Is Someone Recording? Managing The Workplace Risks Of Portable AI Notetakers

AI notetakers illustrate how artificial intelligence is fundamentally changing how people work. For example, there are now “AI Assistants” that snap onto the back of cell phones like a wireless battery pack. Instead of taking detailed notes during a meeting, preparing a summary, and identifying follow-up items, employees can use an AI notetaker to complete these tasks almost instantly. These tools can reduce administrative burdens, improve follow-up, and allow employees to focus on a conversation rather than on taking notes. An assistant, wrapped in a small, inconspicuous package.

Until recently, many AI notetakers were relatively easy to identify. A virtual notetaker, for example, might appear as a participant in a videoconference, which gives the meeting organizer and other attendees an opportunity to approve its use or remove it from the meeting. Organizations could also restrict which applications employees installed on company devices or connected to company systems.

But what if the AI notetaker does not appear on the meeting’s participant list? What if it is already sitting on the conference-room table, or in an employee’s pocket?

1. What are Portable AI Notetakers?

Portable AI notetakers can record in-person conversations and telephone calls, store recordings while offline, and later synchronize the recordings to generate searchable transcripts, summaries, action items, and other AI-enabled content. Some are small enough to fit in a pocket or attach to a cell phone. As a result, an AI notetaker no longer needs to join a virtual meeting, operate on an organization’s network, or be installed on an organization-issued computer. An employee-controlled device may be able to record a conference-room discussion, interview, telephone call, or informal workplace conversation and later send that information to a third-party AI service without the organization’s knowledge.

While portable AI notetakers may provide meaningful benefits, they can also expose organizations to significant privacy, security, employment, and litigation risks.

2. What Notice and Consent Issues Can Portable AI Notetakers Create?

Federal and state laws may restrict the recording of telephone calls and other communications. In most states, the consent of one party to the conversation is sufficient. Other states generally require the consent of all parties. The analysis can become particularly complicated when participants are located in different states or countries. Additionally, portable devices expand the settings where the issue may arise, including job interviews, customer calls, workplace investigations, accommodation meetings, and conversations involving patients or visitors.

Even when participants consent to being recorded, that consent alone may not authorize the recording and associated information to be shared with a third-party AI vendor. Participants may not understand that the service will receive their voices and statements and use that information to create a transcript, identify speakers, summarize the discussion, and generate additional records.

3.  How Can Portable AI Notetakers Circumvent Existing Security Controls?

Many organizations have implemented controls to prevent employees from using unapproved AI tools on their systems. An organization might block AI meeting bots, restrict browser extensions, prevent software installations, or limit access to public AI platforms from company devices.

Portable AI recorders can bypass these controls. An employee may be able to record a workplace conversation without installing software on an organization’s computer or connecting the recorder to its network, then upload the recording through a personal device or account. This is a practice known as “shadow AI”: technology used without organizational approval or oversight. The organization may not know which tools are being used, what information is collected, where it is sent, which third parties process it, or how long it is retained.

4. What Conversations are at Risk of Exposure?

Workplace conversations frequently include information that should not be disclosed outside the organization. A discussion may concern an employee’s medical condition, a workplace complaint, customer or patient data, business strategy, or trade secrets. A portable recorder may capture incidental information that would never appear in formal meeting notes, such as an employee discussing a family member’s health, a trip to a place of worship, or another personal matter unrelated to the purpose of the meeting.

Outside the workplace, there may also be discussions with customers, auditors, government regulators, legal counsel, or other unsuspecting parties containing sensitive or privileged information. These third parties may have their own confidentiality expectations or legal protections that an undisclosed recording could undermine.

An AI recorder captures what participants say, not just what the organization ultimately determines should be memorialized. Participants may speculate, discuss incomplete information, raise concerns that are later determined to be unfounded, or change their views as a discussion progresses. An AI-generated summary may nevertheless preserve, reorganize, and present those statements as a searchable (and perhaps incomplete) record.

5. Why Does an AI Vendor’s Privacy and Security Matter?

When an employee uses an unapproved AI notetaker, the organization loses the opportunity to evaluate whether the vendor’s privacy, security, and contractual protections are appropriate for the organization’s intended use. Marketing statements or general compliance representations may not establish which specific AI services are covered, which third parties process the information, where the information is stored, or whether the vendor will accept appropriate contractual obligations.

Before approving an AI notetaker, an organization should understand what the service collects and how that information travels through the vendor’s systems. That review should account not only for the audio recording, but also for transcripts, summaries, prompts, speaker labels, voice data, integrations, and other information generated from the conversation.

6. What Policies, Approval Processes, and Training Should Organizations Implement?

Organizations should not wait until they discover an unauthorized recording to address these risks. There are several measures organizations can take to help manage the use of portable AI notetakers before sensitive information leaves their control.

• Adopt a Workplace Recording Policy: Organizations should consider adopting a workplace recording policy that generally prohibits employees from recording workplace conversations without (1) prior organizational approval and (2) the knowledge and express consent of all participants. The policy should apply broadly to audio and video recordings made through electronic devices, including personal devices. It should also identify categories of conversations that may not be recorded even with consent, such as discussions involving trade secrets, personally identifiable information, or privileged communications. However, organizations must be careful to ensure that any recording policy does not restrict employee activity protected by applicable labor and employment laws.
• Implement an AI Workplace Usage Policy: Organizations should also adopt or update an AI workplace usage policy that addresses AI tools by function, not merely by brand name or software format. The policy should require approval of both the specific tool and the proposed use, prohibit employees from conducting organization business through personal AI accounts or unapproved devices, and make clear that information submitted to an AI service should be treated as a disclosure to a third party. Approved tools and permitted purposes should be identified, while uses involving confidential information, employment decisions, regulated data, or other higher-risk activities should require additional review.
• Establish an Approval and Vendor-Review Process: An approval process should evaluate the particular tool, the proposed use, the people whose conversations may be recorded, and the categories of information likely to be captured. Approval for routine internal meetings should not automatically authorize recording workplace investigations, accommodation discussions, privileged communications, patient interactions, or customer calls. Organizations should also decide who has authority to approve a tool and who may require recording to stop.
• Employee Training: While written policies and procedures are critical, they will have limited value if employees do not understand what AI tools are permitted or prohibited. Training should explain the risks of portable AI notetakers, the organization’s approval process, when notice and consent are required, and which conversations may not be recorded. Managers, human resources personnel, and meeting leaders should also know how to respond when they identify an unauthorized recording device or learn that a workplace conversation has been recorded.

AI notetakers can provide significant value and convenience. As portable AI notetakers become more common, organizations should ensure that their policies and procedures account for these devices. Organizations that focus only on the AI bot in the virtual waiting room may miss the recorder already sitting on the conference-room table. Policies, diligence, and training should address not only who joins the meeting, but also which devices are listening, where the resulting information goes, and what happens to it next.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.