AI note-taking apps: What every Australian defence supplier should know before hitting 'Record'

AI note-taking applications can save hours by automatically recording meetings, generating transcripts and creating summaries.

But for organisations within, or seeking to join, the Defence Industry Security Program (DISP), that convenience can come with significant security and compliance risks, particularly if these tools are used during discussions involving sensitive, commercially sensitive or potentially classified information.

One of the biggest challenges is that AI note-taking features are often enabled by individual users, sometimes without IT or security teams being aware. Before inviting an AI meeting assistant into your next meeting, it's worth asking one important question: Where is your data actually going?

Before you hit 'Record', verify that your AI note-taking app meets your organisation's security, privacy and Defence compliance requirements, not just your productivity needs.

Three questions every DISP organisation should ask

1. Where is your data stored?

Data sovereignty should be your first consideration. If meeting recordings or transcripts are stored outside Australia, they may not meet Defence security requirements.

Before using an AI note-taking application, confirm where data is stored and processed. Avoid discussing Defence information unless you can confirm the data is stored in Australian data centres (or a jurisdiction with data protection standards equivalent to Australia’s).

2. Does the platform meet recognised security standards?

Organisations participating in the Defence Industry Security Program (DISP) are required to comply with security requirements outlined in the Defence Security Principles Framework (DSPF), the Protective Security Policy Framework (PSPF) and the Essential Eight. Any new technology introduced into the business, including AI note-taking applications, should be assessed against these obligations.

Don't assume an AI tool is secure simply because it's widely used.

Look for recognised cyber security credentials such as ISO/IEC 27001, SOC 2 Type II or an IRAP assessment. The platform should also support security features including multi-factor authentication (MFA) and single sign-on (SSO), while clearly explaining how data is encrypted, protected and accessed.

3. Who can access your meeting information?

An AI note-taking app doesn't just capture a meeting. It often creates a searchable repository of recordings, transcripts and summaries that may be stored in the cloud.

Before adopting a platform, understand who can access this information, whether meeting data may be used to train AI models, and whether the application is appropriate for discussions involving classified, controlled or commercially sensitive information. Meeting participants should also always be made aware their data is being collected and stored.

How to reduce the risk

If your organisation is considering the use of AI transcription software or note-taking tools, take these practical steps before deployment:

• Conduct a security risk assessment by evaluating the application's architecture, data storage location, encryption standards and third-party access controls.

• Avoid using AI transcription tools in sensitive meetings, particularly those involving classified, controlled or commercially sensitive information.

• Review the provider's terms of service and privacy policy so you understand exactly how your data is collected, stored, used and protected.

• Engage your security advisor. If you're unsure whether an AI platform meets DISP requirements, consult your DISP Security Officer or a trusted security advisor, before introducing it into your organisation.

Security starts before the meeting begins

AI note-taking applications can deliver great productivity benefits, but organisations operating within the defence supply chain cannot afford to prioritise convenience over compliance.

Every AI meeting transcript, AI meeting recording and AI-generated summary becomes another repository of business information that must be governed and protected. Taking the time to assess where your data is stored, how it's secured and who can access it will help ensure AI tools support your business without creating unnecessary security or compliance risks.

Before you invite an AI assistant into your next meeting, make sure it meets the same security standards your organisation does. Contact De Stefano & Co for expert advice on assessing AI applications, managing cyber risk and maintaining DISP compliance.