Fireflies.ai and GDPR / AI Act: notetaker, CRM and transfers

Overview and data processed

Fireflies.ai is a US meeting assistant: its bot ('Fireflies Notetaker') joins calls (Zoom, Teams, Meet), records, transcribes, summarises and pushes information to the CRM.

Fireflies processes voice, transcripts, summaries and metadata, as well as data pushed to the CRM. US publisher: exposure to the CLOUD Act; check data use for model improvement.

Risks for your business

Transfer outside the EU, participant consent and distribution of transcripts in the CRM (wider access) are the main risks, along with the potential sensitivity of commercial conversations.

Main GDPR risks:

• Insufficient information; internally, employee consent is rarely valid (legitimate interest/contract).
• Meetings with third parties: information and consent essential.
• Transfer outside the EU (CLOUD Act); SCCs to be put in place.
• Distribution of transcripts in the CRM: access to be restricted and minimisation; retention.

GDPR obligations

1. Inform and obtain consent from participants (third parties as a priority).
2. Sign the DPA; regulate transfers (SCCs); check training.
3. Restrict access to transcripts in the CRM; define retention.
4. Consult the works council if monitoring/assessment; record in the record of processing activities; DPIA if behavioural analysis.
5. Involve the DPO; train teams. No DPO? See our outsourced DPO.

AI Act obligations

Transparency (Article 50): inform of AI and flag AI-generated reports. GPAI; AI literacy required. Prohibition (Article 5): analysis of tone/mood/stress/emotional engagement prohibited at work — disable these features. Participation analyses feeding HR decisions become high-risk (Annex III). See the AI Act guide.

AI Act risks: participants not informed; tone/emotion analysis (prohibited); participation analysis for HR purposes (high-risk).

Cybersecurity and best practices

Cyber risks: transcripts distributed widely via the CRM; transfer outside the EU; bot in confidential meetings; NIS 2 depending on size.

Best practices: information + consent; regulate transfers (SCCs); restrict access to transcripts (CRM); minimal retention; disable emotional analysis; audio rather than video; sovereign alternative for sensitive content; AI charter, register, AI training.

Checklist:

• Information + consent, DPA + regulated transfers (SCCs), training checked/disabled
• Access to transcripts restricted (CRM), short retention, no emotion/tone analysis
• Works council consulted if monitoring/assessment, DPIA if behavioural analysis, teams trained

Sanctions, conclusion and recommendations

Sanctions: GDPR (up to €20m or 4%); AI Act (€35m/7% or €15m/3%); criminal aspect (Article 226-1 of the criminal code); obstruction offence (works council).

Recommendation: Fireflies.ai accelerates sales follow-up, but distributes transcripts widely (CRM) and processes voice outside the EU. Inform and obtain consent, regulate transfers, restrict access, minimise and delete quickly. For confidential meetings, prefer a sovereign solution such as tl;dv. Compare with Otter.ai and Fathom. See the AI tools comparison.