How to Classify Your Business Data Before Rolling Out AI
Before your team starts using Claude for anything that touches real business data, you need a working answer to one question: what kind of data is this, and is it appropriate to put into an AI tool?
Without a shared framework for answering that question, every employee makes their own call. Some will be too cautious and avoid using Claude for anything useful. Others will be too loose and put data into the tool that shouldn’t be there. Data classification gives your team a shared standard so neither of those things happens.
What Data Classification Actually Is
Data classification is the process of sorting your organization’s data into categories based on sensitivity and risk. It doesn’t have to be complicated. A three-tier model works fine for most growing businesses: data that’s clearly fine to use in AI workflows, data that’s clearly off-limits, and data that requires a judgment call before it goes anywhere.
The goal isn’t a comprehensive data inventory. It’s a working framework your team can apply in the moment when they’re deciding whether to paste something into Claude.
Start With the Categories That Matter for Your Business
Every business holds different kinds of data, and not all of it carries the same risk. Work through the categories that are actually present in your day-to-day operations.
Client data is usually the first thing to sort out. Contact names and email addresses on their own are generally low-risk. Client financial records, strategic plans, or anything covered by a confidentiality agreement in your contracts is a different situation. Check your client agreements before you decide how to classify client data — what your contracts say matters more than what you assume.
Regulated data requires its own category regardless of context. Protected health information under HIPAA, financial data subject to SEC or FINRA rules, and personally identifiable information under applicable privacy laws all carry compliance obligations that don’t bend based on how convenient the AI tool is. If your business touches regulated data in any form, that category needs an explicit rule: off-limits unless specific conditions are met.
Internal operational data — process documentation, meeting notes, internal communications, project plans — is usually the lowest-risk category. It doesn’t touch client information, it isn’t regulated, and it’s where AI tools deliver the most straightforward value. This is typically your green category.
What Data Should Your Employees Never Put Into AI Tools
Proprietary business data sits between internal operational data and regulated data. Financial projections, deal terms, product roadmaps, competitive strategy — this information isn’t regulated, but it’s competitively sensitive. How you classify it depends on how your AI tool handles data and what your risk tolerance is.
Build the Three-Tier Framework
Once you’ve worked through your categories, map them to three tiers.
Green means proceed. Data in this category can go into Claude without a second thought. Internal documentation, publicly available research, draft communications that don’t reference client-specific information. The green category should be wide enough that your team can actually get value from Claude without constant second-guessing.
Red means never. Data in this category stays out of AI tools entirely. Regulated data, data covered by client confidentiality agreements, anything where the risk of exposure outweighs the value of AI assistance. The red category should be clearly defined and explained — not just listed, but explained so your team understands why.
Yellow means ask first. Data that doesn’t fit cleanly into green or red goes here. A client name attached to an internal summary. A financial figure that references a specific deal. Anything where the right answer depends on context. Yellow routes the decision to someone who can make the call, rather than leaving it to individual judgment.
How to Write an AI Usage Policy Your Team Will Actually Follow
Make It Specific to Your Business
A generic framework your team has to translate into their actual work is only marginally better than no framework at all. After you’ve built the three tiers, add examples from your specific business.
If you’re a professional services firm: client strategy documents are red, internal project plans are green, client contact information attached to a proposal is yellow. If you’re in healthcare: PHI is red, internal scheduling notes are green, a patient name in an administrative context is yellow. The examples don’t need to cover every possible situation — they need to cover the ones your team actually encounters.
Connect Classification to Your Platform Setup
Data classification decisions feed directly into how you configure Claude Enterprise. The categories you define as red can inform which connectors you restrict and what data sources you keep out of Claude’s reach. The categories you define as green tell you where to start when you’re identifying workflows to build first.
How to Set Up Claude Enterprise for Your Team
Salesforce, for example, lets you classify data at the field level. If certain fields in your CRM contain data you’ve classified as red, you can restrict Claude’s access to those fields specifically rather than limiting access to the entire system. That’s a much more useful outcome than a blanket rule.
Review It as Your Data Landscape Changes
A classification framework that was accurate when you wrote it may not reflect your business a year later. New client relationships bring new data types. Regulatory changes shift what’s required. New AI capabilities change what’s possible.
Put a review on the calendar alongside your usage policy review. The two are connected — changes to your data classification should be reflected in your usage policy, and questions that surface during usage policy reviews often reveal gaps in your classification framework.
Listen to the full podcast episode here.