AI data mapping: prepare your information before implementation

AI data mapping means identifying the information an AI workflow will use, where it comes from, who owns it and what rules apply. It should happen before choosing integrations or uploading documents.

A clear map prevents two common mistakes: building around information the business cannot reliably access, and exposing more data than the task needs.

Start with the workflow

Describe the business task from beginning to end. Record each input, decision, output and handover. Separate information required for the task from material that is merely convenient to include.

Create a source register

For each source, record its name, format, location, owner, update routine and users. Include email inboxes, shared drives, customer systems, spreadsheets, forms, databases and external services.

Note duplicate or conflicting sources. If staff cannot agree which document is current, an AI workflow will not resolve that ownership problem by itself.

Classify sensitivity

• Public information
• Internal operational information
• Commercially sensitive information
• Customer or supplier confidential information
• Personal data
• Special category or highly restricted information

Use the organisation's existing classification scheme where one exists. Check the ICO AI and data protection risk toolkit and obtain appropriate advice when personal data is involved.

Check ownership and permission

Confirm who may approve the data for the proposed use. Consider contracts, licences, copyright, customer expectations and internal policies. Access to a document does not automatically mean permission to use it in every new system.

Assess quality

Look for missing fields, inconsistent names, old versions, scanning errors, unexplained abbreviations and material that was never meant to be a reliable source. Record what will be cleaned, excluded or flagged for review.

Map movement and storage

Show where information enters the workflow, where it is processed, what is stored and where the output goes. Include logs, temporary files, supplier systems and backups. Identify transfers between organisations or locations where relevant.

Apply minimisation

Remove fields and documents that do not contribute to the approved task. Consider whether identifiers can be removed or replaced. A smaller, better-defined dataset is easier to secure, test and maintain.

Plan updates and deletion

State how the workflow receives current information, what happens to superseded material and how deletion requests or retention schedules are applied. Name the owner who will keep the map accurate.

Common findings from a data map

Businesses often find several versions of the same document, important knowledge held only in email, fields with no clear owner and old accounts with wider access than expected. These findings may justify housekeeping before implementation. Cleaning the information flow can improve the current process even if the AI project does not proceed.

Use the map during design

The completed map should shape supplier questions, access controls, testing and monitoring. The AICC Responsible AI tools include a data fact sheet resource that can support documentation.

Map the data before the build

Blue Canvas includes workflow and information mapping in an AI audit so implementation begins with evidence rather than assumptions.

Once the information is mapped, use our data-hardening checks to review unnecessary copies, broad sharing and recovery arrangements as part of a wider security review.

Book a free conversation