Every meeting is now recorded and transcribed by an Artificial Intelligence (AI) notetaker, but nobody knows where the files reside or who has copied them.
In August 2026, Dark Reading discovered a vulnerability in tl;dv’s backend. It allowed an authenticated user to access meeting information belonging to other customers. The vulnerability put more than 180,000 meeting records across 80,000 or more users at risk. Moreover, this vulnerability highlights a risk that could affect companies using any of the more than 100 different notetakers on today’s market.
Risks extend beyond a breach of the notetaker’s platform
From Fireflies to Otter to Granola, these apps have entered businesses faster than the governance required to manage them. According to Kolmogorov Law, one in three people in the United States uses an AI notetaker, and more than 65% have said they did not offer consent. Although this technology raises privacy concerns, it also creates an increasingly pervasive level of risk.
AI notetakers open unexpected doors within businesses. First, they create confidentiality risks, particularly when participants have not approved a meeting recording. They also introduce the possibility of data leaks and breaches. Every recorded meeting creates a trail of data.
If this information falls into the wrong hands, it could result in a breach of South Africa’s Protection of Personal Information Act (POPIA). It could also give cybercriminals access to information they could exploit to compromise the business. At board level, the exposure becomes even greater. Transcripts and AI-generated minutes can enter legal proceedings or reach unauthorised recipients. Furthermore, the risk extends beyond a breach of the notetaker’s platform. Disgruntled employees or internal threat actors could also access and share the data.
According to the Harvard Law School Forum on Corporate Governance, these tools have “matured quickly”. However, their convenience and accessibility can turn “candid boardroom discussions into a lasting governance record”.
The AI notetaker creates a permanent record
The problem is that the notetaker has become as much a part of the average meeting as pen and paper once were. However, the two serve different purposes. Traditionally, a minute-taker produced a summary that someone could review and approve. By contrast, the AI notetaker produces a searchable, permanent, word-for-word record of everything said. This includes comments that nobody would have chosen to document.
Such records could capture a pricing tactic or a campaign discussed before launch. This information could put a company’s reputation at risk. In more serious cases, it could affect a merger or a critical sale.
Once a recording exists, anyone who attended the call can copy it, forward it, or lose it. Meanwhile, the business may lack an audit trail to establish where the information has gone or who has received it. Consider what might happen if a C-suite executive left the company to join another firm. The former executive could take the recordings along and use their insights and data in the new role. They could even steal a proprietary idea. This represents one side of the AI notetaker coin. The other concerns the platform itself.
Most notetakers store transcripts centrally and feed them into other systems by default. Consequently, a file created for one meeting may become searchable by people who never attended it.
Why banning AI notetakers is not the answer
Banning notetakers is not the solution. These tools have become useful and reliable commodities. They help teams track calls, information, insights and tasks with relative ease. They also offer substantial benefits, even as they introduce security risks. Instead of banning them, companies need to apply discipline to their use and introduce additional security measures, such as password protection and encryption.
Companies must deliberately decide where to store sensitive files and who can access them. This distinction is crucial because many organisations make no equivalent decisions about transcripts, even though these records can contain more information than a single report.
Establish clear controls for recording and access
The goal is to manage recordings as carefully as the meetings themselves. Before a meeting starts, decide who may keep a copy, where the recording will be stored, how long the file will remain available, and who may access it afterwards.
Companies must treat AI notetakers as controlled data-processing systems. This requires an approved tool policy, clear meeting classifications and defined consent procedures. Meeting classifications should specify which discussions may or may not be recorded. Companies must also establish clear processes for obtaining consent and ensuring visibility. In addition, they should conduct due diligence on vendors before adopting their platforms.
Organisations should manage these tools through well-defined configuration standards. These standards should include workspace-level controls for recording permissions and multi-factor authentication.
Make security part of everyday practice
Protecting data is essential, particularly as regulatory requirements tighten and cybercrime becomes more challenging. Companies must also recognise a key distinction: what a provider offers through its notetaker system and how the business configures and enforces its use are not the same thing.
Businesses do not have to abandon these tools. Instead, they must enforce clear policies and establish rules for recording, retention, and access. By managing the AI notetaker through consistent governance and security controls, organisations can retain its benefits while minimising risk.
Richard Frost | Head | Technology Solutions & Consulting | Armata | mail me |
