved-tools page current, sets re-check dates for vendor terms and receives the reports.
Do uploaded files follow the same rule as pasted text?
Yes. A file takes the highest class of anything in it, comments and hidden sheets included, and the same tool ceiling applies.