AI meeting notetakers: privacy and confidentiality risks

There are two broad kinds. Built-in features, such as transcription, recording and AI summaries inside Microsoft Teams, Zoom or Google Meet, run inside a platform your organization already licenses and administers. Third-party notetakers are separate services that a user connects to their calendar; a bot then joins meetings as a participant, records audio, produces a transcript and summary, and often emails it to attendees or stores it in the user's account with the vendor.

The second kind is where most of the risk sits. A single employee can connect one with a few clicks, sometimes granting it access to their whole calendar, and from then on it may join every meeting they are invited to, including meetings with clients who never agreed to it.

Recording a conversation collects personal information: voices, names, opinions and whatever is discussed. Under PIPEDA, organizations need meaningful consent for the collection, use and disclosure of personal information, subject to limited exceptions. The Office of the Privacy Commissioner of Canada's guidelines for obtaining meaningful consent set out seven guiding principles, including emphasizing key elements, giving people clear options to say yes or no, and making consent a dynamic and ongoing process.

For meetings, that translates into practical habits:

• Say at the start that the meeting will be recorded or transcribed, and by what tool
• Put it in the invitation for external meetings, so people can object in advance
• Have a real way to opt out: turn the bot off, or the person leaves the transcript
• Do not let notetakers join meetings automatically where the organizer has not chosen to use one
• Apply stricter rules for meetings involving health, financial or HR matters

Ask three questions of any notetaker: where is the recording and transcript stored, who can access it, and when is it deleted? For Microsoft Teams, Microsoft's documentation states that transcripts are stored together with meeting recordings in OneDrive and SharePoint, which means your existing retention policies, holds and access controls can apply to them.

Third-party services typically store data in their own cloud, sometimes outside Canada, under their own retention terms, and some reserve the right to use customer content to improve their models. That copy sits outside your retention schedule and legal holds and, if the employee leaves, may stay in an account you do not control. The Canadian Centre for Cyber Security's generative AI guidance (ITSAP.00.041) advises selecting vendors carefully and being careful what information you provide to AI tools; a notetaker is that guidance applied to every word spoken in a meeting.

For lawyers, and for anyone discussing legal advice with them, a third-party transcript is a disclosure of the conversation to another service. Whether that affects privilege or confidentiality obligations is a legal question, but the cautious position is simple: do not use third-party notetakers in privileged meetings, and think carefully before using any transcription in them.

The same caution applies to board meetings, HR investigations and disciplinary meetings, settlement discussions, and meetings involving health information. A transcript is also a record that can be requested in litigation or through an access request, and AI summaries can misstate what was said in ways a participant may later have to explain.

1. 01

   Approve tools

   Name the transcription and summary tools staff may use, normally the ones built into platforms you already administer.

2. 02

   Ban unapproved bots

   No third-party notetakers connected to company calendars or accounts without approval.

3. 03

   Define no-record meetings

   Privileged, HR, board and health-related meetings are not transcribed unless specifically authorized.

4. 04

   Announce and allow opt-out

   Notice at the start of every recorded meeting; external participants told in advance.

5. 05

   Retain deliberately

   Transcripts follow your retention schedule; delete those you do not need.

6. 06

   Handle external bots

   Tell staff they may ask a client's or vendor's notetaker to leave, and should for sensitive topics.

Policy needs technical backing. In the Teams admin center, Microsoft documents transcription as a meeting policy setting, under Meetings > Meeting policies, which can be turned on or off for everyone or for specific users. Recording, Copilot and meeting lobby settings are also managed through meeting policies.

To stop third-party bots, look at how they get in. Most connect through an app consent in Microsoft Entra ID or Google Workspace; restricting user consent to third-party apps (in Entra, under Identity > Applications > Enterprise apps > Consent and permissions > User consent settings) means staff cannot connect a notetaker to their calendar without admin approval. Review the apps that already have consent and remove the ones you have not approved. Meeting lobby settings can keep unexpected participants, including bots, out of meetings until admitted.

We help organizations set notetaker policies, configure Teams and Google Meet to match, and find the bots already connected.