Is your AI notetaker setup AI-Act-ready?

Your AI notetaker setup is AI-Act-ready only when the vendor can confirm, in writing, that it meets the EU AI Act Article 50 transparency duties and deployer obligations that apply from 2 August 2026 alongside GDPR. The seven questions below turn that into a vendor-by-vendor check: tick each box only when you have the pass answer in writing.

Question 1 · Hosting

Where is it hosted, by region and by provider, for both storage and processing?

Pass Names an EU region and a named provider for both storage and every processing step, or states clearly which step uses a non-EU provider.

Fail "Your data stays in the EU," with no breakdown of where audio is transcribed or summarised.

Question 2 · Subprocessors

Who are the subprocessors, and where is the full public list?

Pass A complete, dated list naming the ASR provider, the summarisation model provider, and storage, with a change-notice mechanism.

Fail Names the cloud host but calls the AI providers "trusted partners" or leaves them unnamed.

Question 3 · Training

Is my call data used to train or improve any model?

Pass A written no-training clause in the DPA covering recordings, transcripts, prompts, uploads and outputs, and every downstream model provider.

Fail A webpage reassurance, or an opt-out you have to find and toggle.

Question 4 · Model control

Can the model be pinned or self-hosted, and are you told before it changes?

Pass Version pinning, advance notice of model changes with a description of what changed, and a self-host or on-prem option for higher assurance.

Fail "We always use the latest model," with no notice and no pinning.

Question 5 · Disclosure (Article 50)

How does the bot disclose itself in the meeting?

Pass Explains the capture mode plainly (visible named bot, or botless), and gives you a workable disclosure and consent step for it.

Fail Treats "the bot records" as if disclosure to participants were someone else's problem.

Question 6 · Deletion and retention

Can you control retention, and does deletion reach derived data and backups?

Pass Configurable retention; deletion covers the recording, transcript, summary and search index; a defined backup deletion window.

Fail "You can delete recordings," with no mention of transcripts, indexes or backups.

Question 7 · DPA

Is a DPA available as standard, and does it match the product?

Pass A standard DPA whose subprocessor annex, processing regions, transfer mechanism and no-training clause match the answers to questions 1 to 6.

Fail A DPA that is vaguer than the sales conversation was, or an enterprise-only upsell.

This checklist is a buyer's guide, not legal advice, and does not determine whether any product is compliant. Compliance depends on your whole deployment and your own disclosure and retention practices. Consult a qualified lawyer and your DPO. Full guide and sources at the URL on the right.

numigtm.com