AI delivery · Toolkit 01
The Data Classification Framework
Decide what your AI is allowed to touch — before you decide what it should do. The rule set that sets the architecture, and the price, of every automation you build.
5 pages · PDF
A look inside
| Tier | Model and provider | Hosting |
|---|---|---|
| Green | Any mainstream provider, default settings. | Cloud SaaS is fine. |
| Amber | Contracted tenancy, retention and training off. | Cloud SaaS with a DPA in place. |
| Red | Zero-retention enterprise tier, or self-hosted. | Your infrastructure, or region-locked with residency confirmed. |
The handling matrix, abridged. The document adds a fourth column — what must be true at each tier — and the classification table you fill in.
The rule it turns on
Match the handling to the sensitivity. Never put regulated data into a tool that was not agreed for it.
What’s in it
- Three tiers, with the examples that actually cause arguments
- The handling matrix — model, hosting and what must be true, per tier
- Seven non-negotiables that are cheap to design in and expensive to retrofit
- The paperwork, and which of it is optional
- A blank classification table to fill in before you request a quote from anyone
- The plain-language answer to give a customer, a regulator or a board
Related reading, ungated: the AI governance non-negotiables.