Compliance · July 30, 2026
Find the unmasked PII before your AI does.
By the MortarIQ Founder · 5 minute read
Every warehouse of a certain age has them: the customer table in a staging schema with raw emails, the support export with phone numbers in the clear, the users_backup_final2someone made during a migration. For years this was tolerated exposure. Twelve analysts had access, none of them ever looked, and the risk rounded to zero in everyone’s head.
Then an AI workload shows up, and the arithmetic changes completely. A retrieval pipeline does not read a few rows; it ingests the table. An agent does not glance at a record; it quotes one to a user. A training run does not forget what it saw. The machine consumer reads everything its role can see, at scale, forever, and “nobody ever looks at that table” stops being a control the day you wire one up.
So before the corpus is assembled and before the agent gets credentials, you want one artifact: an inventory of where personal data lives in your warehouse and whether it is actually protected. Here is how to build one from metadata alone, in minutes, without granting anyone access to the data you are worried about.
Exposure is a set difference
The trick is that finding unprotected personal data does not require reading any personal data. It requires comparing two sets that both live in catalog metadata:
What looks like PII. Column names and types are remarkably honest. email, phone, first_name, dob, ssn, ip_address, address fields, national identifiers. Add columns already carrying a sensitivity tag or classification, since someone has explicitly told the catalog what they are.
What is actually protected. Masking policies on Snowflake, policy tags with access control on BigQuery, and their equivalents elsewhere, all recorded as metadata, all attributable to specific columns.
The difference between the two sets is your exposure inventory: columns that look like personal data and carry no protection. In the assessments we have run, this list comes back longer than the team expected, and the surprises cluster in the same places: staging schemas one layer below the governed marts, ad hoc exports, and backups of production tables. Governance tends to be applied where people look, and exposure survives where they do not. A MortarIQ scan produces this inventory as a standard section of the report, alongside the six-factor score.
The regulatory clock changes the stakes
The EU AI Act’s high-risk obligations, with Article 10 landing squarely on data governance, become enforceable on December 2, 2027, after the Digital Omnibus deferred the original August 2026 date. High-risk AI systems must be built on data subject to appropriate governance practices, including examination for biases and gaps, and personal data handled with the protections that were already due under GDPR. An unmasked PII inventory is the first document a serious review asks for, and the deferral is exactly the window to become able to produce one.
The regulation aside, the operational logic stands on its own. You cannot mask what you have not found, and you cannot scope an AI corpus safely if you do not know which tables are radioactive. The inventory is the prerequisite for every other control.
Get your readiness score.
Connect read-only credentials and see your score and biggest blocker in minutes. Metadata only. Starts free.
Run the free scanFrom inventory to fixed
An inventory nobody acts on is a liability with a timestamp. The report orders findings by severity, so unprotected personal data outranks missing documentation every time, and ships remediation SQL for the platform you are on: the masking policy to create, the tag to apply, the grant to revoke. On the Team plan the findings land on a remediation board that persists across re-scans, so “mask the staging emails” stays assigned until the scan confirms it is done, and reopens if a migration quietly undoes it. Scheduled monitoring then watches for the next unprotected table to appear, because there is always a next one.
The honest boundary
A metadata scan finds PII candidates, not certainties. It cannot see the email address someone pasted into a free-text notes column, and it cannot confirm that a column named customer_ref is as anonymous as it sounds, because both require reading values and this scan never does. What it can do is find the exposure that is discoverable from structure, and give a value-level review a short, prioritized list of places to look instead of an entire estate to sift. Evidence, not certification. That boundary is why the scan is safe enough to run today instead of after a quarter of security review, which is rather the point of doing it before the review, not after.
Frequently asked questions
How can you find PII without reading the data?
From the structure around it. Column names (email, phone, ssn, date_of_birth), data types, existing classification tags, and masking policy coverage are all catalog metadata. Cross-referencing what looks like personal data against what is actually tagged and masked produces a candidate exposure inventory without a single row being read.
Is a metadata-based PII inventory complete?
No, and treat any vendor claim otherwise with suspicion. Metadata detection finds candidates: columns whose names, types, and tags indicate personal data. It cannot see PII hiding in a free-text notes column or a JSON blob, because confirming that requires reading values. The honest framing is that the inventory finds the exposure that is discoverable in minutes, and tells you exactly where deeper, value-level review should focus.
Why does AI change the urgency of unmasked PII?
Scale and memory. A human analyst with access to an unmasked table reads a few rows and forgets them. A retrieval pipeline ingests the whole table into a corpus, an agent quotes it to users, and a training run bakes it into weights. The same governance gap that produced zero incidents for years becomes an incident generator the day a machine consumer arrives.
Does this satisfy EU AI Act Article 10?
No tool satisfies Article 10 by itself, and a metadata scan cannot certify compliance. What it produces is evidence: a documented inventory of where personal data lives, what is protected, and what was remediated, with re-scans showing the trend. Article 10 requires data governance practices for high-risk AI systems; a repeatable, dated assessment is the kind of artifact that demonstrates those practices exist.
Want to see what the inventory looks like first? The sample report includes a full PII exposure section, built entirely from metadata.