The Hidden Risks of AI Note-taking

Artificial intelligence (AI)-powered meeting assistants and automated note-taking tools are a growing part of daily business operations. While these technologies offer efficiencies, they also raise important considerations around privacy, privilege, confidentiality, compliance, and litigation risk. 

In this webinar, Employment Practice Member Jennifer Rubin and Associate Emma Follansbee discuss how organizations can use AI notetakers more responsibly in workplace meetings and the boardroom.  

Key takeaways include: 

• The distinction between enterprise platforms and third-party tools is critical. Enterprise versions are generally configured within an organization’s security infrastructure and may include protections that prevent company data from being used to train GenAI models. Third-party tools connected to personal accounts may operate under separate terms of service and store meeting information on external servers. 
• Organizations should determine which consent and privacy laws apply where their employees are located. Although federal law generally permits recording when one party consents, some states, including California and Massachusetts, require all-party consent. Voice recognition may also be considered biometric data, depending on the tool and how it captures and transcribes information. 
• AI-generated meeting records can increase discovery and litigation exposure. Transcripts and summaries create records that may be subject to preservation requirements, litigation holds, discovery, production, and privilege review. They may also be inaccurate, take statements out of context, or capture comments that participants did not expect to become part of the meeting record. 
• AI notetakers should generally be disabled during privileged and other sensitive conversations. Using a public or third-party platform during discussions with counsel may put attorney-client privilege at risk. Organizations should also consider restricting these tools during sensitive human resources discussions, workplace investigations, executive sessions, and board meetings involving confidential or proprietary information. 
• Policies, training, vendor oversight, and recordkeeping practices can help limit risk. Organizations should identify the tools being used, review vendor contracts, establish consent practices, and address AI-generated records in their data retention policies. If a participant withdraws consent, the recording should stop, with manual note-taking available as an alternative. 

Subscribe To Viewpoints