AAISM lesson 11: Data controls for AI
AI data controls are the familiar data protection controls applied to three places where AI uses data: training and fine-tuning sets, retrieval stores that are read at question time, and the prompts and outputs of everyday use. Subtopic 3C covers them, and two supporting tasks apply: identify and treat security risk associated with data used in the AI life cycle, and maintain processes to identify, inventory and classify AI data. The difference from conventional systems is that data shapes behaviour: what goes in can later come out, and cannot always be taken back.
Three data zones
| Zone | Role | Main risk |
|---|---|---|
| Training and fine-tuning data | Shapes the model’s weights | Memorisation, poisoning, bias baked in |
| Retrieval data (RAG, vector stores) | Added to the prompt at question time | Oversharing, stale or poisoned documents |
| Prompts, outputs and logs | Everyday use records | Sensitive input kept in logs or sent to vendors |
Retrieval data can be changed or removed at once, whereas training data is absorbed into the model. That difference drives most of the choices below. See fine-tuning vs RAG vs prompting and RAG explained.
The controls
Classification. Data is classified before it is used, following the scheme in data classification. The classification then sets which model, environment and vendor may touch it. A model trained on confidential data inherits that sensitivity: its weights and outputs must be protected at the same level.
Minimisation. The cheapest control is not using the data. Remove direct identifiers, drop fields that the task does not need, and use synthetic or anonymised data where it is good enough. Because a trained model may reproduce what it saw, minimisation before training is stronger than filtering after.
Access control. Restrict who can read and change datasets, and who can start jobs that use them. For retrieval, enforce the requesting user’s permissions at query time; otherwise the assistant exposes whatever the index holds.
Encryption. Protect data at rest and in transit, including vector stores, backups and model artefacts. Encryption protects storage; it does not stop a permitted but wrong use.
Provenance and integrity. Keep a record of source, collection basis, licence and transformations, and detect unauthorised modification, for example with hashes and change logs. This is the control against poisoning and the evidence for any later question about lawful use.
Retention and disposal. Set how long training snapshots, prompts and logs are kept, and delete them when the purpose ends. Be aware of the limit: deleting a record from a dataset does not remove its influence from a model already trained on it. Responses include retraining or rolling back to an earlier model, or, where feasible, using techniques that reduce a record’s influence. The planning lesson is to decide before training whether the data may be used, since after training the options are expensive.
Worked example
A 400-person insurer wants an internal assistant answering questions about claims procedures, plus a model fine-tuned on adjusters’ notes. The procedure documents go into a retrieval index. They are classified internal, and the index respects folder permissions, so a junior analyst cannot retrieve the fraud-investigation playbook. A stale procedure is removed from the index and disappears from answers the same day.
The adjusters’ notes contain names, medical details and bank numbers. The data owner decides what to do before any training: identifiers and medical fields are stripped, a sample is reviewed by hand, and the cleaned set is hashed and stored in the isolated training environment. The raw notes stay under their original retention schedule. When a customer later withdraws consent for their data, the team can show that the training set contained no direct identifiers and records this in the log, rather than facing an expensive retrain. Prompts typed into the assistant are logged for abuse monitoring but retained for a short, defined period, with access limited to the security team.
Easy to confuse
- Anonymisation vs pseudonymisation. Anonymised data cannot reasonably be linked back to a person; pseudonymised data can, with additional information, and remains personal data in most regimes.
- Data deletion vs model unlearning. Removing the record is simple; removing what the model learned from it is not.
- Encryption vs access control. Encryption protects against theft of storage; access control governs legitimate use.
Key points
- Treat training, retrieval and logging data as three zones with different risks.
- Classification of the data sets the protection of the model and outputs built on it.
- Minimise before training; filtering after the fact is weaker.
- Retrieval stores must enforce the asker’s permissions.
- Deletion from datasets does not undo learning, so decide on use in advance.
Check yourself
Question 1. A team plans to fine-tune a model on customer service transcripts that contain payment details. Which action is MOST effective BEFORE training starts?
- A. Remove or mask payment details and other unneeded fields from the training set
- B. Add an output filter after deployment
- C. Encrypt the transcripts at rest and train as is
- D. Extend the retention period for the transcripts
Show answer
Answer: A
Removing data the task does not need means the model cannot memorise it or reproduce it later. Output filtering is a weaker second layer, encrypting the dataset protects storage only, and a longer retention period increases exposure.
Want more questions like this? Full AAISM practice tests →
Question 2. A customer asks for their data to be erased, and it was part of a model's training set. What should the security manager recognise?
- A. Deleting the record from the dataset fully resolves the request
- B. Models never retain any individual information
- C. Dataset deletion may not remove the data’s influence, so the documented model remediation approach applies
- D. Encrypting the model addresses the request
Show answer
Answer: C
Deleting the record does not remove its influence from the trained model, so the organisation must follow its documented approach, which may involve retraining or a prior model version, with legal input. Believing deletion suffices, or that models never retain data, is wrong, and encrypting the model does not remove what it learned.
Want more questions like this? Full AAISM practice tests →
Question 3. An assistant retrieves from a shared index and sometimes returns documents the asker may not open. Which control addresses the cause?
- A. Slow down the query response time
- B. Fine-tune the model on more data
- C. Add a disclaimer to every answer
- D. Enforce the user’s access rights at retrieval time
Show answer
Answer: D
The cause is that retrieval ignores user permissions, so enforcing them at query time fixes it. Slower queries, more training and a disclaimer do not change who can see what.
Want more questions like this? Full AAISM practice tests →
This lesson covers subtopic 3C of Domain 3, AI Technologies and Controls (38%); the recap is at technologies and controls explained.