AI Data Classification for Everyone
The classification rule that protects you, your residents, your team, co-workers, company, friends and your family.
Most AI training teaches prompting for six weeks and bolts a safety warning on the end. We do it backwards on purpose. The data classificationDATA CLASSIFICATIONThe practice of sorting information into risk categories so your team knows what is safe to share with AI and what is not. The 3 Data Classification Tiers (Green, Yellow, Red) is the framework we teach. frameworkFRAMEWORKA structured way of organizing thinking, decisions, or actions so a team can act consistently. The 3 Data Classification Tiers (Green / Yellow / Red) is a framework. NIST AI RMF is a framework. Frameworks let your team make the same right call whether the leasing pro has been there 12 years or 12 days. comes first. The skill comes second. Twenty minutes today and you walk out with the same 3-tier data classification model that NIST (National Institute of Standards and Technology)NIST (NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY)The U.S. government agency that writes the rulebook for how technology should be built and used safely. When a company says "we follow NIST standards," it means they follow security and risk guidelines that NIST published. Their AI Risk Management Framework is the leading guide for how organizations should classify and manage AI risk. Our 3 Data Classification Tiers maps directly to it. nist.gov, ISO (International Organization for Standardization)ISO (INTERNATIONAL ORGANIZATION FOR STANDARDIZATION)The worldwide organization that sets quality and safety standards for every industry, from food safety to construction to technology. When you see "ISO certified" on a product or vendor, it means they passed an independent review against ISO's published standards. ISO/IEC 23894 is their standard specifically for AI risk management. Our 3 Data Classification Tiers aligns with it. iso.org, RETTC (Real Estate Technology & Transformation Center)RETTC (REAL ESTATE TECHNOLOGY & TRANSFORMATION CENTER)The real estate industry's own technology standards body. RETTC publishes guidance specifically for property management companies on how to evaluate, adopt, and govern new technology including AI. Think of RETTC as the bridge between big-picture frameworks like NIST and the day-to-day decisions your team makes about which tools to use and how to use them safely. rettc.org, and major enterprise governance frameworks use, focused on the one type of AI that just landed on your team's phones with no governance attached: generative AIGENERATIVE AIAI that creates new content: text, images, code, video. ChatGPT, Claude, Gemini, and Copilot are the major examples. This is the type of AI the 3 Data Classification Tiers governs..
The Week 01 workshop intro recording will be added here after the live event.
Share with your team so they can revisit the workshop anytime.
Beginner · All Levels Welcome
The 20 Minutes Ahead
No warm-up. No recap. We start on time, teach the rule, take five minutes of questions, and close with one tool you can use today. Here is the map.
Open
Jump right in.
Teach the rule
Why you should care, what happens when you paste, the 3 Data Classification Tiers, the default rule, and one live practice round.
Questions
Five minutes, capped. Everything else goes to the portal.
Power Preview
A live demo of one Green Zone AI tool you can use today.
Objective: By the end of this session, you can classify any AI use case as Red, Yellow, or Green and you know exactly why the rule protects you, not just your company.
Not all AI is the same.
Five types under one umbrella. You have been using four of them for years. The fifth is the one we teach.
Your community has been using AI for years through approved vendor tools. What changed is that one specific type landed on every team member's phone with no governance attached. Before we teach the rule, you need to know which type the rule is about.
Machine LearningMACHINE LEARNING (ML)A type of AI that learns patterns from large amounts of data, then makes predictions or decisions based on what it has seen. Unlike generative AI, it does not create new content. It forecasts, classifies, or detects. In multifamily, ML powers revenue management forecasting, fraud screening on applications, and spam filters in your inbox.
Recognizes patterns in data.
Spam filters, predictive text, fraud detection, revenue management forecasting.
Natural Language ProcessingNATURAL LANGUAGE PROCESSING (NLP)A type of AI that reads, hears, and understands human language. NLP powers voice assistants like Siri and Alexa, your prospect chatbot, email auto-classification, and translation tools. It interprets what people say or write, but does not freely generate new ideas the way generative AI does.
Understands human language.
Siri, Alexa, voice assistants, your prospect chatbot, email auto-categorizers.
Computer VisionCOMPUTER VISION (CV)A type of AI that analyzes images and video to recognize objects, faces, text, license plates, and movement. In multifamily, computer vision powers security cameras, package lockers, Face ID on your phone, and parking enforcement. The AI converts pixels into structured information your team can act on.
Analyzes visual data.
Face ID, package lockers, security cameras, license plate readers.
Robotics & AutomationROBOTICS & AUTOMATIONAI systems that take physical or digital actions automatically based on triggers, rules, or sensor input. Smart locks unlock when a code is entered. HVAC adjusts to set points. Workflows fire off tasks when a lease is signed. In multifamily, this includes automated maintenance dispatching, smart thermostats, and renewal workflow triggers.
Takes actions automatically.
Smart locks, HVAC systems, workflow triggers, automated lease renewals.
Generative AI ★
Creates new content: text, images, code, video.
ChatGPT, Claude, Gemini, Copilot. The type your team has on their phones with no governance attached. This is where the failure modes live. This is what the 3 Tiers are calibrated for.
For the next 52 weeks of AI Tuesdays, when we say "AI" we mean generative AI. The other four types live in your already-approved vendor tools. The 3 Tiers protect you from the one type that has not been through that review yet.
One rule. Who you protect when you learn this rule.
YOU
The leasing professional who pasted a resident's social security number into ChatGPT in 2023 does not work in the industry anymore. The one who learned the rule first is a regional now.
YOUR RESIDENTS
Mrs. Garcia handed you her social security number and the fact that her daughter uses a wheelchair. She did not hand that to OpenAI. When you protect her data, you keep her trust.
YOUR COWORKERS
Your assistant manager has 12 years in. Your maintenance super has three kids in college. One AI mistake can pull them into the audit too.
YOUR FAMILY
Your kids are using AI for homework. Your parents could be scammed by it. Same Red, Yellow, Green rule protects your kitchen table.
THE INDUSTRY
The leasing professionals who learn this rule first become the ones their peers come to with questions. AI fluency is the next promotion.
"You will use this information for the rest of your career."
Once it's in, you can't take it back.
When you paste resident info into ChatGPT, you do not just "use AI." Your data goes places you cannot see and cannot reach. There is no delete button that fixes it. Look at where it actually goes.
Real example: In 2023, Samsung engineers pasted proprietary code into ChatGPT to debug it. Samsung banned all employee AI use company-wide within weeks. The code is part of OpenAI's data now. Samsung cannot get it back. Not with money. Not with lawyers.
Meet the 3 Data Classification Tiers
Green is go. Yellow is slow down and check. Red is stop.
You already know red-yellow-green. We apply it as three data classification tiers, the same model used in the NIST AI Risk Management FrameworkNIST AI RMF (AI RISK MANAGEMENT FRAMEWORK)The specific document NIST published that tells organizations how to sort AI uses by risk level and put the right safeguards around each one. It is voluntary, not law, but it is the standard that serious organizations follow. Our 3 Data Classification Tiers (Green, Yellow, Red) maps directly to its risk-tiering approach. When we say our framework is grounded in NIST, this is what we mean. View on nist.gov, ISO/IEC 23894 (AI Risk Management)ISO/IEC 23894The international standard specifically for AI risk management, published jointly by ISO and the International Electrotechnical Commission (IEC). It gives organizations a step-by-step process to identify what could go wrong with AI, assess how serious it is, and put controls in place. Our 3 Data Classification Tiers maps to this standard. View on iso.org, the RETTC (Real Estate Technology & Transformation Center)RETTC (REAL ESTATE TECHNOLOGY & TRANSFORMATION CENTER)The real estate industry's own technology standards body. RETTC publishes guidance specifically for property management companies on how to evaluate, adopt, and govern new technology including AI. Think of RETTC as the bridge between big-picture frameworks like NIST and the day-to-day decisions your team makes about which tools to use and how to use them safely. rettc.org, and enterprise governance frameworks worldwide. Three tiers. Three colors. One universal pattern, applied to every AI tool and use case at your community.
This workshop teaches two classification systems that work together. They answer different questions about the same situation.
Where is this piece of data allowed to go?
Is this AI job allowed to run, and with how much oversight?
Both use the same colors. Both protect you. You will learn to ask both questions every time.
Tier 1 (Green)
Tier 1 (Green)
Safe for Any AIApproved platformAPPROVED PLATFORMAn AI tool that your company has reviewed, vetted, and authorized for use with company data. Approval typically requires SOC 2 certification, a data processing agreement, and confirmation that your inputs will not be used to train future models. Free public versions of ChatGPT, Gemini, or Copilot are NOT approved platforms unless your company has signed a specific enterprise contract for that tier.. Non-sensitive content. You review the output before sending or posting. This is where you live every day. This is where AI fluencyAI FLUENCYThe ability to use AI tools confidently, safely, and effectively in your daily work. Like learning any new skill, fluency builds through practice with the right guardrails in place. builds fastest, with the lowest risk.
What this looks like at your community
- "Help me write a welcome letter template for new residents." Generic. No names. Green.
- "Give me 10 fall move-in special ideas for marketing." Brainstorm. No data. Green.
- "Draft a social caption for our new dog park." Public information. Green.
Tier 2 (Yellow)
Tier 2 (Yellow)
Enterprise OnlyThe AI touches proprietary data. Or generates resident-facing output. Or gets close to pricing or screening. Or it is a brand new tool nobody approved yet. You can use AI here, but only after the right people approve it and the right guardrails are in place.
What this looks like at your community
- "Office wants to add an AI chatbot for overnight prospect leads." Resident-facing. Yellow.
- "Use AI to summarize last quarter's rent comps." Proprietary data. Yellow.
- "A new AI tool nobody on your team has approved yet." Yellow. Stop. Submit it for review before anyone uses it.
Tier 3 (Red)
Tier 3 (Red)
NeverPersonal information or financial data in any AI tool. Autonomous decisions affecting residents. Unapproved consumer AI tools on company devices or with company data. These are the moves that get people fired, sued, or both. There is no version of these that becomes okay.
What this looks like at your community
- "Paste Mrs. Garcia's complaint email into ChatGPT to draft a reply." Red. Always.
- "Upload the rent roll PDF and ask AI who is most behind." Red. Always.
- "Photograph a screening report and ask AI to summarize." Red. Photos don't change the rule.
When in doubt, Yellow it out.
If you are unsure where something falls, default to Yellow until it has been reviewed and approved.
This is the only sentence you have to memorize today. Every other rule in this workshop flows from this one. Going Green when unsure is what creates problems. Defaulting to Yellow and asking for review is what builds careers.
The Four Questions You'll Get
These come up in every Week 1 session. Here are the answers in your back pocket.
Better - if it is actually enterprise-levelENTERPRISE AIA business-tier version of an AI tool that comes with stronger data protections, no use of your inputs to train future models, audit logs, and contractual safeguards. Examples: ChatGPT Enterprise, Microsoft 365 Copilot, Gemini Enterprise, Claude for Work. The signals: a paid contract between your company and the vendor, SOC 2 certification, and a data processing agreement. WARNING: not all Microsoft Copilot is enterprise-level. Microsoft also sells consumer versions that do NOT include enterprise protections.. Critical caveat: not all Microsoft Copilot is enterprise-level. Microsoft sells both consumer and enterprise versions of Copilot. Most people assume it is all enterprise-grade. It is not. Ask your IT team three questions: "Is our Copilot tier enterprise? Is it SOC 2 (System and Organization Controls)SOC 2 (SYSTEM AND ORGANIZATION CONTROLS 2)An independent audit that verifies a technology vendor protects your data with proper security, availability, and privacy controls. If an AI vendor does not have SOC 2 certification, your organization's data is not protected by verified safeguards. SOC 2 is required for any enterprise AI platform used for Tier 2 (Yellow) tasks. certified? Are there audit logsAUDIT LOGA timestamped record of every action taken in an AI tool: who used it, when, what they entered, and what was returned. Enterprise AI tools keep audit logs. Consumer versions do not. When compliance, legal, or your regional asks "who used which AI tool on which resident data and when?" you can only answer that question if audit logs exist.?" If yes, apply the 3 Tiers. Yellow still needs approval. Red stays Red. If no, treat it like consumer AICONSUMER AIA version of an AI tool designed for individual users, not businesses. Free or low-cost. Examples: ChatGPT (free or Plus tier), Gemini (free), Copilot personal, Claude (free). Consumer AI typically DOES use your inputs to train future models, does NOT provide audit logs, and is NOT SOC 2 certified. Rule of thumb: treat anything you type into consumer AI as if it is going on a billboard. Stick to Green tasks only. and stick to Green tasks.
Stick to Green tasks. Never paste names. Talk to your manager. The conversation puts you on record as someone trying to do this right, which protects you later.
The source is still Red. De-identifyDE-IDENTIFYRemoving all personal information (names, apartment numbers, dates, medical details, financial data) from a document before sharing it with AI. Replace real details with generic placeholders like "Resident A" or "Apartment Home." the scenario first, then ask AI for a general framework. You write the actual reply.
That is a chatbot governance gap. We cover chatbot audits in Week 5. Control what you control: what your team pastes into AI.
The Tour Talking Points Generator
AI thinks with you on the most important 20 minutes of your week.
You walk apartment homes every day. AI gives you a custom walkthrough in 30 seconds. This is what Green Zone looks like when you use it well.
One of seven foundational promptPROMPTThe instructions you type into an AI tool telling it what you want. The more specific your prompt, the more useful the output. A good prompt includes a role, a task, and a format. structures we teach across the year. By Week 20 you will recognize all seven.
Two roommates, early 20s, first apartment together
Same apartment home. Different prospects. Different tour.
Same apartment home. Same prompt structure. Completely different walkthrough. That is the wow.
Try This Today
That is what 29 more Tuesdays of Power Previews will teach you to build yourself.
🟢 🟡 🔴 The 3 Data Classification Tiers
Use this framework to classify every AI use case in your organization. If you are unsure where something falls, default to Yellow until it has been reviewed and approved.
The slides below classify the use case.
Data Classification asks "where is this information allowed to go?" Use-Case Risk asks "is this AI job allowed to run here, and with how much oversight?" You need both answers before you act.
Approved, Conditional, and Prohibited AI Use
An Acceptable Use PolicyACCEPTABLE USE POLICY (AUP)A written document that defines exactly what your team can and cannot do with AI tools. It lists approved tools, conditional uses requiring approval, and prohibited uses. Every multifamily organization should have one, every team member should sign it, and it should be reviewed quarterly as new AI tools land on the market. defines clear boundaries so every team member knows what is allowed, what requires approval, and what is never permitted. This applies to all employees, contractors, and vendors using AI on behalf of the organization.
List the AI tools your organization uses or is considering. Classify each as Approved, Conditional, or Prohibited.
Data Privacy MatrixDATA PRIVACY MATRIXA reference grid that maps every type of data your team handles to where it can safely be used with AI: free public AI, enterprise AI only, or never. The matrix turns abstract privacy rules into a quick lookup your whole team can scan in seconds and tape to the wall.
What data goes where. This is the cheat sheet your whole team needs taped to the wall.
- Social Security numbers
- Bank or credit card info
- Government-issued IDs
- Passwords or access codes
- Medical or disability details
- Full criminal record details
- Resident name + complaint paired
- Resident name + apartment number
- Lease amounts or payment history
- Contact information
- Internal financial data
- Employee performance records
- Legal correspondence
- Maintenance requests with names
- Property descriptions
- Public amenity information
- Marketing copy drafts
- Generic email templates
- Public competitor info
- Educational content
- Anonymous scenario examples
When the Yellow fields above appear together in a single named record (a rent roll, a delinquency report, a screening report), classification escalates to Tier 3 (Red) regardless of platform. Combined records concentrate risk in a way individual fields do not. No enterprise tool exception applies.
Spot the Tier
Instructions: Click your classification for each scenario. You get instant feedback so you can see how your thinking compares.
Discussion: Which scenarios were hardest to classify? Where does your organization currently have the biggest gaps between what should happen and what is happening?
The Data Classification Quiz
🔒 Anonymous. No name needed.
Take this anytime, even after we hang up. Wrong answer? You get an educational tip. Your results submit anonymously to help us improve the workshop. No login. No name. No email collected from you. Answer honestly. That's where the learning happens.
Disability touches a protected classPROTECTED CLASSCategories of people that Fair Housing law specifically protects against discrimination: race, color, national origin, religion, sex, familial status, and disability. Any AI output that could exclude or discourage a protected class creates legal exposure. under Fair Housing. The original email is Red. Even with redaction, the safer move is to ask AI for a general framework for handling complaints about accommodations, then write the actual reply yourself with no real names. Personal phone does not change the rule.
That is the default rule: "When in doubt, Yellow it out." Going Green when unsure is the move that creates problems. Defaulting to Yellow and asking for review is what builds careers.
Disability and medical references touch protected class characteristics under Fair Housing. That makes them automatically Red, names or not. The other three are Green Zone tasks you can use AI for confidently.
Delete only removes the chat from your view. The data already left your control. It may live in training dataTRAINING DATAThe massive collection of text, code, and content that an AI model learned from. When you paste information into an AI tool, that information may become part of the data used to train future versions of the model. Once it is in the training data, there is no way to remove it., logs, backups, and human reviewer queues. No undo. No fix. This is why the rule has to come first.
One paste touches the whole chain. Your residents lose privacy. Your coworkers get pulled into the audit. Your family loses your paycheck if it costs you the job. This is why this matters more than 'company policy.'
Download the Policy. Send It to Tami or your supervisor.
This week's action item has three steps. Twenty minutes total. By the end, your community has a documented Data Classification Policy and the leadership team has confirmation that you completed Week 1.
Data Classification Policy Template
The official Multifamily NEXT template every site team should adopt. Download it, complete it for your community, and send the completed version to Tami.
Hallucinations and Sycophancy
The two generative AI behaviors every beginner learns to spot first.
Generative AI does two things that fool beginners. It makes up facts in confident sentencesHALLUCINATIONWhen AI generates information that sounds confident and authoritative but is completely fabricated. It does not know it is wrong. It cannot tell you it is guessing. You have to catch it yourself. Week 2 teaches you how.. And it agrees with whatever you said last, even when you were wrongSYCOPHANCYWhen AI tells you what you want to hear instead of what is accurate. If you push back on a correct answer, it may reverse itself and agree with your wrong answer. Week 2 teaches you how to test for this.. Next Tuesday you learn to spot both on sight, name them out loud in front of your team, and know exactly what to do next.
You did the work today.
You showed up. You sat through the rule. You earned the Power Preview. You are now ahead of most of the multifamily industry on this. Good job. See you Tuesday.
