PII shows up in far more places than a customer database: support tickets, call transcripts, uploaded documents and AI chat logs can all contain names, addresses or identification numbers. Before feeding any of that into an AI tool, a company needs to know what PII is in it and whether the tool is allowed to see it under its contract and applicable privacy law.
The common mistake is assuming PII only means obviously sensitive fields such as a Social Security number. Combined with other data, even a birth date and a ZIP code can identify someone, which is why data governance treats PII as a category to classify and protect rather than a short fixed list of field names.