Data Classification for AI: Why Over-Protection Paralyzes Adoption in SMEs
80% of French SMEs have no documented AI governance. Many compensate with the opposite excess: labeling everything confidential, until the AI becomes unusable.
80% of French SMEs have no documented AI governance (nachnouchi.com). Faced with that gap, the most common reflex is not the carelessness people fear, it is the opposite excess: labeling nearly every document as confidential out of caution, until the AI becomes unusable across most of the company's actual content.
In my work with SMEs and mid-caps, I see this pattern come up again and again. A services company, wary after hearing warnings about AI risks, had labeled nearly all of its client files and contracts as highly confidential before even deploying its assistant. The result: the tool, technically accessible to every team, could not draw on a single genuinely useful document. Three months after rollout, real adoption was zero, while leadership believed it had secured the project.
This over-classification starts from a good intention and produces the opposite effect. A document labeled highly confidential becomes invisible to the AI even if the user has normal access to it, which protects genuinely sensitive data but neutralizes the tool when the label is applied by default. If most of the document base is classified this way, the assistant becomes an empty shell: licenses paid, adoption at zero, ROI impossible to read in front of a steering committee. The legal risk has not disappeared though, it has simply moved. Without a usable validated tool, teams turn to uncontrolled personal accounts, part of the shadow AI that accounts for 40 to 60% of real AI usage in SMEs and mid-caps, according to the field observation from nachnouchi.com.
This is exactly the sixth of the eight AI governance principles defended on nachnouchi.com: do not over-protect, aim for the right classification rather than the maximum one. Concretely, that means a four-level scale, public, routine internal, business confidential, highly sensitive, and a simple rule: data moves up a level only when a specific, documented risk justifies it, never by default. This classification work is part of the scoping done in week 1, before the choice of tools is even made.
Over-protection is not governance, it is a retreat disguised as caution. An SME that labels everything confidential has not secured its AI, it has neutralized it without reducing its real exposure. If you'd like to discuss it, get in touch.
Frequently asked questions
What is data over-classification in an AI project?
It is the reflex of labeling most documents as confidential or highly confidential out of excessive caution, to the point where an AI assistant can no longer draw on most of the company's actual content, even when users technically have access to it.
Why does a document labeled confidential become invisible to AI?
Enterprise AI tools respect the confidentiality labels applied to documents. A highly confidential document can remain entirely invisible to the AI assistant even if the user querying it has normal access, which is the intended behavior for genuinely sensitive data but becomes counterproductive when the label is applied by default.
How many French SMEs have documented AI governance?
80% of SMEs have no documented AI governance (nachnouchi.com), a gap that many fill with defensive over-classification instead of a structured framework.
What classification scale is recommended for AI data?
A four-level scale: public, routine internal, business confidential, highly sensitive, each level tied to an infrastructure and access rights suited to it, rather than a uniform classification driven by excessive caution.
Does over-classification remove the legal risk?
No. The risk shifts toward undisclosed usage: when the validated tool becomes unusable, teams turn to uncontrolled personal accounts, part of the shadow AI that accounts for 40 to 60% of real AI usage in SMEs and mid-caps (field observation from nachnouchi.com).
At what stage of an AI project should data be classified?
Before deployment, during the usage inventory in week 1, alongside the audit of access rights and permissions, never as an afterthought once the tool is already in production.
Who should be involved in AI data classification?
IT alone is not enough: business leads know the real sensitivity of their documents, leadership arbitrates the accepted risk levels, and this classification should be a joint effort rather than a purely technical decision.
What does an SME risk if its AI assistant stays unusable for lack of access to the right documents?
Licenses paid for with no real usage, adoption stuck at zero despite a technically successful rollout, and an ROI impossible to defend in front of a steering committee, while the actual risk of a data leak has not decreased at all.