Catalog / Data Readiness for AI / PREP-024

Data classification rules for AI use ('what may go into which AI tool')

Define four simple data classes and a one-page matrix that tells employees which class may be entered into which approved AI tool, with everyday examples.

Quick win: proven, manageable effort, first results within weeks, low regulatory risk.

Parts needed to run it yourselfAgents & automationLanguage model

Employees paste texts, tables and customer mails into AI tools every day, usually without knowing what is allowed. The fix is not a 40-page policy but four data classes, a one-page matrix of "class by tool" and a few concrete examples per department. With labels in the tools you already own, the rules can be partly enforced instead of only hoped for.

Problem & value

  • Today: SMBs have either no rule or a blanket ban that staff ignore; shadow AI (private ChatGPT accounts, plug-ins) fills the gap.
  • Value: fewer leaks of customer, employee and trade-secret data, faster approval of new use cases, a documented basis for DPO, auditors and customers. The rules are an organisational task; AI-based discovery is SEC-017.

Variants

  • SMB: four classes, one matrix, labels in Microsoft 365 or Google Workspace, 45-minute training.
  • Enterprise: align to the ISMS scheme (ISO 27001 Annex A.5.12/5.13), automatic labelling, DLP and an AI gateway.
  • Public sector: map to VS-NfD handling and state data protection rules; mostly sovereign or in-house tools.
  • Sector add-ons: health data and §203 StGB secrecy (lawyers, tax advisers) go into the top class.

How it works

  1. inventory of AI tools and data types
  2. define 4 classes + examples per department
  3. matrix: class x tool (allowed / conditions / forbidden)
  4. sensitivity labels in M365 / Google Workspace (+ DLP rules)
  5. one-page guide + short training
  6. approval path for new tools / new data types
  7. review every 6-12 months and after incidents
  • Classes (typical): Public (website content, press releases), Internal (internal procedures, non-critical project documents), Confidential (customer data, contracts, prices, personal data of employees), Strictly confidential (health data, applications, trade secrets, legal professional secrets, source code of core products, passwords).
  • Matrix logic: the class limits the tool, not the task. Example: Public may go into any tool; Internal only into approved business tools with AVV and no training on inputs; Confidential only into EU-hosted tools with AVV and access control; Strictly confidential only into self-hosted or explicitly approved tools, otherwise not at all.
  • Human in the loop: the data owner decides the class of a data set; IT decides which tool is approved; the DPO and, where it exists, the works council are consulted on the matrix. Employees decide the class of ad-hoc content using the examples.

Data preparation

What is needed: knowledge about your data: which types exist, where they live, who owns them (PREP-001, PREP-003, PREP-004). Typical gaps: no list of approved AI tools, unclear AVV/no-training terms of licences, sensitive folders with wide access (PREP-023), personal data in spreadsheets (PREP-022).

Steps and realistic effort: 1. Collect the tools in use: IT survey plus a look at proxy or Defender for Cloud Apps / Google admin logs for AI domains (0.5-1 day). 2. Workshop with 3-5 department leads: collect 10-15 real data types and assign a class (half a day). 3. Draft matrix and one-page guide (1-2 days), review with DPO and works council. 4. Create labels in Microsoft Purview (Business Premium includes manual sensitivity labels and limited DLP; auto-labelling and advanced DLP need E5 or the Purview add-on, verify) or Google Workspace classification labels, and apply them to the few critical libraries first (1-3 days). 5. Training session, 45 minutes, recorded for new staff.

Tools: Excel or a Nextcloud/SharePoint list for the register, Purview or Workspace labels, n8n or Power Automate for a "request a new AI tool" approval form. Total about 3-6 working days for an SMB. See GUIDE-003.

Implementation paths

Which path for whom

  • SMB - A: built into M365 Business Premium or Google Workspace; standard process.
  • Enterprise - B: automatic labelling, DLP and an AI gateway need integration.
  • Public - C: sovereignty and procurement rules favour self-operated tools.

Path A - Buy (off-the-shelf)

  • Microsoft 365: Purview sensitivity labels, DLP and (in higher licences) Copilot respecting labels and DLP policies. Check which licence includes what before promising enforcement. Microsoft offers the EU Data Boundary for covered services.
  • Google Workspace: classification labels and DLP in the relevant editions; Gemini inside Workspace follows existing access rights.
  • Standalone: Nextcloud (EU, self-hostable) with file tagging; keep DATEV data out of general chatbots.
  • Choose A when: you have M365 or Workspace, fewer than a few hundred staff and standard needs.

Path B - Build on cloud APIs

  • Route all AI traffic through one gateway (for example LiteLLM or an API management layer) that checks the class before a request leaves: label from the document, PII detection with Microsoft Presidio, then route to an EU-region model (Azure OpenAI EU regions, Mistral as EU provider, Amazon Bedrock Frankfurt) or block.
  • Choose B when: you build own AI applications or want one enforcement point for many tools.

Path C - Self-host (open source)

  • Stack: Ollama or vLLM with an open-weight model for the strictly confidential row, Open WebUI as the employee interface, Presidio for PII masking, n8n for approval flows, Nextcloud for files.
  • Hardware: HW1 is enough for the policy and labelling parts; a small local LLM for the strictly confidential row runs on HW1-HW2.
  • Choose C when: data are very sensitive or the same platform serves several use cases (Baukasten effect with PREP-022, PREP-023).

Path D - Custom training

Not relevant. Training a custom classifier on your own labelled documents is only worth it for very large document volumes (see SEC-017).

State of the art (2026)

  • Copilot and Gemini honour existing permissions and, in the right licences, labels and DLP, so clean labelling is a rollout prerequisite.
  • Browser and endpoint DLP can warn or block pasting into unapproved AI sites; licence cost varies strongly.
  • Limits: labels do not stop use of a private phone; auto-classifiers give false positives and misses; rules without training and examples fail.

Shared resources & combinations

Effort, cost & KPIs

  • Path A: 3-6 days of internal effort for an SMB, plus licence upgrade if labels or DLP are missing.
  • Path B: 2-6 weeks for gateway, PII check and logging.
  • Path C: 1-3 weeks for the local stack plus training; hardware cost for HW1/HW2.
  • KPIs: share of staff trained, share of critical libraries labelled, number of approved versus unapproved AI tools found, DLP warnings per month, time to approve a new tool, incidents.

People & change

Involve: management, department leads, IT and IT security, DPO, legal, works council where one exists (GUIDE-004, GUIDE-005, GUIDE-007).

Works council: depends. The rules themselves are a conduct regulation (§87(1) no. 1 BetrVG); DLP, proxy logs and label audits are technical systems that are objectively suited to monitor behaviour, so §87(1) no. 6 BetrVG applies in practice. §90(1) no. 3 requires information in good time when work processes are planned with AI, and §80(3) allows an AI expert. Agree on purpose limitation: logs serve security, not performance evaluation. Public bodies involve the Personalrat.

AI literacy: Art. 4 AI Act since 27 Jul 2026 requires providers and deployers to take measures that support the development of staff AI literacy (no guaranteed level). A 45-minute session on the matrix with real examples is a practical measure (GUIDE-006).

Communication and pilot: present it as "what you may do"; start with one department and AI champions; when unsure, choose the higher class (GUIDE-008, GUIDE-009).

Risks, regulation & compliance

  • EU AI Act: the classification work itself is minimal risk. Art. 4 duties apply to the organisation; Art. 50 transparency duties apply since 2 Aug 2026 for the AI uses you introduce. See GUIDE-014.
  • GDPR: personal data fall at least into Confidential; special categories (Art. 9) into Strictly confidential. AVV (Art. 28 GDPR) with every tool provider, check of third-country transfers, DPIA (Art. 35) where AI processes personal data systematically or at scale (GUIDE-005).
  • Secrecy duties: §203 StGB for lawyers, tax advisers and doctors; NDAs with customers may forbid cloud AI.
  • Typical risks: shadow AI, outdated matrix, unset labels, false sense of safety from DLP; mitigate with training and review rhythm. Security: GUIDE-013.

Getting started

  1. List the AI tools in use and ask for tools people wish to use (1 day).
  2. Run the class workshop with department leads and write the one-page matrix with real examples.
  3. Check licences and AVV status of the tools in the matrix (GUIDE-010).
  4. Create labels for the critical libraries and brief the works council and DPO.
  5. Train staff, publish the guide in the intranet and set a 6-month review date.

Sources

  1. Microsoft Learn - Learn about sensitivity labels - https://learn.microsoft.com/purview/sensitivity-labels
  2. Microsoft Learn - Data Loss Prevention in Microsoft Purview - https://learn.microsoft.com/purview/dlp-learn-about-dlp
  3. Nextcloud - Files access control and tagging documentation - https://docs.nextcloud.com/server/latest/admin_manual/file_workflows/index.html
  4. Regulation (EU) 2016/679 (GDPR) - https://eur-lex.europa.eu/eli/reg/2016/679/oj
  5. Regulation (EU) 2024/1689 (AI Act) - https://eur-lex.europa.eu/eli/reg/2024/1689/oj
  6. Bundesamt fuer Sicherheit in der Informationstechnik (BSI) - Artificial intelligence topic page - https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Informationen-und-Empfehlungen/Kuenstliche-Intelligenz/kuenstliche-intelligenz_node.html
  7. Microsoft Presidio - https://github.com/microsoft/presidio