How to Classify Information Before Sharing with AI Tools
Every AI interaction is a data-sharing decision. This is the foundation of AI security. Before you can prevent data leakage, use the right tools, or follow policies effectively, you need the habit of pausing to assess what you are about to share. This playbook gives you specific techniques for building that assessment habit, from basic sensitivity checks through advanced aggregation awareness.
This playbook covers the how. For the why and what, see the
skill definition
.
Developing Start here. Build the foundation.
- Before every AI interaction, pause and mentally categorize the information you are about to share into one of three buckets: clearly safe (public information, generic questions), clearly unsafe (customer names, financial data, proprietary code), or uncertain. For clearly safe information, proceed. For clearly unsafe, stop and redact or rephrase. For uncertain, treat it as confidential until you can verify. Practice this three-bucket check for two weeks until it becomes automatic.
- Find your organization's data classification framework and create a one-page cheat sheet with the classification levels (typically public, internal, confidential, restricted) and two examples of each level relevant to your daily work. Tape it next to your monitor or pin it in your notes app. Before each AI interaction, glance at the cheat sheet and identify which level applies to the information you are about to share. After a month, you will no longer need the cheat sheet.
- Take one task you regularly use AI for and audit the last five prompts you sent. Highlight any information that could identify a specific customer, employee, project, or financial figure. For each highlighted item, write an anonymized version: replace names with Person A or Client X, replace exact numbers with representative ranges, remove dates. Use the anonymized versions going forward and verify that your AI output quality is not meaningfully affected.
Proficient Build consistency and rhythm.
- Before starting a multi-turn AI conversation, plan the total information you will share across all turns. Individually harmless details like a project name in turn one, a team size in turn three, and a budget range in turn five can combine to reveal confidential strategic information. Map out the conversation scope in advance and decide which details to withhold or anonymize to prevent aggregation risks.
- Build anonymization into your workflow rather than treating it as an extra step. Create a text snippet or template with common placeholder patterns: [CLIENT_NAME], [EMPLOYEE], [AMOUNT], [DATE], [PROJECT]. Before pasting any real data into an AI tool, run a quick find-and-replace using these placeholders. For structured data like spreadsheets, create a sanitization script or template that strips identifying columns before export.
- When you encounter information that does not fit neatly into your organization's classification levels, document the ambiguity and escalate to your manager or data governance team before sharing it with AI. Keep a running log of these edge cases and their resolutions. Over time, this log becomes a practical reference for future classification decisions and a resource for improving organizational guidelines.
Mastered Operate at the highest level.
- Default to treating uncertain information as confidential in every situation. The cost of over-classifying, which means occasionally anonymizing data that did not strictly need it, is a few minutes of extra preparation. The cost of under-classifying is a potential data breach. Make this default so habitual that you apply it without conscious deliberation, and only downgrade the classification when you have explicit confirmation that the information is safe to share.
- Mentor colleagues on classification practices by reviewing their AI prompts and identifying information they shared that should have been anonymized or withheld. Conduct this as a collaborative exercise rather than an audit. Ask them to walk you through their classification reasoning for recent prompts, and share specific techniques you use for common edge cases in your work domain.
- Contribute to improving your organization's classification guidelines by documenting recurring scenarios where existing frameworks provide insufficient guidance. Propose specific additions or clarifications based on real situations you and your team have encountered. This turns your daily classification practice into organizational learning that benefits everyone.
Unlock Skill Progression
Coaching Personalized to your current level
Progress Tracking Across every skill area
Mastery Validation Evidence-based, not guesswork