Here's a detail that most advisory firms overlook when adopting generic AI meeting tools: where does the data go?
The majority of AI notetaking tools are built by US companies, hosted on US infrastructure, and process audio through US-based AI models. When a client discusses their pension arrangements, inheritance tax position, health conditions, or family financial circumstances in a recorded meeting, that conversation is being processed on servers outside the UK.
For an FCA-regulated firm, this raises real governance questions:
- •Does your data processing agreement cover international transfers?
- •Is the processing compliant with UK GDPR, including appropriate safeguards for cross-border data flows?
- •Can you demonstrate to the regulator exactly where client conversation data is stored and processed?
- •Does your firm's DPIA account for this processing activity?
These aren't theoretical concerns. Under Consumer Duty, firms are expected to exercise greater diligence over their supply chain and the third-party tools they use in client-facing processes. A compliance officer reviewing your technology stack is going to ask these questions.
What matters is that your provider can answer them. A documented Data Processing Agreement, a published sub-processor list, appropriate Chapter V safeguards for any transfer outside the UK, and a contractual commitment never to train models on your client data are what turn this from an open risk into a controlled one. For regulated firms handling sensitive client financial data, that documentation is a governance requirement that generic tools simply don't prioritise.