Generative AI-powered note-taking tools (Gen AI tools) are increasingly being used to record, transcribe and produce summaries of meetings across all levels at large organisations including, in some cases, board and committee meetings. However, whilst near-instant transcriptions and summaries offer efficiency gains, they also introduce legal risks around their data processing, distribution and storage.

This article examines the EU’s key legislative instruments – the NIS 2 Directive, Cyber Resilience Act (CRA) and Digital Operational Resilience Act (DORA) – which together harmonize cybersecurity standards across critical sectors such as infrastructure, digital products and financial services.