Fathom and GDPR / AI Act: the common rules for notetakers

Overview and data processed

Fathom is an American meeting assistant that records, transcribes and summarises calls, with key moment highlighting and CRM integrations.

Fathom processes voice, transcripts, summaries and metadata. US-based provider: exposure to the CLOUD Act; check for potential use of data for training purposes.

Risks for your organisation

As with its competitors: transfer outside the EU, participant consent and retention, with the potential sensitivity of statements.

Main GDPR risks:

• Insufficient information; internally, employee consent is rarely valid (legitimate interest/contract).
• Meetings with third parties: information and consent essential.
• Transfer outside the EU (CLOUD Act); SCCs.
• Potential use for training (to be verified); retention and minimisation.

GDPR obligations

1. Inform and obtain consent from participants.
2. Sign the DPA; frame transfers (SCCs); verify training.
3. Define short retention periods; minimise (audio).
4. Consult the works council if monitoring/evaluation; enter in the record of processing activities; DPIA if behavioural analysis.
5. Involve the DPO; train teams. No DPO? See our outsourced DPO.

AI Act obligations

Transparency (Article 50): inform of AI and flag AI-generated minutes. GPAI; AI literacy required. Prohibition (Article 5): analysis of tone/mood/stress/emotional engagement prohibited in the workplace — disable these features. Participation analyses feeding HR decisions become high-risk (Annex III). See the AI Act guide.

AI Act risks: participants not informed; tone/emotion analysis (prohibited); participation analysis for HR purposes (high-risk).

Cybersecurity and best practices

Cyber risks: recordings outside the EU; access to summaries to be compartmentalised; bot in confidential meetings; NIS 2 depending on size.

Best practices: information + consent; framed transfers (SCCs); minimal retention; audio rather than video; disable emotional analysis; sovereign alternative for sensitive matters; AI charter, record, AI training.

Checklist:

• Information + consent, DPA + framed transfers (SCCs), training verified/disabled
• Short retention, no emotion/tone analysis, works council consulted if monitoring/evaluation
• DPIA if behavioural analysis, sovereign alternative for sensitive matters, teams trained

Sanctions, conclusion and recommendations

Sanctions: GDPR (up to €20m or 4%); AI Act (€35m/7% or €15m/3%); criminal provisions (article 226-1 of the criminal code); obstruction offence (works council).

Recommendation: Fathom is an effective notetaker, subject to the same requirements as its competitors: information/consent, framed transfers, minimisation, short retention, no emotional analysis. For confidential meetings, prefer a sovereign solution such as tl;dv. Compare with Otter.ai and Fireflies.ai. See the AI tools comparison.