Is Your Team's AI Dictation App Safe? I Checked What Mine Had Kept

I talk to my computer more than I type. For the past year I've used an AI dictation app: hold a key, speak, and tidy text appears in whatever I'm writing. It's brilliant, and I recommended it to people.

Last week I decided to replace it. Before I uninstalled it, I looked at what it had saved on my Mac.

What it had kept

Its memory file only went back two weeks. In those two weeks it had stored:

• 507 dictations, each with the full text, the app I was using and the title of the window I was working in. That's 44 different apps.
• A list of 100 people and 78 organisations it had picked out, with 23 email addresses linked to them. Clients, journalists, suppliers: people who never agreed to be on it.
• A profile of me: my date of birth, my home postcode, my phone number, details of my health and my family, and notes on how I write in different apps.

It also kept a queue of things to send to the company's servers. When I first looked, one item was waiting. The next day the queue was empty.

I don't remember telling it most of that profile. It pieced it together from what I said and where I said it.

None of this means the company broke any rules. It's how these products work: the more they know about you, the better they get. The problem is that I didn't know, and I run an AI compliance firm.

Why this matters for your firm

Now think about your team. An accountant dictating notes on a client's tax affairs. A solicitor talking through a case. An HR adviser summarising a grievance. Every word passes through the app, and some of it may be kept: names, health details, money matters, and the names of people who never agreed to any of it.

Under data protection law, your firm is responsible for the personal data your staff handle, whatever tool they handle it with. If nobody approved the tool, nobody checked where that data goes.

Most firms can't answer the simplest question: which AI tools are our people using today?

Five questions to ask about any AI dictation app

1. Where does my voice become text: on my device, or on the company's servers?
2. What does it keep: recordings, text, window details, contacts? For how long?
3. Can I see everything it holds about me, and delete it?
4. Does it read my screen or other apps to "add context"?
5. Who else gets the data: analytics companies, AI providers, anyone else?

If the honest answer to any of these is "I don't know", that is your answer for now.

The same five questions work for any AI tool your team uses, not just dictation.

What I did

I switched to an open-source dictation app that turns speech into text on my own Mac. The only thing that leaves the machine is the text, for an optional tidy-up, sent to a service I chose using my own account, and I can switch that off. I can open its settings and see exactly what it does.

Then I did what we tell our clients to do. I wrote the tool down, wrote down what data can and can't go into it, and decided who checks it.

Start with one page

You don't need a 40-page manual. You need a clear policy that lists the AI tools your team may use, says what data can and can't go into them, and makes someone responsible for keeping it current.

That's what our AI Policy is: customised to your firm, covering approved tools, data rules and what staff do with the output, with a one-page summary your team will actually read.