Planning allowance: 3–10 working days, with legal review potentially longer. Build a manifest before transferring content. Include source, owner, date, customer/tenant, document family, label origin, sensitivity, retention and permitted processing purpose.
Do not equate availability with permission. Ask counsel about customer restrictions, supplier reuse, subcontractors, teacher-model terms and export obligations. When ePHI is involved, HHS’s cloud guidance explains that encrypted storage alone does not remove business-associate obligations. That is a scoped legal issue, not a blanket rule for all software data.
Sample label quality with two reviewers on ambiguous cases. Record disagreement and adjudication. If the labels are inconsistent, repair the rubric before generating thousands more examples. If a record cannot be used, exclude it and preserve the reason in the manifest.
Stop condition: unresolved permission for the planned use, no owner for sensitive-data handling, or no reliable target labels.