Your Meeting Assistant Is a Data Processor
The notetaker in the corner of your call is not a convenience feature. It is an outsourced processing arrangement you never took to the board.
The notetaker in the corner of your call is not a convenience feature. It is an outsourced processing arrangement you never took to the board.
An AI notetaker joined your last client call. It recorded the conversation, transcribed it, summarised it and stored it somewhere. Nobody classified the data, approved the vendor, or decided how long the voice recording is kept.
Meeting assistants arrived in Jersey firms the way most consumer AI arrives: quietly, one calendar invite at a time. Somebody enabled a transcription tool because it saved them writing up actions. It worked. It spread. Within a quarter it is sitting in half the firm's external meetings, and no single person can tell you where the recordings live, who the sub-processor is, or whether client-call content is being used to improve a model.
That is not a productivity story. It is an outsourcing arrangement that entered the firm without going through any of the controls a firm would normally apply to an outsourcing arrangement. The tool is doing exactly what its name promises. The problem is that everything it does is regulated activity dressed up as a convenience.
A transcription tool is a data-processing decision
The moment a tool records a call, transcribes it and stores the output, it has become a data processor acting on your firm's behalf. It ingests personal data — often special-category detail about clients' circumstances — and it produces a new record that did not previously exist. The JFSC's guidance treats the use of a third-party AI service as squarely within the firm's existing Outsourcing Policy: material dependency, supplier due diligence, contractual oversight, awareness of sub-contractors, and a fallback or exit plan. A meeting assistant meets every one of those triggers, and most firms have applied none of them.
The pattern I return to is this: when a firm evaluates a notetaker, the conversation almost always starts and stops at transcription quality. Is it accurate? Does it catch names? Can it summarise actions? Those are the wrong opening questions. The questions that determine risk are the ones about what happens to the recording after the meeting ends — where it is stored, in which jurisdiction, who can retrieve it, how long the voice data is retained, what security certifications the vendor holds, and whether the content of a client call can be fed back into a large language model as training data.
A meeting assistant is not a productivity add-on. It is a processing route for some of the most sensitive conversations the firm has — and it needs to be governed as one.
The AI register was built for exactly this
The JFSC guidance asks firms to maintain an AI use-case register recording what the AI is used for, the type of AI in plain terms, the main data inputs, who is responsible for oversight, and the risk or impact classification. A meeting assistant is a textbook register entry, and the exercise of writing that entry surfaces the whole problem: the moment you have to name the oversight owner and the data inputs, you discover nobody owns it and the inputs include everything anyone has ever said on a recorded call.
Classifying it against the guidance's Materiality Ladder is instructive. On volume and reach a firm-wide notetaker is not a narrow, low-impact tool — it touches client-facing conversations, financial-crime discussions and privileged internal deliberations. Data sensitivity alone pushes it up the ladder. That does not mean banning it. It means the tool earns formal internal approval, a documented risk assessment, defined retention, and a named owner — the medium-impact response the guidance describes, not the silence it currently receives.
Table 1 turns the register requirement into the specific questions a Jersey firm should answer before a notetaker is allowed into an external meeting.
Table 1 — Meeting-assistant governance: the register entry that must exist before the tool is used
| Register field | The question it forces | Why it matters in regulated FS |
|---|---|---|
| Purpose and scope | Which meetings — internal only, or client and counterparty calls? | Scope determines data sensitivity and whether disclosure to third parties is needed. |
| Data inputs | Voice, transcript, participant identity, shared screens, chat? | Each input is personal data; voice is biometric-adjacent and often over-retained. |
| Storage and jurisdiction | Where is the recording held, and does it leave the island? | Cross-border transfer rules and lawful basis apply the moment data moves. |
| Model use | Can call content be used to train or improve the vendor's model? | Client content feeding an LLM is a data-protection and confidentiality breach waiting to be found. |
| Retention and deletion | How long is the audio kept, and can it be deleted on request? | Records obligations and DSAR/erasure rights both depend on a defined lifecycle. |
| Oversight owner | Who is accountable for this tool's outputs and errors? | Accountability cannot sit with 'whoever enabled it'; the guidance requires a named person. |
Consent is not a checkbox — it is a control
When a machine records a client, the client has a right to know. The guidance is explicit that customers should be told when they are interacting with, or being materially affected by, AI, and that firms must not create opaque processes people cannot understand or challenge. A silent notetaker on a client call is the opposite of that principle. The fix is not complicated, but it has to be designed: a standing disclosure at the start of recorded external meetings, a documented lawful basis, and a route for a participant to decline.
In my experience the consent step is where the convenience narrative breaks down most usefully. Once a firm has to say out loud, at the start of every client call, that an AI is recording and processing the conversation, it starts asking whether it actually wants that recording to exist — and for how long, and who should ever be able to listen to it again. That is the right conversation. It just needs to happen before the tool is deployed, not after a client asks where the recording of their divorce-related trust discussion is being kept.
The recording you made is now the record you must produce
There is a second-order consequence that firms rarely price in. A transcript is a record. Once it exists, it is discoverable, it is subject to data-subject access requests, and it may become evidence. A tool adopted to save fifteen minutes of write-up has quietly created a permanent, searchable archive of everything said on every call — including the offhand remark, the half-formed view, the internal disagreement that would never have made it into formal minutes.
That is not an argument against notetakers. It is an argument for deciding, deliberately, what the firm wants to retain and what it does not. The auditability the guidance asks for cuts both ways: you need enough record to evidence and challenge decisions, and not so much uncontrolled record that you have manufactured a liability. A meeting assistant with no retention policy has made that decision for you, in the direction of keeping everything forever, in a location you may not control.
What good looks like
A firm that has this right can answer five questions without hesitation. Which meeting-assistant tools are approved, and which are prohibited? Where is the data stored, and does it stay within an acceptable jurisdiction? Is client-call content contractually excluded from model training? How long are recordings and transcripts kept, and how are they deleted? And who is the named owner accountable for the tool's outputs?
None of that requires banning a genuinely useful class of tool. It requires treating it as what it is. The most common governance failure I see is not a firm that adopted a dangerous tool. It is a firm that adopted an ordinary tool and never noticed it had taken on a processing relationship — because it arrived through a calendar invite rather than a procurement process.
If a client asked today where the recording of your last call with them is stored, how long you will keep it, and whether its content trains someone else's model — could anyone in your firm answer?
Next: what a supplier transition really tests — Vendor Exit Is a Data-Governance Test.
Sources: JFSC, Guidance on the use of AI in Jersey's financial services sector (2026) — Principles 1, 2, 4 and 5, the AI register fields, the Materiality Ladder, and the outsourcing/third-party requirements; Government of Jersey et al., Jersey AI Playbook (2026).
Professional disclaimer: The views expressed are my own and are shared for general informational purposes. This content is intentionally non-confidential and does not include proprietary, client-specific, or employer-sensitive information. It is not legal, regulatory, investment, or professional advice; readers should seek appropriate advice for their circumstances.
Financial services leader (20+ years) | Lean Six Sigma Green Belt | London School of Economics (LSE) AI Leadership Accelerator
See where your firm stands
The free diagnostic scores your firm across the twelve operating-model instruments in about eight minutes.
Take the diagnostic →A version of this article was first published on LinkedIn as part of the Sequence body of work. This is the canonical version.
The views expressed are the author's own and shared for general information. This content is intentionally non-confidential and does not include proprietary, client-specific or employer-sensitive information. It is not legal, regulatory, investment or professional advice. © 2026 Paul Soares. Sequence is the trading name of Sequence Advisory Limited (in formation) · hello@sequenceadvisory.com