Zoom AI Companion and GDPR / AI Act: meeting summaries and transfers

Overview and data processed

Zoom AI Companion is the generative AI assistant integrated into the Zoom video conferencing platform: meeting summaries, action points, conversation summaries and writing assistance.

The tool processes meeting content (audio/video, transcripts) to generate summaries and syntheses. Zoom states that it does not use customer content to train its AI models. US-based provider: exposure to the CLOUD Act; check data residency options.

Risks for your organisation

Risks: informing/obtaining consent from participants for AI summaries, transfer outside the EU and retention of summaries. Activation by the host creates a risk of use without informing other participants.

Main GDPR risks:

• Insufficient information; internally, employee consent rarely valid (legitimate interest/contract).
• Meetings with third parties: information and consent essential.
• Transfer outside the EU (CLOUD Act); check data residency.
• Retention of summaries/transcripts; minimisation.

GDPR obligations

1. Inform participants of AI activation; obtain consent from third parties.
2. Check Zoom DPA and data residency options; frame transfers (SCCs).
3. Define retention of summaries; minimise.
4. Consult works council if monitoring/assessment; record in the record of processing activities; DPIA if behavioural analysis.
5. Involve the DPO; train teams. No DPO? See our outsourced DPO.

AI Act obligations

Transparency (Article 50): inform of AI and flag AI-generated minutes. GPAI; AI literacy required. Prohibition (Article 5): analysis of tone/mood/stress/emotional engagement prohibited at work — disable these functions. Participation analyses feeding HR decisions shift to high risk (Annex III). See the AI Act guide.

AI Act risks: participants not informed of AI; any emotion analysis (prohibited); participation analyses for HR purposes (high risk).

Cybersecurity and best practices

Cyber risks: meeting content to be protected; transfer outside the EU; access to summaries to be compartmentalised; NIS 2 depending on size.

Best practices: inform of AI activation; consent from third parties; check data residency; frame transfers (SCCs); minimal retention; disable all emotional analysis; AI charter, record of processing activities, AI training.

Checklist:

• Participants informed of AI activation, consent from third parties, DPA + data residency checked
• Transfers framed (SCCs), retention of summaries defined, no emotion analysis
• Works council consulted if monitoring/assessment, DPIA if behavioural analysis, teams trained

Sanctions, conclusion and recommendations

Sanctions: GDPR (up to €20m or 4%); AI Act (€35m/7% or €15m/3%); criminal provisions (article 226-1 of the criminal code); obstruction offence (works council).

Recommendation: Zoom AI Companion benefits from a commitment not to train on customer content, but remains subject to information/consent and transfer rules (US-based provider). Systematically inform of AI activation, check data residency, minimise and delete. Compare with Teams Copilot and tl;dv. See the AI tools comparison.