# Communication compliance monitoring is configured for enterprise AI tools
Collection Policies provide the data ingestion layer that supports monitoring of enterprise AI app activity.
Source: https://maester.dev/docs/tests/ZTA.35040
## Overview
Collection Policies provide the data ingestion layer that supports monitoring of enterprise AI app activity. When these policies are in place, Communication Compliance can collect signals from AI app interactions and help organizations understand where data protection risks may exist across AI‑enabled workflows. This visibility helps teams apply data protection controls more consistently as AI use expands beyond Microsoft 365 Copilot.
In practice, users may accidentally share sensitive data with custom AI applications, Power Automate flows, AI Builder automations, or non‑Microsoft AI services that aren’t approved to handle confidential information. However, Communication Compliance policies that cover enterprise AI app interactions can help surface potential data exposure to these services and extend data protection practices to custom and third‑party AI solutions.
## Remediation
- [Create and Deploy collection policies](https://learn.microsoft.com/purview/collection-policies-create-deploy-policy?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
- [Create and manage Communication Compliance policies](https://learn.microsoft.com/purview/communication-compliance-policies?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | High |
| Effort to fix | Medium |
| Impact on users | Medium |
| Pillar | Data, AI |
| Category | Data Security Posture Management |
| Product | [Purview](/docs/tests/products/purview) |
| Feature | Insider risk management |
| Area | Logging and detection |
| Licence | EXCHANGE_S_ENTERPRISE |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.