diff --git a/docs/ai-constitution.md b/docs/ai-constitution.md index ec0a749..5aa9ecb 100644 --- a/docs/ai-constitution.md +++ b/docs/ai-constitution.md @@ -51,12 +51,12 @@ Everything that enters an AI prompt is subject to the same classification obliga ### Data Classification for AI Systems -| Tier | Label | Description | AI Rule | -|---|---|---|---| -| 1 | **Public** | Publicly available data | No restrictions | -| 2 | **Internal** | Operational data, non-personal system data, anonymised logs | Enterprise AI tools only; not consumer/free-tier products | -| 3 | **Confidential** | Proprietary source code, system architecture, IP, identifiable personal data | Enterprise AI with explicit data-not-used-for-training contractual commitment; GDPR legal basis required for personal data | -| 4 | **Restricted** | GDPR Article 9 special categories (health, biometrics, ethnicity, religion, sexual orientation, political views), credentials, regulated financial data, data under professional secrecy | Never enters any AI context. Hard architectural prohibition. | +| Tier | Label | Description | AI Rule | +| ------| ------------------| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| ----------------------------------------------------------------------------------------------------------------------------| +| 1 | **Public** | Publicly available data | No restrictions | +| 2 | **Internal** | Operational data, non-personal system data, anonymised logs | Enterprise AI tools only; not consumer/free-tier products | +| 3 | **Confidential** | Proprietary source code, system architecture, IP, identifiable personal data | Enterprise AI with explicit data-not-used-for-training contractual commitment; GDPR legal basis required for personal data | +| 4 | **Restricted** | GDPR Article 9 special categories (health, biometrics, ethnicity, religion, sexual orientation, political views), credentials, regulated financial data, data under professional secrecy | Never enters any AI context. Hard architectural prohibition. | **Consumer and free-tier AI products are incompatible with processing organisational or personal data.** Enterprise contracts with explicit data-not-used-for-training commitments are the minimum bar. Verify per provider; do not assume.