The Walls Have Ears: AI Notetakers at Work

AI notetakers are becoming more prominent and fundamentally changing how people work by recording everything happening around them. Instead of physically taking notes during a meeting, employees can utilize AI notetakers to take detailed notes, prepare summaries, and identify follow-up items almost instantly. These tools can undoubtedly reduce administrative burden, but in doing so can simultaneously increase legal risk.

An AI notetaker suddenly appears in a virtual meeting you thought was private, or worse, you are having a sensitive in-person conversation that’s being transcribed, and you do not know it. The technology that was supposed to make your job easier has done the opposite. 

For a while, AI assistants were generally easy to spot because they typically appeared as participants in a meeting held on an online meeting platform. However, recently AI notetakers have entered the office as silent, nosy co-workers. Portable AI Notetakers can be small enough to fit in a pocket, or even attach to a cellphone. It no longer needs to announce its presence in a virtual meeting, operate on an employer’s network, or be installed on an employer-issued computer to be present in the day-to-day hustle. Rather, an employee-controlled device can access conference room discussions, interviews, phone calls, and informal workplace conversations and later send that information to a third-party AI service, often without the employer’s knowledge, and before anyone has decided whether that information should exist.

That risk is not theoretical. In a disciplinary meeting, workplace investigation, hiring interview, or discussion about working conditions, an AI-generated transcript can expose confidential information, distort what someone said, complicate an HR decision, or preserve statements the company never expected to keep. The questions are straightforward but consequential: When is recording allowed? What notice or consent is required? Who controls the transcript, and how long will it remain available?

Notice and Consent Issues Created by Portable AI Notetakers

Federal and state laws often restrict the recording of telephone calls and other communications. In most states, including New Jersey, the consent of one party to the conversation is required. However, several other states, including California, Illinois, Florida, Pennsylvania, Maryland, and Massachusetts, generally require all parties to consent before a private conversation is recorded. But with portable devices, exposure is not limited to simply internal telephone or video calls; rather, it expands to normal day-to-day tasks within an employer – accommodation meetings, workplace investigations, candidate interviews, customer calls, and conversations regarding patients and visitors.

Consent to being recorded may not alone authorize the recording to be shared with a third-party AI vendor, which will receive a copy of the conversation and use the information to create a transcript. Employers can get ahead of this issue by creating and issuing policies that generally prohibit employees from recording workplace conversations with an AI notetaker with express notice and approval.

The Security Risks

Many employers have tried to stay ahead of unfettered AI use by locking down their systems, blocking AI meeting notetakers, restricting browser extensions, preventing unauthorized software installations, or limiting access to public AI platforms on company devices. Those controls are a good start, but portable AI notetakers circumvent all of those systemic precautions. An employee can record a workplace conversation without installing anything on a company computer or accessing the company network, and later upload the recording through a personal device or account. The employer never sees it happen. Nobody in IT or Compliance knows which tools are being used, what's being captured, where it is being sent, who is processing it, or how long it is being kept. The risks associated with this are significant.

It Is All in the Details

Many workplace conversations occur on a daily basis that include information that should not be disclosed to anyone outside of the organization. Discussions surrounding disciplinary action, workplace complaints, employee medical conditions and related accommodations, business strategy, trade secrets, and customer information. Nonetheless, a portable AI notetaker may capture sensitive information that would never appear in human-made meeting notes.

Unlike a human notetaker capable of exercising judgment regarding potentially sensitive information, an AI notetaker lacks discretion and the ability to discern which pieces of information are appropriate to memorialize, and the employer is not afforded the opportunity to screen the information prior to it being processed by a third-party vendor. This means that AI notetakers may capture private information, employee speculation, discussions based on incomplete information, raise concerns that are later unfounded, or even change a critical perspective as a conversation continues. AI-generated transcripts may nevertheless preserve, reorganize, and present all of those statements as a permanent, searchable, and potentially incomplete record.

How to Protect the Organization

Employers should act swiftly to address the potential risks associated with AI notetakers. There are several measures employers can take to help manage the use of AI notetakers before sensitive information leaves their control.

1. Adopt a Workplace Recording Policy. Employers should consider adopting a workplace recording policy that generally prohibits employees from recording workplace conversations without prior approval and express consent. The policy should set forth the types of conversations that are prohibited from being recorded, even with consent, such as privileged communications and trade secrets.
2. Adopt or Update an AI Workplace Usage Policy. Employers should also adopt or update an AI usage policy that addresses the use of AI by function. The policy should require prior approval of both the tool and the proposed use, and prohibit employees from conducting business through personal AI accounts. The policy also should state when AI notetakers may be used, who may access transcripts, how long records are kept, how employees can raise concerns, and what notices state law requires.
3. Get Informed Consent. Ensure that prior to initiating any recording, everyone implicated has given informed consent and is aware that an AI notetaker will be used, what it records, how it is used, and where the information will go. Give participants a real chance to object, and keep a written record of consent when possible. Do not treat an automated announcement as enough.
4. Keep AI Out of Sensitive Meetings. Do not use AI notetakers in disciplinary meetings, workplace investigations, union investigatory interviews, or conversations involving legal advice. The administrative convenience is not worth the added risk. All such meetings should be organized by the employer and should take place in an employer-approved meeting space or, if virtual, on employer-approved software.
5. Vet Vendors and Address AI Notetakers Before Signing. Review retention, data-sharing, model-training, and security practices, and require clear contractual protections for confidentiality and prompt notice of a data breach. Have an explicit conversation with each vendor about whether AI notetakers will be used on calls and meetings between the parties, and memorialize the answer in the agreement rather than leaving it to practice.
6. Train Managers and HR. The people who schedule or lead meetings need to know when the tool may be used, when it must stay off, and how to follow the company’s policy. In addition, it should be assumed that all difficult conversations will be recorded, such as disciplinary meetings, investigations, or terminations. A transcript or AI-generated summary can be produced in litigation, requested by an agency, or pulled up in an internal audit years later. As a result, training on how to have these conversations will be important. The practical rule for managers and HR is simple: conduct every sensitive conversation as though it is being recorded.
7. Audit Current Use. Find out whether employees are already using AI notetakers without approval and where they find it helpful.
8. Address Employee-Owned Tools. Your policy should identify, by name, the specific AI notetaker devices and applications that are approved for use and those that are prohibited, and should state that any tool not expressly approved is prohibited. The policy should also specify where and when approved personal tools may be used, including in workplace meetings, on client calls, and on company premises, and should require prior written authorization for any other use.

The Bottom Line

AI notetakers can save time, but an unplanned recording can lead to lawsuits, fines, damaged investigations, privilege problems, and exposure of sensitive employee data. The employers that benefit from these tools should set the rules before anyone presses record.

The Porzio Employment Team is available to help employers navigate the evolving liability landscape, develop and refine policies and processes, and ensure compliance as corporate technology continues to advance.