CF05-003: AI Data Classification

AI Control Library / CF-05: Data Governance & Privacy

Designation: Core | Control types represented: Operational and Technical

Control requirement

Classify AI-related data according to sensitivity and handling needs, including generated, inferred and combined information. Translate classification into appropriate access, transfer, retention and protection decisions.

Why this matters

A low-sensitivity input can produce sensitive inferences or become identifying when combined with other records. Classification must follow information through AI processing rather than attach permanently only to its original file.

How the control types work together

Operational controls define scope, authority and the actions required when conditions are not met. Technical controls produce evidence or enforce the relevant boundaries. Both must apply to the same deployment and operating conditions.

When it applies

AI inputs, outputs, datasets, retrieval stores, embeddings, logs, artifacts and derived records according to their content and exposure.

Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.

Ownership

The data owner approves classification; stewards apply the scheme and engineering enforces related handling rules.

Implementation guidance

Define classification criteria and examples for confidential, personal, regulated and security-sensitive information.
Classify material sources and assess whether inference, aggregation or outputs change the required handling.
Propagate handling labels or equivalent metadata through supported paths, identifying transformations that lose classification context.
Review classifications after data and use changes, and test that resulting access and destination rules apply to the actual data.

How to verify it

Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.

Test	Expected result
Inspect a sensitive source and its output	Handling decisions consider both the original information and generated inferences.
Move labelled data through an integration	Required restrictions persist or an equivalent control addresses lost metadata.
Challenge a low-sensitivity classification	The owner can substantiate it using the actual contents and combination risk.

Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.

Evidence to retain

Classification scheme and decisions
Derived-data assessments
Label and enforcement configuration
Handling and propagation tests

Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.

If the control fails

Escalate material misclassification to the data owner and restrict inappropriate access or transfers. Reassess affected copies and outputs rather than correcting only the source label.

Example in practice

Hypothetical example: An assistant infers a customer’s financial vulnerability from ordinary service records. The generated assessment receives restricted handling even though each source record originally had a lower classification.

Related controls

Framework mappings

CSA AICM (DSP-04)
NIST AI RMF (MAP 1.1)
EU AI Act (Art. 10(2))
ISO 42001 (Cl. 8.2, A7.1)

Review and maintenance

Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.

Back to Data Governance & Privacy

Version 1.0