The AI notetaker you can't see in the participant list

For about three years, the governance question around AI meeting assistants had a convenient property: you could see them.

The tool joined the call as a named participant. It appeared in the attendee list. Everyone in the meeting had at least the theoretical opportunity to object, and a security team reviewing an incident could reconstruct which meetings had been recorded by looking at who else was in them.

That property is disappearing, and most acceptable-use policies have not caught up.

A growing category of meeting assistants captures audio directly from the device or through native platform APIs. No bot joins. Nothing appears in the participant list. The vendors are explicit about this in their marketing, because from the buyer's perspective it removes friction: no awkward bot icon, no colleague asking what that account is, no need to explain anything to the client on the other end of the call.

From a security perspective it removes something else. Visibility.

Shadow AI has a specific shape here

Unauthorised AI tooling is a familiar problem by now, and meeting assistants are among its more consequential expressions, because the data involved is unusually rich.

A transcript is not a document that happened to be uploaded somewhere. It is the unfiltered contents of a conversation, including the parts nobody would have committed to writing: the candid assessment of a partner, the unannounced restructuring, the number before it was approved, the client's actual position rather than their stated one.

Sensitive material tends to arrive in meetings first and in documents later, which means transcripts frequently contain the most sensitive version of information the organisation holds. And they are being generated on personal accounts, under consumer terms of service, by employees who are solving a real problem and are not doing anything they understand to be risky.

The awkward part for security teams is that the employees are right about the problem. Manual note-taking during a call is genuinely bad. Refusing the category outright produces exactly the shadow adoption it was meant to prevent.

The permission grant is usually worse than the recording

Most reviews of these tools focus on where the audio goes. The larger exposure is frequently the OAuth scope requested at signup.

A meeting assistant that offers to join calls automatically needs calendar access to do it. What gets granted, often in a single click by an employee who is trying to get to a meeting on time, is standing read access to the entire calendar: every invitation, every attendee list, every meeting title, indefinitely.

Consider what a calendar discloses on its own, with no audio involved. Which counsel the company is retaining. Which acquisition targets are taking meetings. Which employees are having recurring one-to-ones with HR. Which customers scheduled an unusual number of calls this month.

Several tools then default to joining all future meetings. The employee approved one recording. The grant covers every meeting they will ever be invited to, including the ones they are not the appropriate person to be recording.

This is a straightforward access-review problem and it responds to straightforward controls: enumerate third-party OAuth grants across the tenant, look specifically for calendar and drive scopes attached to consumer AI products, and revoke on a schedule rather than on discovery.

Where the transcript lives, and who else reads it

Three questions determine most of the residual risk, and consumer-tier products frequently answer all three unfavourably.

Is the content used for model training? Consumer terms commonly permit it. Enterprise agreements commonly prohibit it. The difference is contractual rather than technical, which means it is invisible to any inspection of the product itself and can only be established by reading what was signed.

Who at the vendor can access it? Encryption at rest is close to universal and says less than it appears to. The operative question is whether vendor personnel can read plaintext transcripts, under what process, and whether that access is logged in a way a customer can audit.

Where does it sit geographically? For organisations with data residency obligations, a transcript of a European meeting stored in a jurisdiction that does not satisfy those obligations is a compliance finding regardless of how well it is encrypted.

Vendors differ substantially in how much of this they publish. Vomo.ai, for example, documents encryption in transit and at rest, GDPR compliance, no sharing of user data with third parties, and user-initiated deletion. That is the right category of disclosure to look for. It is also, for any vendor, the start of a review rather than the conclusion of one. Certifications, subprocessor lists, training-use terms and breach notification commitments still have to be requested and read, and a security team that accepts a marketing page as evidence has not performed a review.

Retention is the control that never gets written down

Most organisations have a retention schedule. Very few have amended it to cover recordings, machine transcripts and AI-generated summaries, which means those artefacts default to indefinite.

An indefinite archive of every meeting is a liability that compounds. It grows continuously, it is disproportionately attractive to an attacker relative to its size, and it guarantees that any future litigation hold or regulatory request captures material the organisation had no business retaining.

A rolling retention window, commonly proposed at around 90 days, with documented exceptions for meetings that genuinely need preserving, is a substantially better default than an archive that grows with every calendar invitation for years. Practitioner guidance has converged on roughly this position.

Two implementation details matter more than the number. Deletion has to be real, including in backups, which is worth confirming with the vendor in writing. And the categories have to be added explicitly to legal-hold tooling, because a hold that covers email and documents but not transcripts produces exactly the inconsistent preservation that creates spoliation exposure.

The privilege problem is not theoretical

For regulated sectors and anyone handling legal matters, there is a sharper version of this.

Major firms have been flagging it for some time. Analysis from White & Case on the governance risks of AI meeting tools sets out how the proliferation of recordings, machine transcripts and AI summaries alongside conventional minutes creates inconsistent records and preservation exposure. Work from Duane Morris on privacy, privilege and ethical pitfalls addresses the more specific risk that routing privileged discussion through a third-party processor under permissive terms can bear on whether that privilege holds.

The practical control is unglamorous and effective: designate meeting categories where automated capture is prohibited, and make that prohibition technical rather than advisory where the platform allows it. Counsel calls, incident response bridges, HR investigations, and anything under an active hold.

Advisory-only controls fail here for the ordinary reason. The person who most needs to remember not to record is the person under the most pressure at the time.

Finding what is already running

Before approving anything, establish what is in the environment, because the answer is rarely zero and the exercise usually reframes the policy discussion.

The OAuth grant inventory in the identity provider is the highest-yield place to start. Filter third-party applications by calendar and drive scopes and the meeting assistants surface quickly, along with the count of users who have authorised each one. That number is the useful part. A tool with three users is a conversation. A tool with ninety is a procurement decision that has already been made without you.

Expense reports are the second source and they catch what identity logs miss, specifically the personal-card subscriptions that never touched corporate SSO. Search reimbursements for the category rather than for vendor names, since the names change faster than any blocklist.

Network telemetry helps less than expected for the bot-less tools, which is the point of them, though egress to vendor API endpoints during scheduled meeting windows is still a reasonable detection to build.

Then the least technical and most reliable method: ask. A short survey that leads with wanting to approve something rather than with an accusation returns a surprisingly complete picture, because most of these deployments were never intended to be covert. They were intended to save someone forty minutes.

Seven questions before approval

A review of any meeting assistant should produce written answers to the following. If a vendor cannot answer them, that is itself the answer.

1. Does it join visibly, and can visible joining be enforced at the tenant level?
2. What OAuth scopes are requested, and is calendar access required for the functionality actually being bought?
3. Are transcripts used for model training under the agreement being signed, as opposed to the consumer terms?
4. Which vendor personnel can access plaintext, under what process, and is that access auditable?
5. What is the data residency, and does it survive the vendor's use of subprocessors?
6. What certifications exist, current and independently issued, rather than described?
7. What does deletion actually delete, on what timeline, including backups?

Answering these takes an afternoon. Not answering them takes considerably longer, later, in a different format.

The uncomfortable part

Security teams will not win this one by prohibition. The productivity gain from automated meeting notes is real, employees have already discovered it, and the tools that are hardest to detect are precisely the ones marketed on being frictionless.

The workable position is to approve something. Pick a vendor whose terms survive a reading, configure retention deliberately, enumerate the OAuth grants that already exist across the tenant, and give people an approved option that is good enough that the unapproved one stops being attractive.

The alternative is not an organisation without AI transcripts. It is an organisation with AI transcripts nobody can find.