Input data and information sources
Citizens, patients or meeting guests also speak during conversations. The recording and minutes document who said what.
AI meeting minutes and conversation documentation
Also known as: AI meeting notes, ambient scribe
From recorded meetings and consultation conversations, the system drafts minutes or a case note with an action list.
Understand the use case
What defines this use case?
Social services and local councils use these tools. The UK's health service has dedicated guidance on them.
This page describes a typical system design. Actual data flows and permissions depend on your implementation.
- System design
- Generative assistance
- Ability to act
- Action permissions depend on integration
- Fields of use
- social services, local councils, healthcare
- Also known as
- meeting summary, ambient scribe, AI-generated case notes
How it works, step by step
System design and data flows
Input data
A meeting, session or consultation is recorded.
Citizens, patients or meeting guests also speak during conversations. The recording and minutes document who said what.
Processing
Speech recognition transcribes it; a language model condenses the transcript using a template.
Speech recognition first converts the audio recording into a transcript. A language model then organises the statements according to a template and formulates topics, agreements and action items. This produces a new text: the minutes are not a verbatim transcript, and a written action item is not yet a completed task.
Results
The system returns draft minutes, a case note or memorandum with an action list.
A generated result is newly worded or created. To assess it, the instruction and context on which it is based must remain identifiable.
Use and impact
The approved draft becomes part of the record and determines what is later considered discussed and agreed.
Integration determines whether the result is simply displayed, adopted after approval or written directly into a business application. These variants differ in their data flows and permissions.
Explore the system design: Select a component to see its task, incoming and outgoing data, and role in the use case. The guided walkthrough explains each phase. Then use Yes, Uncertain and No to represent your specific system variant.
12 review first12 clarify8 baseline threats
- Present
- Depends on your system
- Absent
- Review first
- To clarify
How to use the model
The diagram shows the typical architecture. Select a component to see what happens there and adapt its features to your system. Enable “Analysis guidance” to see which threats need reviewing for this architecture. The page's checklist continues to describe the typical case.
Changes from the typical case
None yet. Each change will appear here.
Where most threats arise
- 4 review first
- 3 review first, 1 clarify
- 4 clarify
- 2 review first
In this system design: 12 to review first, 12 to clarify, 8 baseline threats.
Architecture as a list
External access: Depends on your system
To clarify
Input: Part of every AI system
Review first
To clarify
Baseline for every AI system
Third-party content: Present
Review first
AI model: Part of every AI system
Review first
- Sleepy Agent (Time/Event-Triggered Hidden Instructions)
- Prompt Injection: Direct
- Jailbreaks
- Meta Prompt Extraction
Baseline for every AI system
Provider service: Present
Review first
To clarify
Memory: Depends on your system
To clarify
Training and feedback: Depends on your system
To clarify
Tools and interfaces: Depends on your system
To clarify
Result: Part of every AI system
Review first
- Factual Inconsistencies (Hallucinations) Review priority
- Model Denial of Service
Baseline for every AI system
Business application or equipment: Depends on your system
person: Part of every AI system
Review first
- Overreliance Review priority
Affected person: Depends on your system
Unapproved AI services: Depends on your system
To clarify
Supply chain and technical foundations: 5 baseline threats applying to every AI system
Baseline for every AI system
How it differs from similar use cases
Speech recognition and transcription
Only transcribes speech, without summarising or deriving tasks
AI assistant in office applications
Summarises meetings in an office application using the signed-in user's permissions
Data and information
Processing and operating environment
Speech recognition and language models generally come from providers.
Storage and further use
Some tools consult earlier notes for the same case. Staff corrections can improve templates or the model.
Results and data sharing
Some tools place drafts directly in the case file or assign tasks; others only provide them for acceptance. With a cloud service, recordings and transcripts leave the organisation's environment.
Using a provider does not automatically determine where processing takes place. Storage location, subcontractors, deletion periods and use for training must be checked for the specific deployment.
Assess risks and determine measures
From understanding the system to analysing risks
- Define the system boundary
Record data, participants, interfaces and permissions. Resolve uncertain characteristics in the model.
- Investigate threats
Relate review candidates to actual data flows: what could happen, and who would be affected?
- Assess risk
Assess impacts and likelihood in the deployment context. The number of review candidates is not a risk score.
- Provide evidence of measures
Select appropriate controls, assign responsibilities and define effectiveness checks. Document residual risks and approvals.
Key threats in the application context
- 3 particularly important
- 9 typical
- 12 depending on the system
- 8 additional threats for every AI system
A total of 32 threats from the threat catalogue may be relevant to this use case.
Priority review points
Factual Inconsistencies (Hallucinations)
The language model attributes a statement to a client that they never made or adds a diagnosis. Once in the case file, the sentence is treated as established in later decisions.
The draft is ready immediately and looks complete. Under time pressure, staff sign it off without checking it against their recollection.
Sensitive Information Disclosure
Social care recordings contain health, family and financial information. Retention by the provider or overly broad access to minutes exposes it to unauthorised people.
9 further review candidates in the typical design
Other relevant threats
Training data or an adopted base model can introduce hidden triggers for misbehaviour.
Listed because of this characteristic
- Uses another provider's model
Sleepy Agent (Time/Event-Triggered Hidden Instructions)
An instruction-following model can change behaviour at a particular time or event.
Listed because of this characteristic
- Performs natural language tasks
Users can override the system's working instructions through their inputs.
Listed because of this characteristic
- Performs natural language tasks
A model can follow instructions in a document or tool result as if they were its own working instructions.
Listed because of these characteristics
- Performs natural language tasks
- Processes content outsiders can write
People requesting generated content may try to bypass intended limits.
Listed because of this characteristic
- Performs natural language tasks
Carefully crafted queries can reveal system instructions, which must therefore contain no secrets.
Listed because of this characteristic
- Performs natural language tasks
Complex or high-volume inputs can exhaust model computing resources.
Listed because of this characteristic
- Generates its own text
Targeted queries can recover some personal or protected training data from the model.
Listed because of these characteristics
- Processes personal data
- Processes confidential data
Exfiltration from ML Application
Protected data can leak through tools, network connections, storage or insiders.
Listed because of this characteristic
- Processes confidential data
Up to 12 further threats may apply, depending on your system design. Nine threats need to be reviewed for every AI system. One of these is particularly important here and is therefore listed above.
System features and open questions
Each Yes adds further threats to your checklist, up to 12 in total. If you cannot yet answer a question, include its threats in your review.
- Added by this Yes
- Also requires a Yes to another question
How your system is built
- Calls other programs or interfaces2 threats
- Uses operational feedback2 threats
- Learns from your own data1 threat, plus 1 only in combination with other characteristics
- Remembers content beyond a single conversation1 threat
- Changes data or triggers processes1 threat
- Learns from examples with correct answers1 threat
- Processes text, images and speech together1 threat
How you operate the system
- Accepts queries directly through an interface4 threats
- Accessible over a network1 threat, plus 1 only in combination with other characteristics
- Incurs costs with each query1 threat
- Shares computing resources with other customers or applications1 threat
- Used alongside unapproved AI services1 threat
How your system is built
Does the system remember content from earlier conversations or tasks and reuse it later?
Some tools consult earlier notes for the same case.
If yes, add
Does the system call other programs, interfaces or search services itself, even if only to read?
If yes, add
Can the system change things itself, such as storing data, sending messages, initiating transactions or granting permissions?
Some tools place drafts directly in the case file or assign tasks; others only provide them for acceptance.
If yes, add
Does your organisation train or fine-tune the model itself using its own data?
If yes, add
Is the model trained on examples to which someone has assigned the correct answer?
If yes, add
Does operational feedback or output later feed into analysis or training?
Staff corrections can improve templates or the model.
If yes, add
Does the system process several input types together, such as text with images or speech?
If yes, add
How you operate the system
These questions arise for almost every AI system.
Can people or programs query the model directly, for example through an interface?
If yes, add
Is the system accessible over a network or dependent on network services?
If yes, add
Do you pay per query or unit of computing time, so costs increase with use?
If yes, add
Does the system share servers or computing resources with other customers or applications?
If yes, add
Do staff also use AI services for this task that your organisation has not approved?
Participants sometimes bring their own unapproved note-taking tools into video meetings.
If yes, add
Controls and implementation
Measures for the priority review areas are expanded. Each linked measure explains how to implement it.
Review priorityFactual Inconsistencies (Hallucinations)3 measures
Review priorityOverreliance3 measures
Review prioritySensitive Information Disclosure3 measures
Backdoor ML Model2 measures
Sleepy Agent (Time/Event-Triggered Hidden Instructions)3 measures
Prompt Injection: Direct3 measures
Prompt Injection: Indirect3 measures
Jailbreaks2 measures
Meta Prompt Extraction2 measures
Model Denial of Service3 measures
Privacy Attacks3 measures
Exfiltration from ML Application3 measures
Controls for the remaining threats are available on their pages in the threat catalogue.
AI Act provisions
-
Art. 4: AI literacy
For every AI system Applies since 2 February 2025.
-
Annex III no. 5 point a: Public assistance benefits
Depending on use Review trigger from 2 December 2027.
Applies to every AI system
Art. 4: AI literacy
Applies if staff or appointed representatives operate or use AI systems.
Applies since 2 February 2025.
Obligations and details for Art. 4: AI literacy
- Who bears the obligations
- Provider, Deployer, Product manufacturer, Provider of a general-purpose AI model
Detailed obligations
May apply in particular uses
Annex III no. 5 point a: Public assistance benefits
Applies if an authority uses generated case notes to assess, grant or reduce entitlement to social benefits or support.
Applies from 2 December 2027.
Obligations and details for Annex III no. 5 point a: Public assistance benefits
- The general condition is
- Applies if authorities or bodies acting for them use the system to assess eligibility for public benefits and services, or to grant, reduce or recover them.
- Who bears the obligations
- Provider, Deployer, Product manufacturer
Detailed obligations
Generally does not apply
Art. 50 para. 1: Disclosure of AI interaction
Participants speak with people rather than the system. The disclosure obligation for interaction with AI therefore generally does not apply.
Obligations and details for Art. 50 para. 1: Disclosure of AI interaction
- The general condition is
- Applies if people directly write or speak with the system and it is not obvious that they are interacting with AI.
- Who bears the obligations
- Provider, Product manufacturer
Detailed obligations
Other legal requirements
Section 201 of the German Criminal Code (StGB)
Recording another person's non-public speech without authorisation is a criminal offence. Obtain all participants' consent before recording.
Open the legislation Section 201 of the German Criminal Code (StGB)
Classify your system with the quick checker All obligations in the obligations compass
Cross-cutting threats
Review these threats for every AI system, whatever its purpose.
Atypical system features
View 12 further questions
If any of these features does apply to your system, add the listed threats.
Does the system generate or edit images, sounds, voices or videos?
If yes, add
Does the system create new content from open-ended requests that people read, see or hear directly? Translation, reading aloud and transcription do not count.
The system summarises what was said rather than creating content from open-ended instructions.
If yes, add
Does the system search its own collection of documents or records for relevant content?
If yes, add
Does the system formulate answers from retrieved documents?
If yes, add
Does the system use a knowledge graph storing concepts and their relationships?
If yes, add
Does the system determine its next steps itself based on earlier results?
If yes, add
Does the system delegate tasks to other AI agents or incorporate their results?
If yes, add
Is the system connected to tools or data sources through the Model Context Protocol (MCP)?
If yes, add
Do documents from several customers, departments or permission groups share one search store?
If yes, add
Can people outside your organisation use the system, including without login?
If yes, add
Does the system generate code, scripts or database queries for further use?
If yes, add
Is the system intended to maximise a specified metric, such as revenue, utilisation or clicks?
If yes, add
Sources
- Register or case collection
UK Algorithmic Transparency Record, Newcastle City Council Magic Notes
The tool records conversations and automatically turns them into case notes.
- Register or case collection
Dutch Algorithm Register, Notuleren van raadsvergaderingen, Gemeente Rotterdam
The city creates minutes from audio recordings of council meetings.
- Authority, court or parliament
The UK government is trialling its Minute tool for meeting minutes in 25 councils.
- Specialist study
Ada Lovelace Institute, Scribe and prejudice?, 11 February 2026
Research across 17 councils shows that errors from such tools enter official records.
- Authority, court or parliament
NHS England has issued dedicated guidance on AI-assisted clinical and care documentation.
Related use cases
Also in the field of Office work and knowledge management
- Generative AI assistant for staffStaff draft, revise, translate and shorten texts using a language model their organisation provides in a secured environment.
- AI assistant in office applicationsStaff invoke the assistant directly in email, word processing, spreadsheets and chat; it accesses mailboxes and file storage using their permissions.
- AI knowledge assistant (enterprise search)The assistant answers questions from a defined document collection and shows which documents support the answer.
- Speech recognition and transcriptionSpeech recognition automatically transcribes dictation, conversations and other recordings.
- Machine translationPublic authorities and businesses automatically translate texts, websites and documents, often using their own glossary.
- AI agentAn AI agent breaks a task into steps and completes it largely independently using tools, interfaces and its own permissions in business applications.
Often used together with
- Clinical decision support (such as early sepsis detection)The system continuously analyses vital signs, laboratory values and patient records and alerts the care team to a possible deterioration.
- Risk-based review selection for applications and benefitsAuthorities assess applications or payments for error or fraud risk and use this to select cases for closer review.
Updated: 30 September 2026. Review checklist rules version 0.3.2, threat catalogue version 2026.10.24.2. How these pages are structured