What Did the AI See?

Episode Summary

AI systems can now use more of the context around the work: selected application activity, website interactions, meeting audio, files, and connected sources. The useful question is no longer only whether the feature works. It is whether the organization can prove what the system was allowed to notice, why that context was necessary, what the person could control, and what happened when the connection changed or ended.

In this episode, Michael turns current OpenAI, Google Workspace, and European Commission signals into a six-part Context-Collection Receipt for operators. The goal is not to treat every context feature as automatically invasive or every opt-in as a complete privacy program. The goal is to make purpose, enablement, scope, choice, lifecycle, and evidence reconstructable.

What Changed

These are product and policy signals, not proof that every plan, tenant, role, region, retention rule, audit trail, or deletion path behaves identically.

• OpenAI's August 13 Enterprise and Edu release notes describe Computer History as an optional, off-by-default feature for eligible members using the ChatGPT macOS app. OpenAI says an administrator must first grant access by role, after which each member chooses whether to opt in and which supported apps and sites to include.
• OpenAI says Computer History records interaction events rather than screenshots, screen recordings, microphone input, or system audio, and excludes private browsing. Members can pause the feature and inspect or delete timeline items.
• Google announced that Take Notes for me can be started for an in-person meeting from Google Meet on web or mobile. Google says Gemini captures meeting audio and, after capture ends, creates notes, action items, and a complete transcript in a Google Doc saved to Drive.
• Google separately provides an administrator setting that can require participants on supported devices to actively agree before note-taking, recording, or transcription begins. That is a product control, not a universal legal conclusion.
• OpenAI's individual-user sync retirement supplies the lifecycle test: individual connections were scheduled for disablement, with deletion of associated synced data beginning August 14, while administrator-managed sync remains unaffected.
• European Commission guidance says specified Article 50 transparency obligations began applying August 2, 2026, for providers and deployers within scope. Applicability depends on the actual organization, system, use, and jurisdiction.

The Operating Distinction

Admin enablement is not user choice.

User choice is not purpose.

A delete control is not a deletion receipt.

An output label is not an input inventory.

Useful context is still collected context.

The Six-Part Context-Collection Receipt

1. Purpose: the approved use, necessary context, prohibited uses, and named outcome owner.
2. Enablement: plan and regional availability, admin role grant, eligible population, effective configuration, and observed tenant state.
3. Scope: included apps, sites, event types, sources, exclusions, and boundaries.
4. Choice and communication: what the person sees, chooses, can pause, can change, and can understand in plain language.
5. Lifecycle: view, correct, export where supported, delete, disable, disconnect, migrate, retain, and verify disposition.
6. Evidence: audit events, configuration snapshots, tests, notices, exception logs, reviewer, and recheck date.

This Week's 45-Minute Block

Pick one context-enabled AI feature and one real workflow. Use a test account and non-sensitive data.

1. Minute 0-10: name the approved purpose, owner, minimum necessary context, and context that would invalidate the pilot.
2. Minute 10-20: record the documented default, observed tenant state, eligible role, included apps and sites, event types, and exclusions.
3. Minute 20-30: walk the member experience. Observe the choice, pause the feature, inspect an item, change the scope, and request deletion where appropriate.
4. Minute 30-40: identify supported audit events, lifecycle questions, and an owner for every unknown.
5. Minute 40-45: write one plain-language communication and set a recheck date.