AB-731: AI Transformation Leader

Preventing an AI system such as Microsoft 365 Copilot from surfacing confidential or classified content requires data governance controls — specifically data classification and sensitivity labeling combined with permission-based access enforcement. When documents are classified and protected through a data governance framework, the AI can only access and reference content that the requesting user is already authorized to view; labeled/restricted files are excluded from AI-generated responses for users without the necessary permissions. Information barrier policies instead restrict communication and collaboration between defined groups of users, communication monitoring reviews conversations for compliance/conduct issues, and data retention policies control the lifecycle (how long data is kept), none of which govern whether AI can read and process classified content the way data governance (classification and access control) does.