Cyberpediaby Brain
ENDEFR

Speech synthesis and voice recognition at work

Transcribing a meeting or call with AI: what the tool does with your voice, what to check beforehand, and what the GDPR and the CNIL say.

In 30 seconds

Where it happens
Automatic meeting minutes, call transcription, voice assistants, dictation.
What is at stake
A recorded voice contains statements, sometimes confidential, and personal data about the participants.
The reflex
Send a recording only to a tool approved by the company, tell participants before recording, and proofread the transcript before sharing it.
If it is already done
Tell the person who handles security or data protection in the company, without waiting.

What it is

A speech recognition tool listens to a recording and turns it into text. This is what produces the automatic minutes of a meeting or the transcript of a call. The reverse process, speech synthesis, produces a spoken voice from a text: it is the voice of a voice assistant.

For an employee, the useful question is less technical than practical: where the recording goes, who can listen to it again, how long it stays stored, and whether the resulting text is reliable. This page gives the benchmarks that the sources in the file make it possible to establish. It does not cover the European AI regulation or voice cloning, for lack of a source on either point in the drafting file.

Straight answers

How does a voice become text?

A research paper was published on arXiv on 6 December 20221. It describes models trained to predict large quantities of transcripts of audio found on the internet, at a scale of 680,000 hours of multilingual data1. Its authors write that, compared with humans, these models « approach their accuracy and robustness »1. In other words, their level comes close to that of a person, without equalling it according to this wording1.

And from text to voice?

No source in the file describes how speech synthesis works. As a precaution, it is better not to enter into such a tool a text that you would not entrust to an outside service.

Is my voice biometric data?

The CNIL defines biometric data as a « Caractéristique physique ou biologique permettant d'identifier une personne (ADN, contour de la main, empreintes digitales...) »2. The voice is not mentioned in this definition2. The file therefore does not allow a conclusion. The GDPR also places particularly sensitive data in a category with specific protection, and biometric data belong to it when they are used to identify a person3. If in doubt about a tool that recognises or authenticates voices, the question goes to the person in charge of data protection before any use.

Does the GDPR apply to a transcript?

The CNIL reminds that, when the GDPR applies, data must be protected in training databases, in the models that may have memorised them, and in the use of models through prompts4. The file does not say whether a transcript falls within this framework: the question goes to the person in charge of data protection.

Must participants be told?

The GDPR provides for informing the people whose data are collected (articles 13 and 14, in the contents of the CNIL page)3. CNIL sheet 9 deals with informing people: the CNIL states that organisations that process personal data to develop AI models or systems must inform the people concerned5. This information obligation appears in the CNIL's practical AI sheets5. The file does not specify the rule for a simple meeting recording. The prudent practice is to announce the recording and the tool used at the start of the meeting, and to let everyone refuse.

1How it works1 min

A transcription tool receives audio, passes it to a model and returns text. At each of these steps, two practical questions arise: where the data is, and how long it stays there.

The UK National Cyber Security Centre (NCSC) addresses providers of AI systems, whether they created the system themselves or built it on tools and services provided by others6. Its guidelines were published on 27 November 20236. Their aim is to build systems that work as intended and « work without revealing sensitive data to unauthorised parties »6. An employee is not their addressee, but the idea translates simply: an AI tool must be able to say who has access to the data entrusted to it.

On the GDPR side, the text asks the controller and the processor to assess risks and to implement measures to mitigate them, for example encryption, in order to ensure an appropriate level of security, including confidentiality3. It lists among the risks the unauthorised disclosure of data transmitted, stored or processed3. In a company, it is the company that chooses the tool and signs the contract. This is why the employee goes through the approved tool.

2What you do1 min

Before recording or transcribing, four checks are useful.

  • Check that the tool is approved. A personal account opened on a free service has not been reviewed by the company. If no tool is approved, do not transcribe a sensitive conversation.
  • Know where the audio goes and how long it stays. This information is in the tool's terms of use or in the internal documentation. If it cannot be found, ask for it before using the tool.
  • Keep confidential conversations out. A one-to-one interview, a health matter, a commercial negotiation or a security incident do not go into a tool that is not approved.
  • Tell the participants. Say at the start of the meeting that it is being recorded and transcribed, and by which tool.

After transcription, proofreading before sharing is recommended. It covers proper names, figures, decisions and commitments, because the text then travels on into emails and files. If a passage looks odd, it is checked against the recording rather than corrected from memory.

3Pitfalls2 min

The first pitfall is trust in the text. According to the research paper cited above, a system can approach human accuracy1. A sentence can nonetheless be misunderstood. The file does not quantify the error rate or describe invented transcripts, but OWASP lists the security risks of applications based on large language models7. Its presentation cites in particular the « dissemination of sensitive information » and the « compromised decision-making »7. A transcript shared without proofreading can produce effects of this kind.

The second pitfall is the automatic summary. NIST published on 26 July 2024 a profile devoted to generative AI8. This profile is intended to help organisations identify the risks specific to this technology8. A meeting summary produced by a model belongs to this family of tools, which justifies proofreading it like a transcript.

The third pitfall is the reuse of data. The CNIL notes that models such as language models may contain personal data, and that the rights of access, rectification, objection and erasure may be particularly difficult to implement in an AI model4.

The fourth pitfall is recording without informing people. The GDPR provides for informing the people concerned (articles 13 and 14)3. The CNIL has also published, with the South Korean authority PIPC, a poster « IA générative et vie privée »9. It was published on 27 May 20269. It explains how to protect one's personal data when using an AI9.

Finally, fraud using an imitated voice, often called CEO fraud, cannot be detailed here: no source in the file documents it. Remembering that a familiar voice on the phone is not enough to approve a request for a transfer or a password is a prudent reflex, not a fact established by this file.

Fact sheet

Identifier
CP-505
Wing
4. Artificial intelligence
Brain skill
Protecting Data When Using AI (protect_data)
Brain reflex
air-024
Diagram
G3 · System & Protocol Anatomy
Languages
de, en, fr
Sources
9 sources checked on 3 November 2026
Sources9 sources
  1. arXiv, “Robust Speech Recognition via Large-Scale Weak Supervision”, 6 December 2022. https://arxiv.org/abs/2212.04356 (accessed 3 November 2026)
  2. CNIL, “Donnée biométrique”. https://www.cnil.fr/fr/definition/donnee-biometrique (accessed 3 November 2026)
  3. CNIL, “Le règlement général sur la protection des données - RGPD”, 24 May 2016. https://www.cnil.fr/fr/reglement-europeen-protection-donnees (accessed 3 November 2026)
  4. CNIL, “IA et RGPD : la CNIL publie ses nouvelles recommandations pour accompagner une innovation responsable”, 7 February 2025. https://www.cnil.fr/fr/ia-et-rgpd-la-cnil-publie-ses-nouvelles-recommandations-pour-accompagner-une-innovation-responsable (accessed 3 November 2026)
  5. CNIL, “Les fiches pratiques IA”. https://www.cnil.fr/fr/les-fiches-pratiques-ia (accessed 3 November 2026)
  6. NCSC (UK), “Guidelines for secure AI system development”, 27 November 2023. https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development (accessed 3 November 2026)
  7. OWASP, “OWASP Top 10 for Large Language Model Applications | OWASP Foundation”. https://owasp.org/projects/top-10-for-large-language-model-applications (accessed 3 November 2026)
  8. NIST, “AI Risk Management Framework”. https://www.nist.gov/itl/ai-risk-management-framework (accessed 3 November 2026)
  9. CNIL, “Intelligence artificielle | CNIL”. https://www.cnil.fr/fr/intelligence-artificielle (accessed 3 November 2026)

Cite this article

Brain, “Speech synthesis and voice recognition at work”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/speech-to-text-text-to-speech-privacy/

BibTeX 
@misc{brain_cp505_en_2026,
  author = {Brain},
  title = {Speech synthesis and voice recognition at work},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/speech-to-text-text-to-speech-privacy/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence