How AI Should Handle Tribal Cultural Data (And How Most Tools Don't)

When most outside companies pitch AI to a tribal organization, the slide they don’t show is the one about what the AI company does with your information. It’s not on purpose — most of them haven’t read the small print of the AI tools they’re recommending either. But the result for tribes is specific: cultural information, ceremonial photos, enrollment records, and elder recordings can end up shared in places that go against the tribe’s own rules.

This post is how we keep that from happening. It’s the part of our work that doesn’t show up in marketing because, when it’s working, you don’t notice it.

How most AI tools behave by default

Out of the box, most AI tools — including the famous ones — assume:

1. Anything you upload is fair to use for their own learning. Even the more expensive versions that say "we don’t learn from your data" often have small print that catches tribes by surprise. Read the fine print, especially on the free or nonprofit versions.
2. Anything you put in is searchable by anyone in your organization. A document you upload, a photo you add to a library, a meeting you record — all become searchable across the whole organization unless you specifically lock them down.
3. Anything you put in can move to other services. Those "connect X to Y" buttons move content between tools with one click. The rules about who can see it usually don’t travel with it.
4. Hidden information stays with the file. Photos remember where they were taken. Documents remember who wrote them. Audio remembers whose voice it is. None of this is on purpose — it’s just how the files work.

For most regular businesses, those settings are fine. For tribes, every one of them can break cultural rules that exist for reasons that go back generations.

The five kinds of information that need protection

Here are the categories we use when we work with Native American organizations. Every tribe has different rules — this is a starting place, not a replacement for your own community’s decisions.

1. Sacred and ceremonial content

Photos of sacred places, ceremonies, regalia, or the inside of cultural buildings. Audio or video of ceremonies. Recordings of language or knowledge that’s restricted (sometimes only during certain times of year).

Our rule: Not put into any system that can search across the whole organization. Not in shared drives that automatically share with AI tools. Not in meeting-recording tools that anyone in the office can access.

2. Enrollment records

Information about who is and isn’t a member of the tribe, family lines, blood quantum, family connections.

Our rule: Treated like the most sensitive personal information — like medical records. Locked up tightly, encrypted, every time someone looks at it gets recorded. Never given to AI tools without a written agreement that says they won’t use it for their own learning.

3. Elder recordings and oral histories

Recordings or written versions of conversations with tribal elders. Often gathered for a specific purpose (preserving language, an oral history project) with specific permissions that don’t extend to other uses.

Our rule: Stays with the project the elder agreed to. Doesn’t get rolled into "every document our organization has" search tools. Doesn’t get summarized for board meetings unless someone has specifically cleared it.

4. Internal council and governance records

Council meeting notes that haven’t been published, internal disagreements, vendor decisions, employment matters, financial information that isn’t in the public budget. Regular work confidentiality, but worth saying out loud — AI tools tend to quietly mix "internal" and "public" content together.

Our rule: The same people who can see the original records are the only ones whose AI tools can see them. AI tools that need access need specific permission.

5. Member service program records

Case files for assistance programs, education records, elder care notes, behavioral health records. Federal medical privacy laws may apply (HIPAA), plus your tribe’s own rules on top.

Our rule: Treated under the strictest set of rules that applies, plus any tribal rules. Most off-the-shelf AI tools can’t legally handle this kind of information.

What this looks like when built right

The good news: it’s not that hard to do correctly. The bad news: most AI projects skip this step entirely and treat protecting information as an afterthought.

Here’s what it should look like:

Different levels of storage

Don’t put everything in one big search system. Have at least three levels:

• Public level: website content, marketing materials, published reports. Open to AI tools, open to search.
• Staff level: office documents, internal policies, vendor contracts. AI tools can see them, but only with clear rules about who sees what.
• Restricted level: the five kinds of information above. Not in any AI search tools. Only specific people can see them.

A label on every document when you upload it

Every document you put into any system — a shared folder, your contact database, a photo library, a meeting recording — gets a label when it goes in. AI tools are set up to respect those labels. Documents without a label default to the most restricted level, not the least.

A record of who looked at what

Every time an AI tool reads any information, it gets logged: which tool, which person, which document. Someone at the tribe reviews this log monthly. This isn’t being paranoid — it’s the same standard hospitals use for medical records.

A clear way to leave any tool

Every AI tool the tribe uses has a clear plan for leaving: how to get all your information out, how long that takes, what happens to any custom training the AI did. If a company can’t answer those questions, they shouldn’t be in your system.

A "do not upload" rule for sacred content

This sounds obvious. It isn’t, in practice. A ceremony recording shows up because someone wants help editing it. A sacred site photo gets uploaded because someone is making a flyer. An elder’s recording gets pasted into ChatGPT because someone is summarizing for a board update.

The rule we recommend, plainly: no ceremonial or sacred content goes into any everyday AI tool, ever. If you need to do work that involves this kind of content, you use a custom tool the tribe controls — not a free service from a big company.

What we wouldn’t recommend

A few things we’d push back on hard:

• AI-made cultural content. AI doesn’t know the difference between a respectful image and a caricature. The voice has to come from the tribe.
• Sharing information between tribes without each tribe agreeing. Even if tribes have similar concerns, they’re different nations with different rules.
• An "AI ethics committee" as a stand-in for actually protecting information. Committees make recommendations. The way you build the system makes the difference. Build it right, then let the committee help oversee it — not replace the actual work.

How to look at a pitch with this in mind

If a company comes to your tribal council with an AI proposal, the questions that matter aren’t about features. They’re about the defaults:

1. When we upload documents to your tool, who can see them by default?
2. What happens to our information that gets used to train your AI? Do you keep it? Delete it?
3. Can we label our documents when we upload them so your tool treats them differently?
4. If we leave, what happens to any custom work we’ve done with your tool?
5. Have you worked with tribes before?

If the answers are "we’ll figure it out" or "let me get back to you" — that’s a no for now. Come back when the answers are in writing.

How we handle this in our work

We’ve been the technology team for AIT and what it used to be called for over ten years. The rules above are the result of all those years — every one of them comes from a moment when a tool’s default behavior didn’t match what the tribe expected.

If your organization is thinking about AI and wants help figuring this out before the pitches start showing up, a free 15-minute call is the right next step. We’ll talk through your specific information and figure out which kinds need which level of protection. No upsell — even if you don’t hire us, you’ll have the framework to look at other companies safely.

The short PDF Where AI Fits in Your Operation covers the bigger question of when AI fits at all. This post is the companion to that: when AI does fit, here’s how to set it up so it doesn’t break your tribe’s rules along the way.