How do you handle PII in AI systems?

I would treat PII as a data-minimization problem first, not only as a filtering problem. Before sending data to a model, I need to know whether the prompt actually needs each field, so I remove names, contact details, or account identifiers when they are not necessary. I would also review provider retention and training terms to confirm that submitted data is not retained or used in ways the application cannot accept. No model or provider setting makes unnecessary data safe to collect.

Next, I would detect and handle PII before it reaches prompts, vector stores, traces, or application logs. Detection can cover structured identifiers and patterns such as email addresses, phone numbers, and payment information. Redaction replaces sensitive values with placeholders, while tokenization can create reversible references when the application needs to restore a value later. I would prefer a deterministic rule for well-defined fields and a tested model-based detector for more varied text. Whatever I use, I would keep the original mapping outside the prompt and logs.

Security controls must cover the rest of the data lifecycle. I would encrypt data at rest and in transit, restrict access to sensitive mappings, apply retention limits, and build a workflow for deletion requests across the application, logs, and vector indexes. I would test redaction recall with labeled examples, including obfuscated and unusual formats, because missed PII can expose sensitive data in logs. I would also monitor detection failures and review any change to the pipeline with the same tests.