AI notetakers are widely used by businesses in all industries. Although efficient, they pose privacy and cybersecurity risks, including lax compliance with established privacy and security frameworks such as GDPR or SOC 2, weak encryption, and recording conversations without consent, which may be in violation of one-party recording laws. For lawyers, it could mean an unauthorized waiver of privilege.
Before deploying an AI notetaker in your environment, it is important to assess the risk it poses to your organization, like any newly deployed technology. Unfortunately, many AI notetakers are embedded in conference platforms, and it may be difficult for users to turn them off. Consider establishing a process to approve AI notetaking for users, including training employees on which platforms have been sanctioned, obtaining consent from all participants during the use of the AI notetaker, establishing who has access to transcripts and how they are maintained, vetting vendors on training from your data, and reviewing vendors vendor contracts for privacy and security protections. Obvious places where AI notetaking may be prohibited include meetings with legal counsel, human resources meetings, and meetings discussing highly confidential matters.
Another consideration is how employees are using private AI notetakers in the workplace. Shadow AI notetakers are being used by employees in their personal lives, and that use spreads into the workplace. They can present themselves as apps on mobile phones or watches, or could be recording through sunglasses or wearable devices. The use of shadow AI notetakers presents a risk to the organization as the use is not sanctioned, governed or subject to the organization’s established policies and procedures.
Shadow AI notetakers present real risks to an organization as users may not be disclosing the use of the AI notetakers to others they are recording, are not obtaining consent, and are secretly recording conversations. In one example, an executive from an organization was having a private conversation with another employee, and unbeknownst to him, the other employee was secretly recording the conversation and the executive was fired. This shows how ubiquitous AI notetakers have become and that there is no such thing as a private conversation anymore. Executives need to be aware of the risks associated with AI notetakers, assess them, and put a governance program in place to address their use in the organization like any other newly deployed technology. Employees need to be aware of the risks, follow the organization’s guidelines and ask that AI notetakers be dismissed from meetings discussing legal, human resources, or highly confidential matters.