How Many AI Systems Are Running Your Business? Most Owners Can't Answer That.

Go ahead and count them. Your CRM has AI in it now. So does your HR platform, your email, your scheduling tool and your marketing software. Add Claude, ChatGPT and whatever else your team picked up this month. And then there's the one that shows up uninvited: the AI note taker. Most owners I talk to can't give me a number, because none of it was ever really "bought." It crept in through a feature update, a free trial or somebody's browser tab.

Let's talk about that note taker, because it's the one that's already in court. Otter.ai is being sued in a federal class action in California. The plaintiffs allege the tool joins meetings and records conversations without every participant agreeing to it, and that it uses those recordings to train its AI. They also allege Otter puts the burden of getting consent on its customers, meaning you. Otter disputes it, and these are allegations, not verdicts. But this August a federal judge let the core privacy claims move forward, including the ones under California and Illinois law.

Here's why those two states matter. California requires all parties to consent before a private conversation is recorded, and its law allows $5,000 per violation without the plaintiff proving any harm. Illinois has its Biometric Information Privacy Act, which requires written consent before collecting a voiceprint. AI note takers that label who said what can be creating exactly that. Fireflies was hit with an Illinois BIPA class action in December. And here's the part that should get your attention: you don't choose which state's law your call falls under. One prospect in California or Illinois, and your team hitting "record" can pull you into it.

Now add the part nobody wants to look at: your employees' personal AI. A recent PagerDuty survey of 1,250 office professionals found 66 percent have used AI tools their company never approved, and 34 percent admitted sharing customer data with them. Picture a rep connecting a personal note taker to their own calendar. Now it's sitting in your client calls, saving transcripts to an account you can't see, can't audit and can't get back. Nobody in that story is a bad actor. They're just trying to work faster, and you never gave them a rule or a safe tool.

So where do you start? With the basics. List every AI system in your business and who owns it. Decide who approves the next one. Tell your team when recording is allowed, how consent gets captured, and what data never goes into a public tool. Get the vendors' commitments in writing instead of assuming. But building all of that is one thing. Proving it, to a customer, a regulator or a courtroom, is another.

That is exactly why Chris Trocola founded AICT, and it's why I'm an AI compliance adviser there. AICT's certification is a standard for business layer AI governance, structured around existing federal and state law, built so a business can show it did this right before anyone asks. Not after the complaint. Not after the lawsuit. Before.

You can't govern what you can't count. So count. Then send me your number.

Not sure where you stand? Reach out.

📧 robikanoff@gmail.com

🔗 LinkedIn: linkedin.com/in/robikanoff
📘 Facebook: facebook.com/robikanoff
📸 Instagram: @robikanoff
🎵 TikTok: @robikanoff
🐦 X: @robikanoffaz
🌐 Blog: robikanoff.blogspot.com