AI note-takers are everywhere now. Plaud, Otter, Fireflies, Zoom AI Companion, Copilot. Most firms are using at least one. Here's the bit that catches people out. Somebody asked me recently about adding standing text to meeting invites ... "unless advised otherwise we will record this meeting". Reasonable instinct. It feels like you've covered yourself. But as consent, it fails. Under GDPR consent has to be freely given, specific, informed and unambiguous, through a clear affirmative action. Silence and inactivity don't count. So an opt-out isn't consent. Here's the link to the guide I created that shows how to fix this. What's interesting is that the same sentence works fine if you're relying on legitimate interests instead, because that needs transparency and a right to object rather than a yes. Same words. Different basis. Two practical things while I'm here. First, if you record in person with something like a Plaud ... turn the recorder on before you ask, and say that you've turned it on. Otherwise the one thing not captured is the agreement itself. Second, check your platform settings. Since January, Zoom makes every participant acknowledge the AI disclaimer before the meeting continues. Google Meet can require explicit consent before note-taking starts, but it's switched off by default. For video calls that solves most of the problem for you. So ... are you recording client meetings? And if you are, how are you handling consent at the moment? Honestly interested in how many people have thought about this 👇

Ask an accountant how they keep client data safe with AI and you'll almost always hear the same line: "I've turned off training." It's a reasonable thing to believe. It's also, on its own, close to worthless as a compliance position. Turning off training stops one thing... the provider reusing your conversations to train future models. Everything else still happens. Your prompt still leaves your computer. It's still processed on a server, usually abroad. It's still retained for a while. It's still, in the language of the law, being handled by a third party on your behalf. If you process client data through AI, and virtually every firm does, you're the data controller and the AI provider is your processor. That's a defined legal relationship with eight separate obligations attached. The training toggle covers roughly one of them. This isn't hypothetical any more either. The PCRT bodies, including the ICAEW, published AI guidance in January. The IRS issued its first Circular 230 guidance on AI in June. The UK's Data (Use and Access) Act landed in February. None of it created new duties. All of it confirmed the existing ones apply, and that regulators are actually looking now. I put together a free guide walking through all eight things compliance actually requires, in plain English, with a simple framework for deciding what's safe to do with client data. Fifteen minutes to read. Attached below. The full course covers the other four chapters this guide doesn't (agentic AI, connecting AI to QuickBooks and Xero, prompt injection, and the 2026 rules by jurisdiction) ... that's inside Premium if you want to go deeper. Where does your firm genuinely stand on this right now... sorted, working on it, or hadn't thought about it until this post? 👇

I'm not sure if people are aware of some free training that the Information Commissioner is offering to do with data protection, which I think is really useful and indeed some that may be helpful for non-UK residents. Below is a link if you want to have a look at it and hopefully it is something that you could get your team to cover as well as good training. https://ico.org.uk/for-organisations/advice-for-small-organisations/training-and-resources/data-protection-essentials/

I caught ChatGPT trying to improve a sentence that I'd written. It suggested replacing "That is what I'm still thinking about" with "That's what I'm still thinking about." There was just one problem: I'd written "That's." So I called ChatGPT on it: "Hold on. That's not what I wrote. Where did you get that?" We talked it through and realized what had happened. It wasn't looking at my sentence. It was mentally carrying over an earlier version of the conversation. It wasn't a big deal. I didn't think that AI was broken. I was really just curious how ChatGPT came up with the word that didn't exist. It struck me how differently a lot of people treat AI compared to humans. If a coworker made the same mistake, we wouldn't declare them unreliable and not fit to work with forever. We'd just ask them to hold on a minute so we could figure out where the mistake happened. People work through a misunderstanding and move on. What's funny is that the same conversation that contained the mistake also had some of the best insights. Correcting one mistake doesn't mean losing confidence in either AI or a person. I'm not right all the time, and I'm comfortable with that. Maybe AI deserves the same space to be wrong sometimes. It gives us room to question, think, and collaborate.

Anthropic announced that it's embedding a watermark in all of the text it creates. This is cleverly woven into the text so it's not visible to a human. If you've been using Claude to write and distribute text for you, be aware that it now includes a permanent footprint. If you're copying and pasting even some of what Claude has written, you might want to consider typing it yourself instead. It seems likely that platforms that are pushing back on AI-generated content now have a clearer way to detect it. https://support.claude.com/en/articles/16266773-how-claude-marks-ai-generated-content