Organisations have spent the last decade locking down workplace technology like laptops, smartphones and enterprise networks to prevent system breaches. But wearable tech like AI-enabled smart glasses, earbuds, watches and rings has slipped under the radar, despite being able to receive and record confidential communication and analyse documents. With millions of these devices in use every day, they are a governance blind spot that companies should be seriously considering.

Wearables, once associated mainly with fitness tracking, have become embedded in daily life. According to the IDC’s Worldwide Wearable Device Tracker, global wearable-device shipments totalled 145.7-million units in Q1 2026, an increase of 4.3% year-on-year. And unlike laptops and smartphones, they are not always seen as part of an organisation’s technology environment.

While earlier generations of wearables performed narrow, user-initiated tasks, newer devices run continuously and with greater independence from the wearer.  A smartwatch connected to Outlook may provide almost immediate access to sensitive commercial information such as emails, messages and calendar entries without the employee touching a laptop. Smart glasses can capture photographs, video and audio, live stream, translate and interact with an AI assistant, all while resembling ordinary eyewear.

Many organisational controls still rely on familiar categories. Laptops are managed as workplace devices, smartphones fall under mobile-device controls, and cloud applications are assessed as third-party services. A watch, ring, pair of glasses or set of earbuds may not fit comfortably within any of these categories, even where their capabilities overlap with all three.

Organisations should therefore consider whether their cybersecurity, information-governance and AI-governance frameworks adequately address the information these devices can access, capture, process, store and transmit.

Wearables may already be connected - even if the organisation has not approved them

Typically, organisations know which laptops and smartphones they have issued, which personal devices have been authorised, and what security requirements apply. Some organisations have detailed Bring Your Own Device (BYOD) policies but those policies were drafted with smartphones in mind, not always-on, AI-enabled wearables that enter buildings as unremarkable accessories.

The connection does not necessarily have to be direct either. A wearable may interact with corporate information through a paired smartphone, a companion application or a cloud-based account, without ever connecting to the corporate network independently. Its absence from the organisation’s inventory of devices therefore does not mean that it lacks access to workplace information.

Wearables can also create access to sensitive information, without any intent or malice. A smartwatch displaying the subject line of a confidential email within the view of a nearby passenger on a flight, or an executive's smart glasses inadvertently recording a board meeting, illustrates the risks.

Wearables also present cybersecurity risks beyond inadvertent disclosure of confidential information. Many devices communicate with smartphones, laptops, companion applications and cloud platforms, creating multiple pathways for information to flow. Depending on the device and its configuration, these connections may use Bluetooth, Wi-Fi or other wireless protocols.

The risk is not that every wearable is inherently insecure, but that each introduces additional software, credentials, connections and third-party services into the organisation’s environment. This expands the attack surface, the number of potential entry points through which systems or data could be compromised. 

Physical connections create additional exposure. Where wearables connect to computers via USB for charging, updates or data transfer, a compromised device could introduce malware or enable confidential information to be copied outside the organisation's usual security controls.

Following a cybersecurity incident, regulators, insurers and litigants may ask whether the organisation's security measures addressed all connected technologies capable of interacting with its systems.

The AI-governance pitfalls

Several wearables now incorporate AI assistants that can summarise conversations, answer questions, draft messages and interact with business information through natural language. An employee might ask a wearable to summarise a confidential meeting or draft a response to a client.

Organisations should ask whether confidential information is being processed by third-party AI providers; whether personal information is being transferred across borders; whether recordings, prompts or outputs are retained to train AI models; and whether their AI governance framework extends to wearables.

In the United States, AI-enabled smart glasses are already the subject of lawsuits concerning data collection and processing practices. The allegations remain untested, but the dispute illustrates how the operation of AI-enabled wearables can create legal exposure extending beyond the individual wearer.

Locally, where wearables collect or process personal information, the Protection of Personal Information Act, 2013 (POPIA) may apply. The law requires responsible parties to implement appropriate, reasonable technical and organisational measures, identify reasonably foreseeable internal and external risks, and maintain appropriate safeguards. A device does not fall outside these requirements merely because it is personally owned.

The exposure, recording or external processing of business information through a wearable could breach employment confidentiality duties, NDAs, trade secret obligations or sector-specific requirements.  And although the Companies Act, 2008 does not prescribe controls for wearables, emerging technology risks may form part of the broader risk-governance matters warranting board oversight.

The organisation’s response to wearables must, however, also respect employees’ rights. Restrictions on personal devices, workplace monitoring and access to information collected by wearables should be proportionate, transparent and consistent with applicable privacy, employment and interception laws.

The appropriate response is not necessarily to ban wearables or draft a standalone wearables policy. Organisations should instead assess whether their existing cybersecurity, BYOD, acceptable use, confidentiality, AI-governance and incident-response frameworks address the capabilities of these devices and the circumstances in which they are used. 

As part of that assessment, organisations should be looking at which wearables are being used in the workplace, their capabilities and whether workplace and network access protocols adequately address wearable technology.  It’s also important to determine whether incident-response processes can identify and contain an incident should a breach occur as a result of a wearable device, and to assign clear responsibility for risks to the appropriate teams, such as IT, information security, human resources, and legal.

Technology evolves rapidly, and when policies, controls and safeguards are not keeping up with that change, that is where risk creeps in. Closing the gap now means that measures can be put in place long before a wearable device proves precisely why they are needed.

Written by Tebogo Sibidla, a Director at Werksmans Attorneys