As demand for AI tools and services continues to grow, it’s more important than ever to understand the data we plan to input into these tools. Safe and appropriate use starts with a simple but critical question: what is the classification of the data I’m about to put into AI?

To address this challenge–and to streamline the classification process–UW–Madison will transition to a new data classification policy and framework beginning January 1, 2027.

What’s changing

• UW‑504 Data Classification policy will be retired on December 31, 2026.
• Beginning January 1, 2027, UW–Madison will adopt UW System Administrative Policy 1031, Information Security: Data Classification (SYS 1031).
• Data classification will move from a four‑tier model to a three‑tier, risk‑based one:
  • Low risk
  • Moderate risk
  • High risk

Why it matters

Feedback from across campus suggested that our current approach is confusing. Adopting the data classification schema in SYS 1031 will simplify classification, reduce uncertainty, and better support compliance and security—especially as data is used in new tools and technologies.

What’s next

The Data Classification team is actively supporting this work by:

• updating the Data Classification Initiative webpage with the latest insights and information.
• creating new guidance for research data.
• presenting at MIST, ITCCC, and other meetings, as well as holding office hours.

If your team would like a dedicated presentation, please reach out to Lisa Johnston or Heather Johnston to coordinate.