Worked example: the meeting notes that became evidence

A mid-sized insurer licenses a collaboration suite. In March the vendor enables automatic meeting transcription and summarisation for all tenants on the current release channel. The change appears in a release note. No ticket is raised. By June, roughly four hundred staff have recordings, transcripts and generated summaries of their meetings stored in the tenant.

What happened, step by step

The feature switched on. The insurer became a deployer of an AI system that day, because staff used it under the insurer's authority in the course of professional activity. Nobody decided to; the duty does not care.

The output began to be trusted. Within weeks, summaries were being pasted into follow-up emails. The generated action items were treated as the record of what was agreed. This is the shift that matters. A convenience became the source of truth, and nobody reviewed the decision, because nobody experienced it as a decision.

A dispute arrived. A broker claimed a commission arrangement had been agreed in a call. The insurer went to the transcript. The summary said one thing; the transcript, read in full, said something materially softer. The summary had compressed a conditional statement into a commitment.

Walking the duties

Is it an AI system? Yes. It infers: it produces a summary nobody wrote a rule for, and the same meeting summarised twice does not produce identical text.

Is it high-risk? On these facts, no. Meeting notes are not an Annex III use. But note how close the edge is. If the same summaries were used as an input to performance management, the use would sit in employment and worker management, which is listed in Annex III. Nothing about the tool would change. The classification hangs on what the output feeds, which is exactly why the register records the decision the output feeds and not just the tool.

What applies anyway? A good deal. The transcripts are personal data about identifiable employees and, in some meetings, about customers and their health. The Article 6 revFADP principles apply, proportionality and purpose limitation in particular: recording every meeting by default to provide a convenience is hard to argue as proportionate. Article 19 requires people to be told on collection who is processing, for what purpose, and, where the data goes abroad, to which state under which safeguard. If meeting participants were never told, that duty was missed in March.

What about the participants outside the organisation? Brokers and customers joining a call are not covered by an internal notice nobody sent them.

The part that is not a legal question

The dispute did not turn on compliance. It turned on a team treating generated text as a record. A summary is an inference about what was said. It is produced by the same process that produced the transcript's confident-sounding paraphrase, and it has no privileged access to what anyone meant. Used as a memory aid, it is useful. Used as evidence, it is a fabrication risk with a timestamp on it.

What good looked like, in hindsight

The insurer's corrective actions were unglamorous and cheap. Transcription was moved from default-on to opt-in per meeting. Participants, internal and external, are told at the start of a call that a recording and a generated summary are being produced. Generated summaries carry a standing line stating that they are machine-generated and that the transcript governs. Summaries were removed from the evidence chain for anything contractual. The feature went on the register with the entry naming the decision it feeds, which is "none, by policy".

The last one is the item people skip. An inventory entry that records a deliberate limit is worth more than one that records a tool name, because the limit is the control.

What this example is meant to fix

The failure was not the model. The summary was a reasonable summary. The failure was that a system entered the organisation without anyone deciding what its output was allowed to be used for, and the answer defaulted to "anything".

As of 24 September 2026.