Every organization runs on two kinds of data. The first kind is structured: rows, columns, defined fields, and consistent schemas that databases and business intelligence tools were built to handle. Revenue figures, headcount, inventory counts, transaction records — this is all information that fits neatly into the systems that were designed for it.
The second kind doesn’t fit anywhere neat. Contracts. Audit reports. Engineering specifications. Onboarding guides. Meeting transcripts. Scanned invoices. Presentation decks. Email threads where the real decisions get made. This is unstructured data — information that carries meaning but resists the schema.
Unstructured data reflects how people actually communicate, think, and document their work.
Roughly 90 percent of enterprise data is unstructured, and that proportion hasn’t shrunk as organizations have added more software; it has grown, because the volume of generated content grows faster than the systems designed to organize it.
What makes data "unstructured"
Unstructured data is defined by the absence of a fixed schema. Because of aspects like layout, formatting, or medium, extracting information from unstructured data is a complex task that requires interpretation rather than a simple query.
As Aaron Levie, CEO of Box, explained during a recent fireside chat, "About ten percent of our data today is structured data... It's the ninety percent of our data that's unstructured that we've never really been able to tap into." Information, Levie continued, "tends to be highly fragmented across a wide variety of systems," including "document sharing services," "network file shares," and "enterprise content management systems."
Centralizing that content on one platform gives AI-powered processes a consistent layer for access, permissions, versioning, sharing, and lifecycle management.
The categories span a wide range:
- Document formats. contracts, PDFs, Word files, spreadsheets used as documents, slide decks, forms, and scanned paper records
- Communications. Email, chat, recorded calls, video meetings, and their transcripts
- Rich media. Images, video, audio recordings, and the metadata attached to them
- Operational records. log files, support tickets, handwritten notes, survey responses, and incident reports
- Collaborative artifacts. shared documents, comments, annotations, wikis, and version histories
What connects all of these categories is that understanding the content requires reading it — or, increasingly, running it through an AI model that can do the equivalent of reading at scale.
Why AI depends on this data
The large language models and multimodal systems now reaching enterprise adoption were trained on unstructured data. The capability these systems demonstrate — reasoning through text, summarizing a long document, answering a question based on context, extracting a specific clause from a contract — is the direct result of exposure to enormous volumes of human-generated content.
That capability doesn’t disappear when a model is deployed into an organization. The same techniques that let a model summarize a news article can be applied to a technical specification, a vendor agreement, or a call transcript.
Natural language processing identifies entities and relationships. Computer vision reads tables and diagrams in scanned documents. Intelligent document processing extracts fields from complex layouts that rule-based systems could never handle reliably.
Structured data powers the dashboards and reports an organization already relies on.
On the other hand, unstructured data powers the next layer of AI applications, which can do things like:
- Read contracts and surface a renewal risk
- Route a claim based on what the claimant actually wrote
- Answer a question by pulling from documents scattered across years of operations.
The problem organizations actually face
Most enterprise unstructured data isn’t organized in a way that makes it useful for AI. It’s distributed across document-sharing services, network file shares, email inboxes, and point solutions that accumulated over years of departmental decision-making. The same contract exists in three locations, and which is the authoritative version is often unclear. Sensitive files sit alongside routine ones with no classification applied. Permissions are inconsistent or simply absent.
All this fragmentation creates problems that go beyond inconvenience. An AI system ingesting content from fragmented, poorly governed sources will inherit the disorganization. It may retrieve an outdated document, expose material a user was never authorized to access, or produce an answer grounded in a draft that was superseded two years ago. To make matters worse, the failure mode is harder to detect because the output looks coherent even when the underlying source is wrong.
In order to eliminate the problems that come with interpreting unstructured data, enterprises should take care to implement vigorous governance policies that reduce the risk of errors and mislabeled files.
What governance changes
The organizations getting durable value from AI on their unstructured data share a common characteristic: they treat content governance as a prerequisite, not an afterthought.
Strong examples of governance include:
- Centralizing content on a platform with consistent access controls and permissions
- Applying classification to identify sensitive material before it reaches an AI system
- Maintaining clear version histories so retrieval returns the authoritative source
- Defining retention and lifecycle policies for both the original files and the outputs AI generates from them
"My own point of view on IT has always been as an enabler,” says Box CIO Ravi Malick. “But how do we provide the guardrails? How do we make sure that the brake system works well so that we can go fast and we can go fast in a controlled way?" By ensuring that you have these guardrails in place, you can reduce the risk of unauthorized data exposure while increasing agent accuracy by limiting their searchable repository to trusted sources.
By ensuring that you have guardrails in place, you can reduce the risk of unauthorized data exposure while increasing agent accuracy by limiting their searchable repository to trusted sources.
Security doesn’t weaken when AI enters the picture; it becomes more important as the surface area for accessing content expands. An AI system that can answer a question from across a document repository must not be able to surface material the person asking couldn’t otherwise open.
Unlocking the potential of unstructured data is important for every enterprise. But, take care to build in guardrails like governance policies and intelligent data management procedures to ensure data privacy and workflow efficiency.
Frequently asked questions about AI and unstructured data
What does unstructured data mean?
Unstructured data is information that doesn’t follow a predefined schema with consistent fields, rows, and columns. Examples include contracts, PDFs, emails, chat messages, images, videos, audio recordings, social posts, and free-form logs.
Can AI analyze unstructured data?
Yes. Natural language processing (NLP) processes text, computer vision analyzes images and video, speech recognition transcribes audio, and intelligent document processing extracts fields from complex documents. Embeddings and vector databases also enable semantic search across content based on meaning rather than exact keywords.
How does AI turn unstructured data into structured data?
AI first extracts content through native parsing or optical character recognition (OCR), then uses NLP, layout-aware models, classification, and field extraction to identify entities, relationships, categories, and values. The results can be mapped to a defined schema and delivered as JSON, database records, metadata, or fields in another business system.
How is semantic search different from keyword search?
Keyword search retrieves content containing literal terms or close variations. Semantic search represents the query and source content as embeddings, allowing it to retrieve conceptually related passages even when they use different wording.
Can an LLM replace SQL or business intelligence tools?
No, it can’t. Large language models (LLMs) are probabilistic token predictors and can make quiet mistakes in arithmetic, table joins, exact filtering, and schema enforcement. A more reliable architecture uses SQL or BI engines for deterministic computation and LLMs for query interpretation, summarization, and analysis of unstructured context.
How does retrieval-augmented generation work?
Retrieval-augmented generation is an architecture that retrieves relevant source content before asking a language model to produce an answer. RAG can make outputs more current and grounded, but its reliability depends on retrieval quality, source permissions, chunking, reranking, and evaluation.
What sensitive data should not be shared with an AI system without safeguards?
Credentials, regulated personal information, protected health information, payment card data, client-confidential material, unreleased financials, and proprietary intellectual property require protection.
Depending on the use case, safeguards may include redaction, tokenization, de-identification, private deployment, role-based access, DLP scanning, logging controls, and retention policies.
Can AI process new unstructured data without additional training?
Yes. During model training, an LLM learns language patterns from large volumes of content; during inference, it can process new files through uploads, RAG, or agent-based parsing without being retrained. Modern LLMs can also perform zero-shot analysis on some unfamiliar document types, although their outputs still require evaluation and appropriate oversight.
When should an organization use batch extraction, RAG, or agentic parsing?
Batch extraction is best suited to stable document types and predictable layouts that justify upfront processing. RAG is useful for varied content and question-answering, while agentic parsing offers flexibility for unpredictable tasks but requires more advanced orchestration, monitoring, permissions, and auditing.
How Box approaches AI for unstructured enterprise data
Box views unstructured data as a core source of enterprise knowledge. Contracts, presentations, reports, images, notes, and other files become more useful when organizations apply AI while preserving the permissions, security controls, governance policies, and workflows surrounding the original content.
How Box AI analyzes enterprise content
Box AI lets people ask questions about content, generate summaries, and extract information from documents. These capabilities apply natural language processing and generative AI to practical knowledge tasks such as reviewing reports, identifying important details, and interpreting long files. They cover the same generation and summarization stages described in the processing pipeline.
Generated answers and summaries should still be treated according to their business risk. For legal, financial, compliance, or other high-stakes work, people should work in concert with agents to verify important claims, rather than relying on agentic output entirely. This approach follows the human-oversight principle that high-stakes AI output requires inspectable evidence.
Curating trusted knowledge for AI with Box Hubs
Box Hubs enables teams to organize and publish curated collections of content for specific topics, projects, or audiences. This supports retrieval quality in a retrieval-augmented generation architecture by narrowing the source set to relevant, intentionally selected material rather than asking a model to search indiscriminately across every file in a repository.
A curated knowledge base can reduce noise and make it easier for people to identify the authoritative documents behind an AI-generated answer. Content owners can also manage which information is available for a given business purpose, addressing the retrieval-and-context problem that determines whether a RAG system returns grounded, relevant answers.
How Box Shield protects sensitive content in AI workflows
Box Shield supports content classification and security controls that reduce risk around sensitive files. This aligns with the pipeline's need to identify protected information before it’s ingested, embedded, or surfaced in a generated answer.
As Matt Terrell, Director of Product Management on Box's AI team, explained, organizations "need to be able to have confidence that the AI is not going to spit something out that you don't want in the hands of users like PII data." That includes the categories of sensitive data described in the security and compliance discussion, such as regulated personal data, payment information, and confidential material.
AI doesn’t remove the need for least-privilege access. Retrieval and generation systems should respect the same document-level permissions that govern direct access, so a semantic search or RAG query doesn’t expose material the requester couldn’t otherwise open.
Retention and defensible disposition with Box Governance
Box Governance supports retention policies, legal holds, and defensible disposition for enterprise content. These capabilities relate directly to the lifecycle requirements introduced earlier, including how long source documents, business records, and AI-derived artifacts must be retained.
Organizations should also define policies for derived outputs such as extracted metadata, generated summaries, workflow records, and review decisions. Retaining content indefinitely can increase risk, while deleting it prematurely can conflict with legal or regulatory obligations. This is the same balance the article raises when discussing storage costs and retention requirements.
Automating human review and document routing with Box Relay
Box Relay supports workflow automation for content-centric processes, including routing, approvals and repeatable handoffs.. It supports the human-in-the-loop patterns described earlier by routing documents for review, assigning tasks, collecting approvals, and moving content through repeatable business processes.
This applies directly to intelligent document processing and other extraction use cases. A field extracted below a confidence threshold can be routed to an authorized reviewer rather than flowing automatically into a downstream ERP or business system, mirroring the review-and-correction step in the IDP workflow.
Connecting AI-assisted agreement workflows with Box Sign
Box Sign supports electronic signature workflows within content-centric business processes. When AI summarizes an agreement or extracts its terms, Box Sign can support the subsequent signature stage while keeping the signed document connected to the broader content lifecycle.
AI-generated analysis should not substitute for required legal review or signer judgment. It can make an agreement easier to navigate, but the authoritative terms remain in the underlying document. Summarization is a starting point for review, not a final authority.
Supporting collaborative, AI-assisted knowledge work
Box Notes and Box Canvas support collaborative documentation, ideation, and visual planning. Teams can use them to record decisions, organize findings, and turn AI-assisted analysis, such as driver analysis linking qualitative themes to structured outcomes, into shared knowledge and actionable plans.
These tools address a practical requirement beyond model output: Insights need to be reviewed, discussed, contextualized, and translated into coordinated work by the people who remain accountable for the outcome.
Generating content and integrating it into business workflows
Box Doc Gen can create documents from structured data and approved templates, connecting structured information with content-generation workflows. Box Apps can support purpose-built experiences around content, while Box Platform and APIs allow organizations to connect Box-managed content with business applications, AI services, and downstream systems.
These capabilities support the hybrid architecture described earlier, in which deterministic systems handle exact fields and calculations while AI interprets unstructured data. Organizations can also build batch, retrieval-based, or agentic workflows without separating content access from enterprise security and governance controls.
Extracting structured metadata from documents with Box Extract
Enterprise documents contain fields that are genuinely useful as structured data: effective dates in contracts, coverage limits in insurance certificates, line items in invoices. Retrieving them has historically required manual review.
Box Extract applies AI to pull specific fields from documents at scale, producing structured metadata that feeds directly into downstream workflows and reporting. Financial services teams surface key contract terms without manual review. Procurement teams build datasets of renewal dates. Life sciences organizations extract protocol fields into compliance-ready records.
Box Extract applies metadata within the governed Box content environment, where access to the source content remains subject to Box permissions.
