Which data can go into an AI? A decision tree modelled on the risk graph

The situation — the decision is made at every copy and paste

In April 2023, Samsung engineers sent internal source code to ChatGPT. According to an internal memo reported by Bloomberg, the company then restricted the use of generative AI.

The same decision is made every day in engineering offices. Take a fictional machine builder with 180 employees. A sales engineer wants a price offer proofread. A controls engineer wants a PLC program corrected. A production manager wants a recipe summarised. Each decides alone, in a few seconds.

Business need: use AI on real documents, without waiting for a legal opinion on every transfer.
Security need: data goes only into a circuit whose level covers the damage of a leak.

The method — required level, achieved level

The risk graph of IEC 61511 answers a similar question: what risk reduction does this scenario require? Its logic carries over.

IEC 61511 risk graph	Data tree
C, consequence	C, consequence if the data becomes public
F, exposure time	F, how long the data stays sensitive
P, possibility of avoidance	P, recovery possible after the leak
W, probability	Replaced by the circuit, which carries the probability of a leak
Required SIL	Required level, from D0 to D3
Achieved SIL	Level achieved by the circuit

Two caveats. No standard sets this tree: it is an IndustryHub calibration, to be validated in each company. And “no risk” does not exist: an accepted result means a residual risk acceptable for this circuit.

Common mistakes

Mistake	Why it appeals	What it produces
Banning all AI	A memo is enough	Personal accounts, with no contract and no log
Allowing everything with an enterprise plan	One contract	A manufacturing secret held by a third party
Removing the customer’s name and sending	Fast	A drawing stays identifiable and confidential without its title block

Step 0 — cases outside the tree

Some cases are not settled by the graph: the law or the contract decides first.

Case	Result	Basis
Already lawfully published	D0, any circuit	Check copyright and licence
Password, key, certificate	No AI; renew if already entered	No reason to send one, even locally
Under a non-disclosure agreement	Customer’s written agreement first	The contract
Dual-use item	Export control, then local model	Regulation (EU) 2021/821: the exporter can be whoever transmits electronically
Sensitive personal data (health, trade union…)	D3 and impact assessment	GDPR Art. 9: prohibited unless an exemption applies; Art. 35
Other personal data	D2 at least, processing agreement	GDPR Art. 28

In Switzerland, the FADP also requires a processing contract (Art. 9) and an impact assessment when the risk is high (Art. 22).

The tree

Data
 ├─ C1 ─────────────────────── D1
 ├─ C2 ─┬─ F1 ─┬─ P1 ───────── D1
 │      │      └─ P2 ───────── D2
 │      └─ F2 ──────────────── D2
 ├─ C3 ─┬─ F1 ─┬─ P1 ───────── D2
 │      │      └─ P2 ───────── D3
 │      └─ F2 ──────────────── D3
 └─ C4 ─────────────────────── D3

C1: nuisance, no measurable loss.
C2: limited, repairable loss.
C3: market or competitive edge lost, penalty.
C4: safety of people or installations, survival of the company.
F1, F2: sensitive for under one year, over one year.
P1, P2: recovery possible (change a price, a network address), impossible (a known recipe stays known).

Each company puts figures on C1 to C4 according to its size. The online tool asks these questions one by one and gives the result for each circuit.

Classified data

These classifications apply to our machine builder. Another company may shift them.

Data	Path	Level
Catalogue, published manual	Step 0: public	D0
Routine meeting minutes	C1 F1 P1	D1
Internal procedure	C1 F2 P1	D1
Current price offer	C3 F1 P1	D2
CAD drawing of a standard part	C2 F2 P2	D2
Electrical schematic of a routine installation	C2 F2 P2	D2
PLC program	C2 F2 P2	D2
Internal directory	Step 0: personal, floor	D2
Manufacturing recipe	C3 F2 P2	D3
OT network diagram with addresses	C4	D3
HR file with sick leave	Step 0: sensitive	D3 and impact assessment
API access key	Step 0: secret	No AI

Example — an electrical schematic in Claude Code

A schematic of a routine installation comes out at D2. The answer then depends on the account, not the product.

Free, Pro or Max account: no. These accounts fall under consumer terms. Training on the data is the user’s choice, with 30-day retention if refused and 5 years if accepted.
Team, Enterprise or API account: not yet enough for D2. Anthropic does not train its models on this data and keeps it for 30 days by default. The place of processing still has to be checked: by default, the API may route traffic outside Europe.
Through Amazon Bedrock or Google Cloud in an EU region, with logging: yes. This is the D2 circuit.

A schematic showing safety functions or a sensitive site moves up to D3: local model or qualified cloud. One belonging to a customer under NDA first needs written agreement. Claude Code sends the model what it reads: classify the open folder, not just the target file.

The circuits

These are the circuits of the article Digitalising the company in the age of AI. A circuit covers its own level and the levels below.

Achieved level	Circuit	To check
D0	Consumer service	Nothing to protect: public data only
D1	Enterprise plan under contract, no training	Training clause, retention period
D2	Enterprise plan hosted in Europe, with logging	Hosting location, sub-processors, access to logs
D3	Local model or qualified European cloud	Internal access rights, backups, logs

Classification also protects your legal position. Directive (EU) 2016/943 recognises a trade secret only if its holder has taken reasonable steps to keep it secret (Art. 2). An applied grid is evidence; having none is a weakness.

Pitfalls

The extract. Classify the whole set sent, not each piece. Several D1 items combined can fall under D2.
The answer. What the AI produces inherits the level of what it received.
The connected assistant. Connected to a file share, it reaches the level of the most sensitive document it can read. Review access rights before connecting it.
False anonymisation. The GDPR excludes only data that no longer allows the person to be identified (recital 26). Removing a name is not always enough.
The local model. Nothing goes out to a supplier, but logs, backups and internal rights still need control.
The frozen classification. An offer submitted, a product launched: a level changes. Review it at each project milestone.

What the tree does not do

It does not replace the legal department, the data protection officer or the export control officer.
It does not say whether the AI’s answer is correct.
It does not classify the AI system itself under the AI Act: that is a different question, with different criteria.
It deals only with confidentiality. The integrity and availability of data need their own analysis.

Checklist

C1 to C4 have figures for the company and are approved by management
Each Step 0 case has a named owner
Each allowed circuit is identified, with its contract and achieved level
Personal accounts are replaced by an allowed circuit
Access rights are reviewed before an assistant is connected to files
Classification is reviewed at each project milestone
A secret entered by mistake triggers immediate renewal