AI Note-Takers: The Security Questions Institutions Should Be Asking

AI-powered meeting assistants and note-taking tools are becoming commonplace. They promise better meeting documentation, automatic action items, and increased productivity. For busy bankers, auditors, and executives, that value proposition is hard to ignore.

Unfortunately, many organizations focus on the wrong question when evaluating these tools:

"Is the AI note-taking tool secure?"

While security is important, it is not the most important question.

The bigger questions are:

1. What information are you allowing the tool to access?
2. Where does that information go?
3. How long is it retained?
4. Who can access it?
5. Has the institution consciously approved that risk?

An AI note-taker does far more than create meeting minutes. Depending on the product and configuration, it may record conversations, generate transcripts, create summaries, store recordings in the vendor's environment, share information among participants, and retain data for extended periods. Industry guidance and legal analyses continue to highlight concerns around data retention, third-party processing, consent, and the creation of permanent records of sensitive discussions. [polsinelli.com], [natlawreview.com]

For community banks and credit unions, the risks extend beyond cybersecurity. Sensitive customer information, confidential business discussions, compliance matters, vendor negotiations, employee information, and strategic initiatives may all become part of the tool's data footprint.

Rather than asking whether a vendor has encryption or a SOC report, institutions should adopt a structured risk-based approach.

A Practical Framework for Evaluating AI Note-Takers

Before approving an AI note-taking solution, evaluate:

1. Data Collected

• What information is captured?
• Audio only, or audio plus chat, files, calendars, and meeting metadata?
• Could customer or non-public information be included?
  

• Where is the data stored?
• In your Microsoft 365 tenant or in the vendor's cloud?
• What jurisdictions are involved?

• How long are recordings and transcripts retained?
• Can retention be customized?
• Is deletion verifiable?

• Is your data used to train AI models?
• Are transcripts used to improve the service?
• Can data-sharing be disabled?

• Which additional vendors may access or process the information?
• Are subprocessors disclosed and contractually governed?

• Who can view transcripts and recordings?
• Is multifactor authentication supported?
• Are access permissions integrated with organizational controls?

• Are participants notified that recording or transcription is occurring?
• Are applicable consent and privacy requirements satisfied?

• Has the solution been reviewed through the institution's vendor third-party risk management program?
• Are security, privacy, business continuity, and contractual requirements addressed?

• Does the use case align with GLBA, privacy obligations, record retention requirements, and other applicable regulations?
• Could the transcripts become discoverable records?

• What information is prohibited from being discussed or captured?
  
• Has management formally approved the use case and associated risks?

Final Thought

AI note-takers can provide significant value. In fact, many organizations are finding them useful for improving meeting accuracy, capturing action items, and reducing administrative burden. However, convenience should not be mistaken for governance.

A secure product can still create unacceptable risk if it is collecting the wrong data, retaining it indefinitely, sharing it with third parties, or operating outside established institutional controls.

The goal is not simply to determine whether the tool is secure. The goal is to determine whether the institution understands, accepts, and governs the risk created by the information the tool is allowed to access.

That is the question regulators, auditors, boards, and customers will ultimately expect us to answer. Bedel Security's AI Risk Management & Oversight Program can help answer these questions. Our program can assist community banks and credit unions by establishing clear AI governance, defining acceptable risk, and creating a repeatable process for evaluating and overseeing AI use.