Is your data ready for AI?
AI shows people whatever it can reach. If your files are unlabeled, widely shared, or out of date, connecting AI turns every old mistake into a visible one. Here is what to check first, and how to do it without exposing anything sensitive.
What goes wrong
The AI did its job. The data wasn't ready.
At a recent information-governance conference, a consultant described a health system that was merging several hospitals and clinics into a single Microsoft 365 environment. The request was to switch on AI across the whole thing. Nobody had asked what the AI would be able to see.
Nothing was hacked. An HR policy that was sensitive, misfiled, and already superseded ended up in an answer given to an employee who should never have seen it. As the speaker put it, AI does not change your security. It amplifies the mistakes that were already there, such as company-wide sharing links that spread when separate systems merge.
The lesson is simple: AI readiness is information readiness. Clean, labeled, correctly permissioned data makes AI both safer and more accurate.
The checklist
Five checks before you connect AI.
Answer these for every repository you plan to connect. If you cannot answer one, that is your first task.
Know what you have
Who owns each repository, and how much of its content is labeled by sensitivity? You cannot protect what nobody is responsible for.
Fix who can see it
Fix permissions first. Remove "anyone in the company" sharing and stale access before an AI can search it on someone's behalf.
Keep a person in the loop
Keep a person in the loop. Send low-confidence or sensitive answers to a human reviewer instead of straight to the user.
Record where answers come from
Record where each answer came from. Citations and audit trails let you show an auditor, or a court, why the AI said what it said.
Clear out what's expired
Dispose of expired content on schedule. Old drafts and superseded policies make AI quote the wrong version and answer with confidence.
Not sure where you stand?
We can review your repositories against these five checks and tell you what to fix first. Start a conversation.
Where the mess comes from
Four problems AI makes visible.
Email trapped in inboxes
Contracts and decisions live in individual mailboxes, so neither people nor AI can find or govern them. Moving the important ones into a shared, labeled library fixes both. See how we handled this in our mailbox automation case study.
Shared drives nobody owns
Old shared folders tend to be the most loosely permissioned and the least reviewed. They are also where AI finds things people forgot existed.
Expired and duplicate files
Several versions of the same document compete for the AI's attention. Without a retention schedule, the outdated one can win.
Paper that was never digitized
Records still in boxes are invisible to AI, and often to your own governance program. Scanning them with proper capture checks turns them into searchable, controlled content. Our document processing work covers extraction and validation.
How we help
Private AI, on your terms.
We build AI on AWS that runs inside your own account, so your documents stay in your environment and respect your permissions. Answers cite the source passages they came from, so reviewers can check them.
Our AWS AI assessment helps you decide which AI projects are worth building. Data readiness is the part that decides whether they are safe to launch. To see private, citation-grounded AI in a regulated setting, read how we built a legal opinion tool for a real-estate law firm.
This page is part of our information governance for AI guides. Questions about your own situation are the best place to start. Tell us what you are trying to connect, and we will tell you what to check first.
Common questions
Straight answers.
Why does AI show people files they should not see?
AI assistants search everything the signed-in user is technically allowed to open. If folders are shared too widely or files were never labeled as sensitive, the AI surfaces them in answers. The AI did not break a rule; the existing permissions were already too loose, and AI made that visible.
What is data classification, and why does it matter before AI?
Data classification means labeling files by sensitivity, such as public, internal, confidential, or regulated. Labels let you control which content an AI system can read and quote. Without them, an AI cannot tell an HR policy from a marketing flyer.
Does AI forget a document after we delete it?
Not automatically. Many AI systems keep a searchable copy of your content in an index. Deleting the original file does not always remove that copy, so deletion has to be applied to the index as well. Test it by asking the AI about a deleted document and confirming it can no longer answer.
Why do old drafts and outdated files hurt AI accuracy?
AI retrieves whatever looks most relevant, including superseded drafts and expired policies. When several versions exist, it may quote the wrong one. Retiring expired content under a retention schedule keeps answers current.
What should we fix before connecting AI to company data?
Identify who owns each repository, remove overly broad sharing such as everyone links, label sensitive content, retire expired files, and decide where the AI is hosted and who can query it. Then connect one low-risk repository first and test before expanding.
Can we run AI privately on our own AWS account?
Yes. Models can run inside your own AWS account, for example through Amazon Bedrock, so your documents stay within your environment and permissions. Horus builds private, citation-grounded AI on AWS for regulated organizations.
Keep exploring
What comes next.
AWS AI Assessment
Decide which AI projects are worth building, with a roadmap, architecture, ROI model, and security review.
Generative AI Consulting
Once your data is ready, this is how we build private AI on Amazon Bedrock.
Intelligent Document Processing
Extract, classify, route, and validate documents, including paper and email.