Capstone Three: A Vendor Tool Decision

In practice

First, the risk scan. The tool hears everything said in meetings, including client details, personnel matters and the occasional health disclosure, so data privacy is likely and severe. Confabulation is likely in summaries, with moderate consequences, since decisions are recorded from them. Information security matters too, because recordings are valuable to attackers. Second, the data terms. The vendor stores recordings for ninety days on its own servers and may use transcripts to improve its models unless an administrator opts out. Third, the evidence. The model card lists meetings in English as the intended use, and its caveats mention lower accuracy with overlapping speakers and strong accents. The team's calls often have both. Fourth, a test. The team records five internal meetings with consent, compares each summary with the full transcript, and finds two decisions misattributed to the wrong person and one action item missing. Fifth, the decision and the rules. The tool is approved for internal meetings only, with the training opt-out set and retention cut to thirty days in the contract. Every participant must be told it is recording. Client calls and personnel discussions are excluded. Summaries are drafts, and the meeting owner checks decisions and action items before circulating them.