What information should an industrial AI system be allowed to use?
Access should be limited to approved information needed for a defined use case and authorized for the people using the system.
What to consider
Identify the data owner, sensitivity, source location and existing access rules before connecting information. Review whether the proposed system stores, shares or sends information outside approved boundaries. Permissions and retention decisions should follow the organization’s policies and applicable agreements.
Practical steps
- List the proposed sources and the reason each is needed.
- Have the responsible owners approve access and identify restricted information.
- Verify that users cannot retrieve material beyond their authorized access.
- Test how updates, removals and access changes are reflected in the system.
A practical example
A technician asks an AI tool for a pump manual, but the repository also contains restricted personnel and vendor information. The pilot owner limits access to approved documents and confirms that the user's existing permissions apply. Tests include an authorized document and a restricted item to verify the access boundary. The team resolves failures before wider use and keeps source ownership and review responsibilities clear.
Explore the assessment
See how KANE approaches this work and what an engagement includes.
View the related assessment →Related answer: Explore related guidance