It’s the kind of story you’d expect from a spy thriller. Except it allegedly happened in a conference room at OpenAI, the company behind ChatGPT.

Earlier this month, federal authorities arrested an OpenAI engineer accused of secretly installing an audio recording device in an executive conference room at the company’s San Francisco headquarters. According to prosecutors, the device was hidden behind a television, plugged into a USB port, and concealed in toilet paper. Investigators allege the employee intended to capture confidential conversations involving company executives and sensitive technology. The employee faces a federal criminal charge, but is presumed innocent unless proven guilty.

Although the allegations certainly are unusual, they raise an increasingly common workplace issue: unauthorized recordings. And with artificial intelligence (AI) making it easier than ever to capture, transcribe, and summarize conversations, California employers have good reason to pay attention. After all, unauthorized workplace recordings don’t always involve hidden electronic devices. Sometimes, they involve an AI assistant that nobody realized was listening.

Meet Your Newest Attendee: AI

Imagine conducting a performance review when you notice an unfamiliar participant in your virtual meeting. It’s an AI notetaker. Perhaps the employee activated it to capture the discussion, or maybe it automatically joined through someone’s calendar. Either way, the platform is capturing the conversation, generating a transcript, and preparing a summary.

AI meeting assistants have become increasingly popular because they can document discussions, identify action items, and produce detailed notes in seconds. For busy employees and leaders, these tools offer obvious benefits. Unfortunately, their convenience can overshadow significant legal concerns, particularly when employees use them without understanding the rules governing confidential workplace conversations.

California employers should be especially careful because the state’s recording laws can apply regardless of whether someone uses a traditional recording device or newer technology.

California’s All-Party Consent Rule

California is commonly described as a two-party consent state, but it’s more accurately an all-party consent state. Under Penal Code section 632, intentionally recording or electronically eavesdropping on a confidential communication generally requires the consent of everyone participating in the conversation. Whether a communication is confidential depends on whether at least one participant has an objectively reasonable expectation that the discussion isn’t being overheard or recorded.

Consider how many workplace conversations could fall into that category. Performance evaluations, disciplinary meetings, workplace investigations, reasonable accommodation discussions, and conversations involving medical information often include sensitive matters that participants reasonably expect to remain private. Executive meetings addressing confidential business decisions can raise similar concerns.

An AI tool that captures audio to produce a transcript may trigger these requirements just as an ordinary recording device would. Depending on the circumstances, unlawful recording can result in criminal penalties and civil liability. Under Penal Code section 637.2, an injured person may seek statutory damages of $5,000 per violation or three times actual damages, whichever is greater, without having to establish actual financial harm.

Of course, not every workplace conversation qualifies as confidential, and the circumstances matter. But employers shouldn’t assume a recording is permissible simply because everyone involved works for the same organization or the technology makes recording easy.

But Everyone Saw the Notetaker!

Suppose an AI assistant appears in a virtual meeting with a name like “Meeting Notes AI.” Everyone can see it, and nobody objects. Does that mean everyone has consented to being recorded?

Not necessarily. Consent may be express or implied under the circumstances, but merely seeing an unfamiliar participant or recording tool doesn’t automatically establish legally sufficient consent. And employers shouldn’t assume that a general technology policy authorizes every recording of a confidential conversation.

The better approach is to clearly disclose when a conversation will be recorded, explain how the technology will be used, and obtain appropriate consent before recording begins. If someone objects, the employer should address the concern before proceeding.

Employers also need to understand how their meeting platforms operate. Some applications automatically activate recording or transcription features, while others allow individual participants to introduce third-party AI assistants without the meeting organizer’s approval. As a result, a leader conducting a sensitive conversation may not even realize that the discussion is being captured.

What Happens to the Recording?

Obtaining consent is only part of the problem. Once an AI tool records a conversation, employers need to understand what happens to the information afterward. Where is the recording stored? Who can access the transcript? How long is the information retained? Does the vendor use customer data to improve or train its AI systems?

These questions become particularly important when the conversation involves sensitive employee information. Imagine an AI assistant recording an employee’s medical disclosures during an accommodation meeting or capturing confidential witness statements during a workplace investigation. Information intended for a limited audience could end up stored with a third-party technology provider or shared more broadly than anyone anticipated.

Employers also should consider whether recording certain conversations could compromise attorney-client privilege, expose proprietary business information, or create additional records subject to discovery in litigation. A transcript that seems helpful today could become a significant liability tomorrow.

And there’s another concern: AI-generated summaries aren’t necessarily accurate. These tools can misunderstand statements, attribute comments to the wrong person, or produce summaries that don’t accurately reflect what occurred. An employer that relies on an inaccurate AI summary to support a disciplinary or termination decision could create problems that extend well beyond recording consent.

Can Employers Ban Workplace Recordings?

Generally, California employers can establish reasonable policies governing workplace recordings, including restrictions designed to protect confidential information and employee privacy. However, broad prohibitions should be reviewed carefully because employees may have legally protected rights to document certain workplace activities.

For example, the National Labor Relations Act protects certain concerted activities relating to employees’ terms and conditions of employment. Other laws protect employees who report suspected unlawful conduct or engage in protected whistleblowing activities. Although these protections don’t automatically authorize recordings that violate California law, overly broad workplace policies can create separate legal concerns.

Employers therefore should avoid assuming that a blanket prohibition on every recording, under every circumstance, is necessarily the best solution. Instead, policies should explain when recording is permitted, when advance authorization and consent are required, and how the organization will protect confidential information without interfering with employees’ legal rights.

What Should Employers Do?

The first step is understanding what technology employees are already using. Employers should determine whether their video conferencing platforms automatically activate recording or transcription features and whether employees are introducing third-party AI assistants into workplace meetings. Waiting until a confidential conversation has already been recorded is hardly an effective compliance strategy.

Next, employers should establish clear procedures for obtaining consent and restricting recordings during particularly sensitive discussions, including investigations, disciplinary meetings, and accommodation conversations. They also should evaluate vendor privacy practices, including data storage, access, retention, and potential use of recordings to train AI systems.

Finally, leaders need training. They should understand that an AI-generated transcript isn’t necessarily reliable, that sensitive information should not be uploaded into unapproved systems, and that employees may not appreciate the legal distinction between taking their own notes and electronically recording everyone else’s conversation.

A clear, practical policy can help employers take advantage of useful technology without unnecessarily exposing confidential information or creating new legal problems.

The Bottom Line

The allegations involving OpenAI represent an extreme example of the risks associated with unauthorized workplace recording. Importantly, that criminal case concerns an allegedly concealed physical recording device, not ChatGPT’s meeting-recording technology. Nevertheless, the larger lesson applies to California employers of every size.

Technology has made it remarkably easy to record conversations, but it hasn’t eliminated the legal obligations associated with employee privacy, confidentiality, and consent. Whether an employee uses a sophisticated device hidden behind a television or an AI assistant quietly joining a virtual meeting, employers need to understand who’s listening, what’s being recorded, and where that information is going.

Before your next sensitive workplace meeting, it’s worth asking a simple question: Who’s recording this conversation, and did everyone agree?