Catalog / Data Readiness for AI / PREP-002

Use-case data mapping & gap analysis

For one concrete AI use case, map the needed data to sources, owners and gaps, and turn the result into a list of preparation tasks before any money is spent on tools.

Parts needed to run it yourselfAgents & automationLanguage model

Most AI projects in SMBs do not fail on the model but on a simple question nobody asked early: "Where exactly is the data this needs, who owns it, and is it good enough?" A data mapping answers this for one concrete use case in a few days: needed data items, real sources, owners, gaps and a prioritised task list. An LLM speeds up the boring parts (reading field lists, drafting the matrix, spotting contradictions), while the decisions stay with the process owner.

Problem & value

  • Who: companies that picked a use case (e.g. via GUIDE-001) and are about to buy or build. IT is often asked "can we do this with AI?" without knowing what data exists.
  • Today: feasibility is guessed in a meeting; surprises come late: history only in Excel, a key field empty in many records, the relevant step on paper, a system without export.
  • Why AI helps: an LLM summarises table and column lists, matches them to the requirements, drafts questions for data owners and writes the task list. It does not replace interviews.
  • Value: pilots do not stall in week six, and effort estimates become realistic. No sourced time-saving figure exists; compare planned and actual preparation effort in your first projects.

Narrower than PREP-001 (company-wide readiness) and PREP-003 (shadow systems); process mining (DATA-013) and the AI governance inventory (SEC-022) are separate.

Variants

  • Before buying (Path A candidate): do your data and fields fit the vendor's connectors?
  • Before a RAG assistant: map document types, versions, owners, access rights (PREP-013, PREP-023).
  • Forecasting: history length, granularity, labels.
  • Public sector: add a legal-basis column per source (PREP-025).

How it works

  1. use-case card
  2. data requirement list
  3. source discovery
  4. quality sample
  5. gap matrix
  6. task list
  7. go / no-go
  1. Use-case card (1 page): goal, output, users, frequency, required accuracy.
  2. Requirement list: what must the AI see to produce the output? An LLM drafts it; the process owner corrects it.
  3. Source discovery: per item, system, table/folder, format, owner, refresh rate, export option (PREP-005). Work from exports, not live access.
  4. Quality sample: 50-200 real records; check completeness, duplicates, formats, scans vs. native text.
  5. Gap matrix: one row per item, green/yellow/red with cause (missing history, missing field, paper only, no access, no legal basis).
  6. Task list and verdict: each gap becomes a task with owner and effort; verdict go, go after preparation, or no-go.

Human in the loop: the LLM drafts; process owner and data owner confirm every row.

Data preparation

The input here is mostly metadata, which keeps risk low: - Where it lives: ERP and accounting (DATEV, Lexware, SAP Business One), CRM, ticket system, Microsoft 365 / Google Workspace, file shares, Nextcloud, e-mail, Excel on personal drives, paper. - Typical gaps: history shorter than needed, free-text instead of fields, inconsistent customer numbers between systems, scans without text layer, no export function, unclear ownership. - Concrete steps: export field lists and 100 sample rows (mask personal fields); list SharePoint/Nextcloud folders with PowerShell or n8n; profile empty/duplicate rates with Power Query or pandas; interview two to four people per use case (about 45 minutes each). - Effort: typically 2-5 person-days per use case (planning estimate, not a benchmark). Related: PREP-005, PREP-006, PREP-011, PREP-022; GUIDE-003.

Implementation paths

Which path for whom

  • SMB: B. No product fits "your" use case and your systems; a light build with an LLM API, Excel/Power Query and a workflow tool (n8n, Power Automate) on exports is enough. A plain Copilot or ChatGPT-type seat also works for drafting, but it is not a tool for this task.
  • Enterprise: B. Same method, executed with the data catalogue and an approved LLM API behind the corporate gateway.
  • Developer: C. Script the profiling and matrix generation with an open-weight model (Ollama) so that schema information never leaves the network.

Path A — Buy (off-the-shelf)

  • Microsoft Purview (Data Security Posture Management, DSPM for AI) shows what sensitive and overshared data exists in Microsoft 365 and how Copilot and other AI tools access it. One vendor table lists DSPM for AI as requiring Microsoft 365 E5 Compliance; verify current licensing before relying on it [1][2]. Purview Data Map has no documented generic SMB/NAS file-share connector, so classic file servers need the Information Protection scanner [3].
  • Data catalogues (Atlan, Collibra, open-source DataHub) suit enterprises with many systems; overkill for most SMBs.

Path B — Build on cloud APIs

  • Stack: Excel/Power Query or a CSV export, an LLM with EU region (Azure OpenAI in an EU region, Mistral La Plateforme from France, STACKIT AI Model Serving (Germany)), orchestration with n8n (self-hostable, EU) or Power Automate.
  • Pattern: a workflow reads field lists and masked sample rows, asks the LLM to rate each requirement, and writes a draft matrix to a SharePoint list or Excel sheet. Effort: 1-3 days for a reusable template.

Path C — Self-host (open source)

  • Ollama or llama.cpp with a small model (7-14B class) on a laptop or small server (HW1), plus n8n, Paperless-ngx for document metadata and Python/pandas for profiling. Sufficient because the task is summarising and matching, not deep reasoning.
  • Right choice if schema or sample data is confidential (HR, health, trade secrets) or the server later serves other PREP cases. Ops effort: a few hours per month.

Path D — Custom training

Not needed. Fine-tuning a model for gap analysis would cost more than the analysis itself.

State of the art (2026)

  • LLMs read schemas and data dictionaries well and draft requirement matrices reliably; agentic profiling (an LLM writing and running SQL/pandas checks) is common.
  • Vendor tooling focuses on oversharing, labels and sensitive data rather than fitness for one use case [1][2].
  • Limits: the LLM cannot see undocumented knowledge ("column X is wrong before 2022"), may invent plausible field meanings, and a 100-row sample can hide rare defects.

Shared resources & combinations

Effort, cost & KPIs

  • A: licence cost (check Microsoft licensing). B: 1-3 days setup; API cost is negligible, interview time dominates. C: 1-2 days on existing hardware.
  • KPIs: share of items with known source and owner; red gaps closed before pilot; estimated vs. actual preparation effort; use cases stopped early (a good outcome).

People & change

Involve early: the department lead and the data owners of each source (ERP, DATEV, file share) are the real information source; IT supplies exports; management decides on the verdict. Involve the DPO once a source contains personal data (PREP-025, GUIDE-005). Sample data sent to an external LLM needs an AVV (Art. 28 GDPR); a DPIA (Art. 35 GDPR) is rarely needed for the mapping itself, but may be for the later use case.

Works council: depends. The mapping analyses data, not people. Caution if sources include activity logs or user-level performance data: §87(1) no. 6 BetrVG covers systems objectively suited to monitor behaviour (BAG), and §90(1) no. 3 requires timely information about AI-supported work processes. Public bodies involve the Personalrat (GUIDE-004).

AI literacy: Art. 4 AI Act requires providers and deployers to take measures that support staff's AI literacy; a one-hour session on what to put into an LLM prompt (metadata and masked samples, never raw customer lists) is enough here (GUIDE-006, GUIDE-007).

Communication and pilot: present it as "we check first whether it is worth it". Start with one use case sponsors like; the department lead owns the matrix (GUIDE-008). Typical concerns: "you are auditing my Excel files" (focus on data, not people), extra work for data owners (cap at 45 minutes).

Risks, regulation & compliance

  • EU AI Act: the mapping itself is minimal risk; the use case it prepares may be high-risk (Annex III, duties from 2 Dec 2027), for example HR selection. Flag this in the matrix, see GUIDE-014.
  • GDPR: metadata is mostly harmless, sample rows are not: mask or pseudonymise, conclude an AVV, prefer EU hosting (GUIDE-010).
  • Risks: all-green matrices because nobody checked a sample; stale exports lying around. Mitigate with a mandatory sample check, deleting exports afterwards, and versioning the matrix.

Getting started

  1. Pick one use case and write the one-page card with the process owner (1-2 hours).
  2. Build a matrix template in Excel or a SharePoint list: item, source, owner, format, quality, access, legal basis, gap, task, effort.
  3. Export field lists and 100 masked sample rows per source; profile them.
  4. Let an LLM draft the matrix, then review it with the data owners in one 90-minute workshop.
  5. Decide go / go after preparation / no-go and put the tasks into your planning tool.

Sources

  1. Petri, "Microsoft Purview DSPM Explained for Copilot Readiness" - https://petri.com/microsoft-purview-data-security-posture-management/ (accessed 2026-10)
  2. CIAOPS, "Microsoft Purview DSPM for AI in SMBs" - https://blog.ciaops.com/2025/10/01/microsoft-purview-dspm-for-ai-in-smbs/ (accessed 2026-10)
  3. Atlan, "Purview Data Governance: Coverage Gaps by Source [2026]" - https://atlan.com/know/ai-agent/microsoft/purview-data-governance-coverage/ (accessed 2026-10)