Data classification
What it means
What is data classification?
Data classification means labelling what is in a dataset, document or prompt by sensitivity. Common tiers are public, internal, confidential and restricted. A company can then decide what may reach a given AI tool. That way nobody pastes something in and finds out too late.
NIST's own method for federal systems ties each category to a real question, not a subjective label. The question is what actually happens to confidentiality, integrity or availability if this breaks. That means naming who could see this data, alter it, or take it offline. A scheme built the same way works for AI. That is what makes classification useful for a real decision, not a compliance exercise nobody consults.
Every new tool a company adopts multiplies the places a given tier could leak from. That is why the scheme has to live inside the AI register, not beside it. Without a scheme, two employees facing the same document reach different answers. The wrong answer usually only surfaces after the data has already left the building through a chat prompt.
Published · Updated
In practice
Why it comes up
It is the first practical question underneath any AI acceptable-use policy. Can this go into that tool? Nobody can answer that until someone has labelled what this actually is. A security reviewer asks for the classification scheme by name, not as an abstract principle. The scheme is what turns a policy from a statement of intent into something an employee can actually follow on a Tuesday afternoon.
What to do about it
Keep the scheme small. Three or four tiers is enough for most companies, and a scheme nobody can remember gets ignored the same as none. Map every AI tool in the register to which tiers may reach it. Make the most important rule explicit: customer data and secrets never go into an unclassified tool. The AI Governance Starter Kit already includes this table, mapped to what may reach a vendor.