tl;dv and GDPR / AI Act: the sovereign meeting assistant, with conditions

Overview and data processed

tl;dv is a German-origin meeting assistant: a bot ('notetaker') joins your Zoom, Teams or Google Meet meetings, records, transcribes and generates summaries, with CRM integrations. Its European roots are a compliance argument.

tl;dv processes participants' voices (personal data by nature), possibly their image, transcripts, summaries and metadata (date, participants, duration). This content may include sensitive data mentioned in meetings. Hosting within the EU depending on the plan, to be confirmed.

Risks for your organisation

The number one risk is failure to inform/obtain consent from participants — especially external ones. Next come excessive retention of recordings, recording of confidential remarks and the lawful basis in an employee context.

Main GDPR risks:

• Insufficient information: a simple 'this meeting is being recorded' is not enough; you must mention AI in the invitation, remind participants orally and make notifications visible.
• Internally, employee consent is rarely valid (imbalance): prefer legitimate interest or performance of contract.
• Meetings with third parties: information and often consent essential.
• Minimisation (audio rather than video) and retention (delete audio after minutes are approved).

GDPR obligations

1. Inform in the invitation and orally; obtain consent where required (third parties).
2. Choose the appropriate lawful basis (legitimate interest with balancing test, or performance of contract).
3. Confirm EU hosting and sign the DPA; set short retention periods.
4. Consult the works council if the tool is used to monitor/assess; add to the record of processing activities; DPIA if behavioural analysis.
5. Involve the DPO; train teams. No DPO? See our outsourced DPO.

AI Act obligations

Transparency (Article 50): inform of AI use and flag AI-generated minutes. GPAI models (provider obligations since 2 August 2025); AI literacy required (Article 4, since 2 February 2025). Prohibition (Article 5): analysis of tone, mood, stress or 'emotional engagement' is prohibited at work since 2 February 2025 — disable these features. If meeting analytics feed into HR decisions, it becomes high-risk (Annex III): human oversight, inform the works council, DPIA. See the AI Act guide.

AI Act risks: participants not informed about AI; tone/emotion analysis (prohibited); participation analytics for HR purposes (high-risk).

Cybersecurity and best practices

Cyber risks: recordings and transcripts = sensitive assets; access to minutes must be partitioned; bot joining confidential meetings; NIS 2 depending on size.

Best practices: confirm EU hosting and DPA; systematic information + third-party consent; audio rather than video; minimal retention; disable all emotional analysis; AI policy, record of processing activities, AI training.

Checklist:

• Information (invitation + oral reminder) and third-party consent, documented lawful basis, EU hosting + DPA confirmed
• Short retention (audio deleted after minutes), no emotion/tone analysis
• Works council consulted if monitoring/assessment, DPIA if behavioural analysis, teams trained

Penalties, conclusion and recommendations

Penalties: GDPR (up to €20m or 4% of global turnover); AI Act (up to €35m or 7% for prohibited practices, €15m or 3% for non-compliant high-risk system); criminal aspect — Article 226-1 of the Criminal Code for recording without consent; obstruction offence in case of failure to consult the works council.

Recommendation: tl;dv is relevant for sovereignty, but compliance depends on consent, minimisation and retention. Always inform, prefer audio, delete quickly, disable emotional analysis and consult the works council if assessment. Compare with Otter.ai, Teams Copilot and the example not to follow Read AI. See the AI tools comparison.