Laws are changing around the world to require frequent disposal of high-risk information, to reduce the impact of (inevitable) breaches. As such, ‘records management’ is now cyber discipline, but one that has not previously been well enabled by technology. To address the new importance of records governance, and the growing challenges of managing data at scale, AI has entered the fray over the last five years, to automatically classify records against risk and retention rules. But there are pitfalls to be aware of when considering AI for data classification, not least of which relate to new legislation for Ethical AI. This talk provides a summary of the requirements for data lifecycle management, the technology approaches, and the risks, and includes a Data Minimisation Best Practice Checklist for cyber professionals.