Compliance & ContractsFree worksheetPDF, Excel, Word export

AI Data Classification Handling Matrix Worksheet

Most AI data incidents start with a simple question: can I paste this into the chatbot? This worksheet turns your data classification scheme into a clear answer for hosted APIs, on-prem models or neither.

Download:

Data class	ERP examples	Hosted LLM API	On-prem model	Masking or control	Exception approver	Approx. users affected

Total users in scope

265

Data classes

Replace the sample rows with your own classification scheme and regulatory duties. Defense, export control and personal data rules depend on your jurisdiction and contracts, so have your compliance owner confirm the decisions before publishing the matrix to users.

AI data policy review

An optional review of your AI data handling rules against your ERP and regulatory scope.

Optional. The tool and every export work without this. No spam.

How to use it

Start from your existing classification levels or the sample rows. For each class, list real ERP examples so users can recognize them, then set what is allowed for a hosted LLM and for a model you run yourself. Add the masking control and the person who can approve exceptions. Export it to PDF and attach it to your AI acceptable use policy so employees have a one-page reference.

Reading the matrix

The usual pattern is that public data may go anywhere, internal data goes to hosted services only after masking, and commercially sensitive or regulated data stays on infrastructure you control. Export-controlled and CUI data usually need an even stricter environment, with access limited to authorized people and no external network path. The exception column keeps decisions accountable rather than ad hoc.

Name the owner of each class
Give users concrete examples, not definitions
Define masking so it is repeatable
Review after any new tool or contract

Common mistakes

Policies often say do not paste sensitive data without defining sensitive. Another gap is ignoring data that leaves indirectly through plugins, browser extensions and meeting transcription tools. Teams also forget that on-prem does not equal permitted: the model still needs access control and logging. Finally, a matrix nobody reviews goes stale when ERP modules or contracts change.

Frequently Asked Questions

Can customer pricing go to a hosted LLM if the vendor promises no training?

That depends on your contracts and risk appetite. A no-training promise addresses one risk but not retention, access by vendor staff or legal obligations to customers. Many companies still keep it on controlled infrastructure.

What does masking mean in practice?

Replacing identifying values, such as names, ids and prices, with tokens before text leaves your environment, then mapping them back in the answer. It must be automated, tested and logged to be reliable.

Is on-prem always allowed for personal data?

Not automatically. You still need a lawful purpose, minimization, access control and retention rules. On-prem reduces transfer risk but does not remove data protection duties.

Who should own this matrix?

Usually the security or data protection function, with input from IT, legal and the business. A named owner and a review date keep it current.

Netray runs private models on your own infrastructure so regulated data never needs to reach a hosted API. We can help map your classes to an architecture.

Talk to an Expert Explore More Free Tools

Related Tools

AI Agents & Automation

More Compliance & Contracts tools

See all

Back to All Tools