Every AI Project Is a Data Project
Before a team connects documents, inboxes, customer records, or call recordings to an AI tool, it needs to know what information is involved, who can access it, what the provider does with it, and what happens if something goes wrong.
This checklist covers the essentials. It is not legal advice; requirements differ by state and industry. For phone-specific controls, see the voice AI security checklist.
1. Inventory the Data
For each workflow, list:
- Data sources, such as CRM, email, documents, and calls
- Types of data, such as contact details, health, financial, or employee information
- Where the data goes: AI providers, platforms, and other systems
- Who owns each source
2. Classify Sensitivity
| Class | Examples | Rule |
|---|---|---|
| Public | Website content, published prices | Fine to use |
| Internal | Procedures, internal docs | Approved business tools only |
| Confidential | Customer records, contracts | Approved tools with access controls and data terms |
| Regulated | Health information, payment cards, Social Security numbers | Only with specific agreements and safeguards, or not at all |
Decide in advance what must never be entered into an AI tool.
3. Vet Every Vendor
Ask each AI provider, platform, and agency:
- Is our data used to train models? Can we opt out?
- Where is data processed and stored?
- How long is it retained, and can we delete it?
- What security certifications or reports do you have, such as SOC 2?
- Will you sign a data processing agreement, or a BAA for health data?
- Which subprocessors do you use?
4. Use Business Accounts, Not Personal Ones
Consumer AI apps used with personal logins bypass your controls. Provide approved business accounts, turn off training on your data where possible, and make it easy for staff to use the approved tools.
5. Control Access
- Role-based access: people and AI agents see only what they need
- No shared logins
- Separate credentials for each integration, with minimal permissions
- Remove access promptly when staff or vendors leave
6. Protect Credentials and Integrations
- Store API keys in a secrets manager, never in documents or prompts
- Rotate keys regularly
- Verify webhook signatures
- Keep development and production environments separate
7. Set Retention and Deletion Rules
Decide how long prompts, outputs, transcripts, and logs are kept, and delete them on schedule. Keeping data forever increases the damage from any breach.
8. Respect Privacy Rights
US privacy law is a patchwork. California's CCPA gives residents rights to know, delete, and opt out of the sale or sharing of their personal information, and a growing number of states have their own comprehensive privacy laws. Make sure you can find and delete a person's data across your AI workflows when asked.
9. Be Honest About AI Use
Do not overstate what your AI does or hide its use where customers would expect to know. The FTC has repeatedly warned businesses about deceptive claims and inadequate data security.
10. Test Before Launch
- Try to access data you should not be able to reach
- Test what happens with sensitive information entered by mistake
- Check that logs capture automated actions
- Confirm that offboarding removes access
11. Monitor and Review
- Review access logs and unusual activity
- Sample AI outputs for leaked or incorrect data
- Review vendor terms when they change
12. Plan for Incidents
- How to switch off an AI workflow quickly
- Who investigates and decides
- How to notify affected people and regulators if required; state breach notification laws and HIPAA have specific rules
- How to fix the cause before restarting
A Lightweight AI Intake Form
Before any new AI use case, answer five questions: What data does it use? Which vendors touch it? Who can access it? How long is it kept? Who owns it? This makes safe adoption faster than reviewing every project from scratch.
Bottom Line
AI data security comes down to knowing your data, choosing vendors carefully, limiting access, setting retention rules, and planning for incidents. The NIST AI Risk Management Framework is a helpful reference for a more formal program. If you want help applying this to a project, see our voice AI implementation standards.
Official documentation
Platform capabilities and implementation details can change. These official references help readers verify the guidance in this article.
- AI Risk Management Framework from National Institute of Standards and Technology
- California Consumer Privacy Act (CCPA) from State of California Department of Justice
- Privacy and Security business guidance from Federal Trade Commission