Who Owns the Meeting Room? Auditing Smart Office Devices in 2026

The modern UK meeting room is no longer just a table and a screen. It may contain a video bar with a camera and microphone array, a room booking panel, an occupancy sensor, a smart display running a third-party app store, and a lighting or heating controller that talks to the building management system. Each device is convenient. Together, they form a small estate that IT may not own and facilities may not see as a security risk.

That gap is the problem. Hybrid work has pushed smart office technology into spaces that were once low-tech. Procurement often sits with facilities, workplace or property teams. Installation may be handled by an audio-visual supplier. The device then appears on the Wi-Fi, receives firmware updates from a vendor cloud and stores data that nobody has classified. IT sees a network client. Facilities sees a room feature. Nobody sees the whole picture.

A joint audit is the remedy. It should be practical, repeatable and owned by both IT and facilities, not passed between them.

Why the meeting room escaped the asset register

Traditional IT asset management assumes that devices are bought by IT, configured by IT and supported by IT. Smart office devices break that assumption. They are often purchased as part of a fit-out, bundled with a lease or installed by a specialist contractor. They may be managed through a vendor portal rather than a corporate device management tool. Some are designed to be simple: plug in, connect to Wi-Fi and use a cloud account.

Simplicity is useful, but it bypasses controls. If a meeting-room camera is not in the asset register, it may not be patched, reviewed or included in incident response. If an occupancy sensor sends data to a cloud service, that data flow may not appear in the record of processing activities. If a smart display supports third-party apps, the room may have a software supply chain that nobody has assessed.

The first step is to stop treating the meeting room as a facilities-only space. It is a connected environment with security, privacy and operational dependencies.

Start with a joint walk-through, not a network scan

A network scan will find devices that are online. It will not tell you why they are there, who owns them or what data they capture. Begin with a physical walk-through of every meeting room, breakout space, reception area and shared floor. Include IT, facilities and, where appropriate, the data protection lead.

Record each device: location, make, model, serial number, firmware version, network connection, management portal, vendor contact, contract owner and purpose. Note whether it has a camera, microphone, motion sensor or display. Note what data it collects, where that data is stored and how long it is retained. Include the boring items too: room booking panels, digital signage, printers, access-control readers and any building sensors that share the corporate network.

Map the physical device to the logical account. Which cloud tenant manages it? Who has administrator access? Is the account tied to a named person or a generic team mailbox? What happens when that person leaves? These questions expose the shadow ownership that often surrounds smart office tools.

Segment by function and trust

Meeting-room devices should not sit on the same flat network as finance systems, HR records and email. Segmentation is not a luxury. It limits lateral movement if a device is compromised and makes it easier to apply appropriate rules.

Create separate network zones for corporate IT, guest access, meeting-room devices and building systems. Restrict outbound traffic to what the device actually needs. Do not allow inbound access from the internet unless there is a documented business requirement and a compensating control. Where vendors require remote support, use a managed access route with logging and time limits rather than a permanent open door.

Segmentation should be matched by account separation. A facilities administrator should not use the same credentials for the building management system and the corporate email tenant. Vendor accounts should be individual, not shared, and should be removed when a contract ends.

Make firmware and updates somebody's job

Smart devices are small computers. They need patching. The audit should establish who is responsible for firmware updates, whether updates are automatic, how quickly critical fixes are applied and what happens when a device reaches end of support.

Some meeting-room devices update silently through the vendor cloud. That is convenient, but it still needs oversight. A failed update can take a room out of service. An unpatched device can become a route into the network. Record the update mechanism, the support end date and the fallback plan. If a device no longer receives security fixes, it should be replaced or isolated.

Treat cameras, microphones and sensors as data sources

A camera in a meeting room is not just equipment. It is a potential source of personal data. An occupancy sensor can reveal patterns of use. A microphone array may capture speech if configured incorrectly. Under UK GDPR, the organisation needs a lawful basis, a clear retention period and appropriate transparency.

For camera-enabled devices, confirm whether recording is enabled by default, where recordings are stored and who can access them. For sensors, confirm what is measured and whether individual-level data is inferred. For any device that processes personal data, check that the supplier terms support the organisation's obligations. A data protection impact assessment may be appropriate for always-on cameras or sensors in workspaces.

The practical rule is simple: if a device can see, hear or infer something about people, it belongs in the data protection conversation.

Decide what stays

Not every smart device deserves to remain. Use a decision matrix that weighs business need, security, privacy, cost, supportability and interoperability. A room booking panel that saves administrative time may be worth keeping. A smart display with an unmanaged app store and no update path may not be.

Options include retain with controls, isolate on a separate network, replace with a supported alternative, or remove. The decision should be recorded, with an owner and a review date. This prevents the audit from becoming a one-off exercise that is forgotten by the next fit-out.

Put smart office devices into normal governance

After the audit, add the devices to the IT asset register and the vendor register. Include them in change control, procurement review and incident response. Give facilities a route to raise new devices before they are installed, and give IT a route to flag security or privacy concerns before a purchase is completed.

Review the estate quarterly. Smart office technology changes quickly, and a device that was acceptable at installation may be unsupported two years later. The aim is not to remove convenience from the workplace. It is to make sure that convenience does not become an unmanaged, unpatched and unaccountable part of the corporate estate.