What should a company dictation policy include?

A dictation policy should answer six questions: which tools are approved, which account each must use, what content may not go into them, which settings must be on or off, how long speech and transcripts are kept, and who owns the rule and when it is reviewed. Each cloud tool also needs its contract and default settings checked before anyone uses it at work. The policy can be short, but each of these six parts needs a specific answer.

Start with the approved list and the account type

Name each approved tool, the account it must use, who approved it and when it will be reviewed. The account type matters as much as the tool. Microsoft lists Copilot dictation as available for work or school accounts, not for personal accounts ¹. A rule that says "Copilot is approved" without the account type leaves staff free to sign in with a personal login, which is the gap described in our answer on why companies ban AI notetakers.

Require contracts that cover subprocessors and health data

A contract decides what the vendor may do with speech. Under the EU's GDPR, a processor cannot engage another processor without the controller's prior written authorization, either specific or general ². For dictation, that means asking which speech engine, cloud host or analytics provider sits behind the app, and whether the company has approved each one.

For US health information, HHS says that a covered entity and a cloud service provider holding its health information must sign a HIPAA-compliant business associate agreement ³. Any policy that covers clinical notes needs that agreement in place before dictation starts. The glossary entry on business associate agreements defines the term.

Set the defaults, and keep company speech out of training

Defaults decide what is kept when nobody changes a setting. Google says Cloud Speech-to-Text does not log customer audio or transcripts unless the customer opts into data logging ⁴. A policy should list each required setting, its default and who checks it.

Training terms belong in the policy too. Otter's privacy policy lists training its AI on de-identified audio recordings and on transcriptions ⁵. So the policy should require a setting or a contract term that keeps company speech out of model training, and it should say how staff confirm that setting.

State how long audio and transcripts are kept

Retention is the part most policies leave out. Under GDPR Article 13(2)(a), a controller must tell people, when the data is obtained, how long it will be stored, or the criteria used to set that period if a fixed period is not possible ⁶. Even outside the EU, the same discipline works. Give audio its own period, give transcripts a separate one, and say who may delete them and how deletion is confirmed.

Name an owner and a review date

Give the policy one owner and a date for the first review. OMB's memorandum M-25-21 gives federal agencies 270 days to develop a generative AI acceptable-use policy ⁷. That is guidance to agencies, not a rule for private companies, but it is a reasonable model for a private deadline. Put the deadline in the policy, then put the review on a calendar.

It depends on sector, device and location

• Health. Clinical dictation needs a business associate agreement wherever a cloud provider holds health information, as covered above.
• Legal. Client material follows privilege rules, and a notetaker on a client call needs its own review. See our guide to dictation and attorney-client privilege.
• Government. Federal agencies must check FedRAMP scope before they approve a cloud tool. Our answer on government employees and AI dictation covers that route.
• Personal devices. Decide whether staff may use personal phones for work speech, and what management can see on them. Our answer on what your employer can see explains the device side.
• On-device tools. An on-device tool removes some contract questions but still needs a settings check, and the policy should say so.

A policy outline you can adapt

1. Approved tools. Name each tool, the account type it requires, the approver and the review date.
2. Banned tools and accounts. Name the consumer AI apps and notetakers that may not handle work speech. Say that personal accounts are not allowed for work content.
3. Restricted content. Keep health data and legal material out of any tool without the required contract.
4. Required settings. Set the baseline for each approved tool, including logging and training choices.
5. Retention and deletion. Give periods for audio and transcripts, who may delete them, and how deletion is confirmed.
6. Owner and review. Name the owner and set the date of the first review.

Keep the wording plain. A rule that staff cannot follow without calling IT will not hold. For the full set of options, read our guide to dictation at work, enterprise and government policies, which covers how to check a vendor and where each option sends speech. The overview of voice privacy explains the wider subject.