# What is data classification?

> Data classification is labelling data by sensitivity, such as public, internal or restricted, before deciding what may reach an AI tool.

Source: https://meshin.co/glossary/data-classification
Updated: 2026-10-02

---

## Why it comes up

It is the first practical question underneath any AI acceptable-use policy. Can this go into that tool? Nobody can answer that until someone has labelled what this actually is. A security reviewer asks for the classification scheme by name, not as an abstract principle. The scheme is what turns a policy from a statement of intent into something an employee can actually follow on a Tuesday afternoon.

## What to do about it

Keep the scheme small. Three or four tiers is enough for most companies, and a scheme nobody can remember gets ignored the same as none. Map every AI tool in the register to which tiers may reach it. Make the most important rule explicit: customer data and secrets never go into an unclassified tool. The [AI Governance Starter Kit](/resources/ai-governance-starter-kit) already includes this table, mapped to what may reach a vendor.