# Can Your AI Use Sensitive Data Safely? 5 Capabilities You Need

## Executive summary

The use of sensitive data in AI systems necessitates controls that operate at machine speed. The video outlines five foundational controls—Visibility, Classification, Governance, Access Control, and Evidence—required to safely leverage data assets while maintaining compliance and digital sovereignty. Organizations must move beyond reactive compliance and implement proactive, automated controls across data movement, storage, and processing.

## Key takeaways

- The Need for Machine-Speed Controls: Since AI processes data at machine speed, security controls must match this pace. The most useful data (e.g., PII, PHI, financial data) is often the most sensitive, creating a security conundrum.
- Visibility and Classification: Protection requires knowing where the data is (on-premises, cloud, in-flight) and who is using it. Automated classification and sensitivity tagging are essential, as manual methods are slow and error-prone.
- Understanding Data Jurisdiction: Distinguish between Data Residency (where data is physically stored), Data Sovereignty (which laws apply to the data), and Data Localization (the legal requirement that data must be processed and stored within a specific jurisdiction).
- Access Control via IAM: Access control is managed through Identity and Access Management (IAM), which involves four key components: Administration (provisioning/deprovisioning accounts), Authentication (verifying identity, e.g., MFA), Authorization (determining if the user is allowed to perform an action, e.g., Role-Based Access Control), and Audit.
- Continuous Evidence and Audit Trails: Regulators require continuous, immutable evidence of data movement, access, and usage by AI workloads. Automated logging must capture these movements to prove compliance.

## Technical details

- Data Residency vs. Sovereignty: Residency refers to the physical location of data storage. Sovereignty refers to the governmental laws that govern the data, regardless of where it is stored. Localization is the legal mandate to store and process data within a specific national boundary.
- IAM Components: The four pillars of Identity and Access Management (IAM) are: Administration (managing accounts and privileges), Authentication (verifying identity, e.g., pass keys), Authorization (defining permissions, e.g., conditional access control), and Audit (reviewing actions).
- Data Security Lifecycle: Trustworthy AI requires trustworthy data, which mandates controls that allow organizations to see, identify, classify, constrain, and prove the handling of sensitive data.

## Practical implications

- Implement automated data classification tools to tag sensitivity levels proactively, rather than relying on manual processes.
- Ensure legal teams are involved in the data strategy to correctly interpret data residency, sovereignty, and localization requirements.
- Establish continuous, immutable audit trails that track data movement and access across all AI workloads to satisfy regulatory requirements.
- Adopt a principle of least privilege across all systems, enforcing strict controls over who can access sensitive data and under what conditions.

## Topics

AI Security, Data Governance, Digital Sovereignty, Identity and Access Management (IAM), Data Classification, Digital Sovereignty Information, IBM Technology YouTube Channel

Source: https://www.youtube.com/watch?v=jnP9AgtX0qo