Skip to main content

ai governance

the people who didn't get a setting

software that listens at work is switched on by one person, and it leaves a record that everyone else in the room has to live with. in a drug company, that record can carry a reporting duty. the rules for it have to be written down, because no settings screen will write them.

picture a field rep's call with a doctor, with an ai note-taker running. halfway through, the doctor mentions a side effect a patient had. the call ends. the summary lands in a company inbox before anyone has closed the tab, and nobody reads it that day.

drug companies already have a rule for this moment. anyone who hears about a side effect reports it to drug safety, fast. the rep heard it, so in the ordinary case the clock is already running. the note-taker changes 2 things. it catches what the rep missed, and it leaves a written copy in a company system whether anyone reads it or not.

why the written copy matters

for a serious, unexpected side effect from a marketed drug, the fda gives a company 15 calendar days to report it. the clock starts when the company first receives the information, from any source1.

if the rep reports it, fine. if the rep was half watching the notes and never files, the summary is now the company's own written proof that it knew, sitting unread past the deadline. and on a call with no company staff on the line, like some market research interviews, the summary may be the only place the side effect was captured at all. the fda rule was written long before anyone had an ai note-taker, so how it applies is a call for your drug safety team: who owns the tool, whose inbox the summary lands in, and who is expected to read it. we'd want that call made before a summary forces it.

the doctor on that call is the other half of the problem. many drug companies already ask a doctor's consent before a call is recorded. a note-taker that one person adds on their own can skip that step. and that half of the problem is spreading well beyond drug companies.

what else switched on

between august and september 2026, xai, meta and openai each shipped assistants that sign into your apps and keep working in the background: grok bot, muse and dots2. in the same stretch, apple watch series 12 got a feature apple says "ambiently takes notes on your conversations throughout your day," once the wearer turns it on3.

a test we use on all of these tools. if a new contractor asked on day one to sit in every meeting and keep notes on every conversation, would your security team say yes? we'd expect a no. software often gets the same access with far less scrutiny, because turning it on is a setting someone clicks.

one person opted in

the watch makes the problem easy to see. the person wearing it opted in. the people across the table didn't get a setting. apple's support page doesn't describe any signal to the people nearby while it takes notes. it asks the wearer to be mindful of private or sensitive conversations around them3.

apple says no audio is recorded or stored, and the summaries delete themselves after 7 days unless the wearer saves them3. that answers where the data goes. it does nothing for the colleague across the table, who never chose to be summarized.

the same gap shows up on an ordinary video call. one person's note-taker joins first, and everyone else is now in its summary.

what it does to the room

this part is our own observation, not a study. on our calls with a note-taker running, people prep less, because the summary will cover it. and they think out loud less, because a half-formed idea now has a transcript.

the rule a settings screen can't write

before one of these goes on a laptop, a calendar or a wrist, write down 3 things. what it can see. what it can send, and to where. and who can turn it off. if nobody can answer the third one, it isn't ready.

then make it visible to the people who didn't choose it. when a note-taker or a watch will be listening, say so in the invite, so anyone on the call can ask for it off before it starts.

in a drug company, hold one more meeting. drug safety, compliance, your it team and whoever runs calls with doctors, in one room, deciding 3 things: whether note-takers run on those calls at all, who reads every summary the same day, and how anything that mentions a side effect reaches drug safety. write the answers down and send them to everyone who runs those calls.

sources

  1. 1us code of federal regulations, 21 cfr 314.80, postmarketing reporting of adverse drug experiences. 314.80(b) requires the applicant to review adverse drug experience information "obtained or otherwise received by the applicant from any source"; 314.80(c)(1)(i) requires serious and unexpected adverse drug experiences to be reported "no later than 15 calendar days from initial receipt of the information by the applicant." whether an unread ai-generated summary constitutes receipt is not addressed by the rule and is a determination for a company's own drug safety function.
  2. 2launch coverage, august to september 2026: meta, "introducing muse," september 8, 2026 (an agent that opens a browser, fills in forms and books things for you); openai's dots, always-on agents across connected apps, reported by al jazeera and nbc news, late september 2026; xai, "introducing grok bot," august 11, 2026 (always-on agents with their own computer that sign into the tools you already use and keep working 24/7; x.ai/news/introducing-grok-bot, checked 2026-10-13).
  3. 3apple support, "about audio intelligence features on apple watch series 12 and apple watch ultra 4" (support.apple.com/148354), september 2026. describes siri recap as ambiently taking notes on conversations once the wearer turns it on; audio is not recorded or stored; summaries auto-delete after 7 days unless saved; asks users to be mindful of private or sensitive conversations around them. the page describes an audible chime for a different feature, live rewind, and no equivalent signal for siri recap.