{{item.videoDuration}}
{{item.title}}
{{item.text}}
{{item.videoDuration}}
{{item.text}}
Smart glasses, AI recorders, and the new insider risk
The workplace has acquired eyes and ears. A new class of consumer technology can now see, hear, interpret, and remember. Artificial intelligence (AI)-enabled smart glasses combine cameras, microphones, and voice-controlled assistance in eyewear. Portable AI-enabled recording devices can capture meetings and conversations and then generate searchable transcripts, summaries, and action items.
These technologies can support accessibility, field service, and productivity. But they also change the nature of information loss. Sensitive content can leave through what an employee sees or hears—not just through what they download, email, or copy.
Screens, whiteboards, badges, and people can all be captured visually. Meetings and calls can become transcripts, summaries, and searchable records. Persistent, low-friction collection can accumulate across the working day.
Insider risk is an emerging concern
Risks aren’t limited to intentional recording. Well-intentioned employees may use personal AI-enabled tools for convenience in the workplace without recognizing company information will be transferred to a personal device, personal account, or external AI environment outside of the organization’s visibility and control.
The enterprise boundary is shifting from a managed endpoint to a human interface: what a worker can see and hear.
Our point of view? Treat AI-enabled wearables and recording devices as unmanaged capture endpoints. Traditional controls are designed to detect a file being downloaded, emailed, uploaded, or copied. But smart glasses and AI voice recorders can observe the information directly from a screen, whiteboard, or conversation.
Once captured, the information may move through a personal smartphone, mobile network, or companion application. It can then be processed in an external AI environment beyond the organization’s contractual, retention, monitoring, and deletion controls.
Privacy and consent remain important. But exposure can extend beyond personal data into confidentiality, intellectual property, regulated data, material non-public information, and the gradual and invisible migration of organizational knowledge.
How ambient capture can become corporate knowledge migration
Why is this exposure different?
Ambient capture can bypass data loss prevention (DLP) controls. No file needs to be downloaded. The device can capture content from the presentation layer itself. Even traditional DLP often remains incomplete. According to PwC’s 2027 Global Digital Trust Insights, only slightly over half (52%) of Canadian organizations have fully implemented DLP across key egress channels. Ambient capture devices operate outside those channels.
This exposure is also difficult to detect. Glasses look like normal eyewear, while a recorder may stay in a pocket, wallet, or phone case. Because company information may travel through a personal phone, mobile network, or cloud subscription, repeated capture can accumulate at scale, turning fragmented conversations into a searchable external body of corporate knowledge.
Focus on capabilities, not products
A governed exception process is essential. Why? A blanket ban without an approved alternative is likely to drive legitimate demand into shadow usage. And a product-specific ban will age quickly. A capability-based framework can address the next pair of glasses, recorder, pendant, or AI agent.
Organizations should move from a single acceptable use clause to an integrated governance, control, and assurance architecture. The policy should define what people may do. Supporting standards should specify how systems, facilities, and controls must operate.
Create a governed and timely route to approval
Some will need to ban devices—but all will need to govern capabilities
For most organizations, the goal isn’t to prohibit innovation. It’s to establish clear boundaries around what may be captured, where these technologies may be used, which systems may process the resulting information, and who remains accountable.
Begin with a focused assessment of how smart glasses and AI recorders could enter your environment. Identify high-risk information and locations, evaluate current policy coverage, and determine whether existing controls can prevent, detect, or attribute ambient capture.
The result? A governed route to legitimate use and a practical action plan that covers policy, physical zones, technical controls, employee awareness, and a timely exception process.
Learn more about emerging cyber, privacy, and information governance challenges associated with AI-enabled workplace technologies.
{{filterContent.facetedTitle}}
{{contentList.loadingText}}
{{contentList.loadingText}}
Contact us
Partner, National Technology, Media and Telecommunications Leader, PwC Canada
Tel: +1 416 670 6244
