Half of Enterprises Lack AI Governance for Voice and Collaboration Data

Only 50% of organizations have implemented a structured AI security and compliance program across workplace collaboration and contact centers, according to Metrigy research. That gap now extends into enterprise communications, where AI agents generate records faster than governance frameworks can cover them.

AI can turn a single customer conversation into dozens of artifacts: recordings, transcripts, summaries and CRM updates, each stored in different systems under different policies. Platform fragmentation compounds the problem. Prachi Nema, principal analyst for UC and collaboration at Omdia, a division of Informa TechTarget, said enterprises typically run two to seven UC and collaboration tools, each with its own controls and retention policies.

"Responsibility is also fragmented across collaboration, contact center, security, legal, compliance, records management and AI governance teams," Nema said.

What happens when records outlive the call?

David Smith, founder and principal analyst at InFlow Analysis, identified a second risk: automation removes the human checkpoints that manual workflows once provided. Before AI automated contact center processes, each handoff gave someone a chance to review the work.

"When AI takes that handoff out, the company books the time saved, but the checking quietly stops happening too," Smith said. "That's a liability nobody is pricing yet."

Smith proposed a practical test for CISOs: pick one customer conversation and trace everything it produces — the recording, transcript, summary and CRM update — then check which records the retention policy actually covers. He warned the results are often ugly.

"Retention policies were written for recordings. A call can be deleted right on schedule while the transcript and summary AI made from it live on somewhere else under a different policy," Smith said.

Gartner adds that governance for AI-enabled meetings must address inconsistent recording practices and privacy risks, including policies that define storage, access and deletion requirements for recordings, transcriptions, summaries and derived records. Organizations must also account for mobile and BYOD use.

Shadow AI widens the compliance gap further. Metrigy found about 19% of organizations respond to security risks by blocking applications or disabling features such as recording, transcription and AI copilots. That often pushes employees toward unsanctioned AI notetakers outside IT control.

Is voice now sensitive data?

AI-generated voices have undermined traditional caller verification, said Ran Inbar, CTO for UC at communications software vendor AudioCodes. Customers can no longer trust caller ID and logo verification alone, prompting demand for additional identity checks.

Inside the enterprise, speaker identification and automated notetaking rely on stored voice samples — raising questions about where that data lives, who owns it and who deletes it when an employee leaves.

"If an attacker needs only a couple of seconds of someone's voice to impersonate them, a stored voice sample is a security risk as well as a privacy one," Inbar said.

He recommends stronger caller verification, such as banks initiating calls through their mobile app after customer authentication, tying calls to an established identity-verification process. Organizations should also inventory voice sample collection points, restrict access, define retention and deletion responsibilities, and assess GDPR applicability.

How do enterprises hold AI agents accountable?

Nearly half of organizations have suspected or confirmed an AI agent took unauthorized actions in the last 12 months, according to a survey of more than 380 security and IT professionals by AI security company Salt Security. Yet only 17.5% of respondents said they could automatically stop an agent behaving unexpectedly.

Smith said every agent should have its own identity and audit trail, mirroring employee accountability. Organizations must limit agent permissions, retain action records and define when human approval is required.

When evaluating governance tools, CISOs should test whether products:

• apply policies across communications platforms;
• integrate with existing security and compliance systems;
• track AI-generated records;
• provide auditable evidence of enforcement.

Vendors should demonstrate these capabilities in the organization's own workflows, using representative scenarios for policy enforcement, record retrieval, access controls and agent intervention.

CISOs should assign responsibility jointly with communications, IT, legal, compliance and records teams: business and compliance owners approve policy requirements, IT and security implement and monitor controls, and designated owners review exceptions. Audit pass rates, policy exceptions, record coverage and mean time to remediate failures reveal whether controls work in practice.

The goal, analysts agree, is to govern the original conversation, the data derived from it and the agents that act on it — with controls that prevent agents from exceeding their scope and mechanisms to stop them when they do.