AI Data Classification: What Company Data Can an AI Tool Access?
AI data classification is the practice of sorting company data into tiers by what each document contains, then setting which AI tools may access each tier. Public material can go into any approved tool, and internal material into tools whose terms rule out training. Confidential data needs a signed agreement, and restricted data such as payment details stays out entirely.
Picture the copy shop down the street. You'd hand the clerk your event flyer without a second thought. You'd pause before handing over the board deck, and you'd never hand over a stack of customer files, whatever the clerk promised about the shredder.
Your team makes that call every day with AI tools, usually without the pause. A sales rep pastes a call transcript into a chatbot to draft the follow-up. A finance lead uploads the cap table to check a formula. Every AI tool is a copy shop that reads each page you hand it, and some keep copies.
Two questions decide what a tool may see. What does the document actually contain, and what has the tool promised to do with it?
AI data classification tiers
The first question sorts the data. AI governance for a small company sets three tiers for a one-page AI policy: public, internal and confidential. A fourth tier covers data no general AI tool should hold, and each tier sets what a tool may access:
| Tier | Holds | AI access |
|---|---|---|
| Public | Published posts, the website, a competitor's pricing page | Any approved tool |
| Internal | Meeting notes, drafts, plans, rounded metrics | Approved tools whose terms exclude training |
| Confidential | Customer contracts, call recordings, source code, financials | Tools under a signed data processing agreement, where the customer's contract allows |
| Restricted | Health records, payment card numbers, government IDs, passwords | No general AI tool |
Bring in a lawyer before building any workflow that genuinely needs restricted data.
Your advantage sets the hardest line. If the company wins on a proprietary algorithm, that code is confidential everywhere. If it wins on customer relationships, so is the customer list.
Hard cases
Most documents sort themselves. The hard ones hold a mix, and the highest tier inside a document sets the tier for all of it.
| Document | Tier | Why |
|---|---|---|
| Sales call transcript | Confidential | The customer names a budget and a problem |
| CRM export | Confidential | Names and emails are personal data, even in a spreadsheet |
| Investor update | Internal or confidential | Rounded growth is internal; runway and deal terms aren't |
| Job applicant résumés | Confidential | Personal data, and the hiring call stays with a person |
| Survey results in aggregate | Internal | Totals with no names drop a tier |
| Support ticket with a card number pasted in | Restricted | One field sets the tier |
Removing names helps less than it looks. A contract with the customer's name blacked out still describes one customer's deal, and anyone in the industry can often tell whose. Aggregated numbers drop a tier, and a redacted single record keeps its own.
When the customer's contract decides: a customer agreement can limit where that customer's data goes, whatever your own tiers say. Read the confidentiality clause before a customer's material goes into any AI tool, including an approved one.
Connected tools and agents
The copy shop changes once you hand it a key to the filing cabinet. A connected AI tool reads whatever the account it runs under can open, without waiting for anyone to pass it pages. Microsoft's Copilot privacy documentation (2026) says the tool surfaces any company data a user has permission to view.
So the folder someone shared with the whole company three years ago is now one question away from anyone who asks. Fix access before you connect anything:
- Permissions: close the folders that are open to everyone and shouldn't be.
- Scope: connect a tool to the folders its job needs, never the whole drive.
- Agents: give an agent its own account with the narrowest access that works, rather than a person's login.
The same tiers decide what goes into a company's AI operating system, the shared context every tool reads. AI agent operating system covers what an agent needs before it does real work. I build the same boundary into my own systems. Muster, my outbound system, gives each client its own deployment and database rather than a login to a shared one, because separate databases are what make a confidentiality promise real. Cadence, the company context layer I build, lives in a repository the company owns, and nothing about it depends on software I run.
Classification mistakes
Connected tools raise the cost of a wrong tier. Three mistakes put data in the wrong one:
- Sorting by file type: "meeting notes are internal" breaks the first time a customer's name and budget land in the notes. Sort by what a document contains.
- Classifying once: a customer table that started with names and emails grows a payment field, and nobody moves it up a tier. Re-check a source whenever it gains a field or a new tool connects to it.
- Trusting the product name: one product can carry different terms on a personal plan and a work plan. Anthropic's 2025 consumer terms update lets people on Claude's personal plans allow training on their chats, with data kept for five years, while its work plans and API sit outside the change. Check which plan the account is on.
Deciding what a tool may see
Nobody carries the whole filing cabinet to the copy shop. A team that sorts its data first can use AI tools freely on most of it and keep the rest out of reach. Start with the shared drive and the CRM, since both hold customer data and both are easy to connect.
If you don't know how far AI has already spread through the company, the AI readiness assessment scores it. To write the rules down for the team, use the one-page policy on the AI governance page.
Sort the pages before you hand them over.
Common questions
Can we put customer data into an AI chatbot?
Customer data can go into an AI chatbot only when the account sits on a business plan covered by a signed data processing agreement, and only when the customer's own contract allows it. A personal account on a free plan never qualifies, whatever its privacy settings say.
Does anonymizing data make it safe to use with AI?
Anonymizing data makes it safer to use with AI when the result is aggregated, such as totals across hundreds of customers. Removing the names from a single record helps less, because the details that remain often identify the customer anyway. A redacted record keeps its original tier.
Who should classify company data at a small company?
Company data at a small company is best classified by the person who owns the AI policy, with each team lead sorting the sources their own team uses. The policy owner settles the disputed cases and re-checks a source whenever it gains new fields or a new tool connects to it.
Is source code confidential when a team uses AI coding tools?
Source code is usually confidential when a team uses AI coding tools, so those tools belong on a business plan under a signed data processing agreement. Code the company has already published as open source is public. Secrets such as API keys and passwords are restricted and should never sit in code a tool can read.