Can AI Meeting Notes be used legally?

Yes, a business can use AI meeting notes legally in most of Europe and the UK. But it is not automatic. You need a lawful reason to process what people say, you have to tell everyone before the tool starts listening, you must control where the recording and transcript go, and you should keep the tool out of the meetings where a verbatim record does more harm than good.

This article explains the rules in plain language, using regulators’ own guidance and law firms’ published advice, and ends with a checklist you can use this week. It is general information, not legal advice, and the law differs by country, so use it to ask better questions of whoever advises your business.

Key takeaways

• A transcript of identifiable people is personal data, so data protection law applies from the first recording.
• Consent is not always required under the GDPR, but it is often the safest habit, and some countries’ recording laws and some US states do require it.
• Employee consent is a weak legal basis because of the power imbalance. Legitimate interest, backed by a written balancing test, is often a better fit.
• Tell people in the invitation and again at the start of the call. A bot that joins uninvited is where most of the legal trouble starts.
• Keep AI transcription out of board, legal advice and formal HR meetings unless you have thought it through.
• Never switch on emotion or sentiment scoring of people in a workplace meeting. The EU AI Act bans emotion inference at work.
• Own the tool: pick one approved account, switch off training on your data, set a deletion period and name a person responsible.

Is it legal to use AI meeting notes?

There is no single law on AI meeting notes. Three separate layers apply at once, and a tool that passes one can fail another.

The first layer is data protection. Under the GDPR, and the UK version of it, a recording of someone’s voice and a transcript of what they said are personal data whenever the person can be identified, which in a meeting they nearly always can. That brings a set of duties: a lawful basis, a notice, a contract with the supplier, limits on how long you keep it and respect for people’s rights. Our entry on the GDPR sets out the basics, and the page on data protection explains what it means once staff start using AI tools.

The second layer is recording law. This is separate from data protection and is set by each country, and in the United States by each state. It decides whether you may record a conversation, and who has to agree. It can be criminal law, not just a regulator’s guidance.

The third layer is workplace and professional rules: employment law on grievances and discipline, the confidentiality of legal advice, and the EU AI Act where a tool starts to analyse people and not just transcribe them.

The reason the question feels murky is that people ask it as if one answer covers all three. It does not. “Is it legal?” really means three questions. Do we have a lawful basis for the data? Are we allowed to record this call at all? And is this the kind of meeting where a transcript creates new problems? The sections below take them in turn.

Do I need consent to record a meeting?

Under the GDPR, consent is only one of several lawful bases, so you do not always need it. But recording law is a different matter, and that is where the answer changes from place to place.

In Germany, for example, a law firm’s published guidance explains that recording or making available a non-public spoken statement without consent can be a criminal offence, and that automatic transcription regularly meets that test because at least an audio recording is made. The same firm notes that consent may be implied if someone joins a meeting that is clearly marked as transcribed, but only after clear information. In the United States, most states allow a participant to record a call, while commentators count about a dozen that require every participant to agree. California is one of them, and it is the home of the best-known lawsuit about AI note-takers, covered below.

Your meetings do not respect borders. A call between a Dublin office, a client in Berlin and a supplier in California is covered by more than one set of rules at once. That is why most advisers settle on one habit: tell everyone, and get a clear yes where there is doubt. It costs thirty seconds and removes most of the legal risk.

The big meeting platforms already build this in. Microsoft Teams, for instance, has an administrator setting that makes participants agree before they are recorded or transcribed. When it is on, and someone starts recording or transcription, everyone else is muted with their camera and content sharing off until they answer Yes or No. Anyone who answers No gets a view-only experience. The setting is off by default, which means a business that never opens the admin centre is not asking for consent at all.

If you use a bot from a third-party tool and not the platform’s own feature, you do not get this safeguard for free. You have to create it yourself, by telling people beforehand and saying so at the start of the call.

What does GDPR say about AI transcription?

The GDPR does not mention meeting notes. It applies because of what the tool does. Six of its requirements matter most here.

A lawful basis. Every use of personal data needs one of the legal grounds in Article 6. For meeting notes the realistic options are consent and legitimate interest, covered in the next section.

Transparency. People must be told who is processing their data, why, for how long and what their rights are. For a meeting that means a short notice before the recording begins, not a paragraph buried in a policy.

A contract with the supplier. Where the tool provider processes data for you, you need a processor agreement. A law firm’s guidance on transcription tools singles out the provider’s access to the data and any use of it for its own purposes, such as training its AI, as the points to check.

Minimisation and retention. Keep only what you need, for only as long as you need it. A routine team meeting rarely needs a full audio recording stored for years.

People’s rights. A person can ask for a copy of what you hold about them, and can object. A transcript is data about them, so it falls within that.

Special categories. If a meeting touches health, trade union membership or similar subjects, the rules are stricter. HR meetings are the usual example.

For a plain account of what staff should and should not feed into AI tools generally, our guide on what is safe to paste uses a three-tier test that works just as well for a recording as for a pasted email. Most of the same logic applies: a tool covered by an agreement is different from a personal account, and the text takes the risk level of its most sensitive element.

Consent or legitimate interest?

This is the question that trips most businesses, because consent feels like the obvious answer and often is not.

Under the European Data Protection Board’s guidelines on consent, valid consent has to be freely given, specific, informed and unambiguous. “Freely given” is the hard part. If your boss or your biggest client asks you to agree to a recording, how free is the choice? The guidelines treat the imbalance of power in employment as a real problem for consent, and German regulators cited in law firm commentary regard employee consent as often invalid for exactly that reason.

The alternative is legitimate interest, the lawful basis in Article 6(1)(f). It does not need anyone’s agreement, but it demands more homework. The UK regulator, the ICO, describes a three-part test: you must have a genuine purpose, show that the processing is necessary for it, and balance it against the person’s interests, rights and freedoms. The EDPB has issued guidelines on the same test.

Necessity is where meeting notes often stumble. If a human note-taker, or live captions that store nothing, would do the job, a full recording is harder to justify. The balancing step asks what people would reasonably expect. A client who expected a normal call and finds a bot recording and summarising everything has not been given what they reasonably expected.

The sensible position for most small businesses is a mix. Use legitimate interest as the written basis for routine internal meetings, document your reasoning in a page, and still tell people and let them object. For anything where the person’s agreement matters, such as an interview or a sensitive client discussion, ask them directly and have an alternative ready if they say no.

Do I have to tell people?

Yes. Transparency is a core GDPR duty, and it is also the cheapest way to avoid every other problem. There are three moments to get it right.

In the invitation. Add a line to the meeting invite: “This meeting will be transcribed by an AI note-taker. Tell us beforehand if you would prefer we did not.” Regulators and law firms alike point to notice at invitation stage as best practice, because it lets people object before they are on the call.

At the start of the call. Say it out loud: “We are using an AI note-taker for this meeting. The notes stay within our company and are deleted after 30 days. Is anyone uncomfortable with that?” Wait for a beat. If someone is hesitant, switch it off.

On screen. Most platforms show a banner when recording or transcription starts. Teams lets administrators customise the message and the link to the privacy policy that appears there, so participants see your own wording, such as the example in Microsoft’s documentation: “By attending this meeting, you agree to being included.”

Two cautions about banners. A banner is a notice, not proof that someone agreed. And a banner shown only inside your own platform does nothing for people who join from outside it, or for a third-party bot that arrives as a guest. For those, your invitation and your spoken statement are the notice.

What are the Rules in the UK, EU and US?

A short map, with the caveat that each country adds its own detail.

EU. The GDPR applies everywhere, but recording rules are national. Germany is the strictest commonly cited example, with criminal law covering recording without consent. Some regulators publish their own guidance on meeting recordings, and these often stress retention limits and prior information. If your clients are across several countries, work to the strictest one.

UK. The UK GDPR applies, and the ICO’s guidance on lawful basis, including legitimate interests, is the place to start. UK employment law adds duties around fair process in grievance and disciplinary meetings, which is one reason transcripts of those meetings need thought.

United States. There is no single rule. Federal law and most states allow recording by a participant. About a dozen states require every party to agree, and California is among them. If any participant could be in an all-party state, treat the call as needing everyone’s consent.

The honest summary is that the risk comes from mixing: a UK business, a German client and a California supplier on one call. Work to the strictest rule among those present.

What happened in the Otter.ai lawsuit?

The case that made businesses pay attention to this is a class action filed in August 2025 in a US federal court in California against Otter.ai, a popular AI note-taking service. The plaintiff alleges that the service’s Notetaker bot recorded private conversations on Zoom, Google Meet and Microsoft Teams without getting consent from everyone on the call, and then used those recordings to train its AI. According to NPR’s report, the complaint claims violations of state and federal wiretap and privacy laws.

One allegation matters for every business. The complaint says that when a host links a calendar to the tool, the bot can join meetings and start transcribing without anyone on the call having actively agreed, including the host. Otter’s response, as reported, is that recording starts only when one of its users starts it, and that its terms make users responsible for obtaining any permissions needed. The case has since been folded into wider proceedings, and no ruling on the merits had been reported when this article was written. These are allegations, not findings.

You do not need to follow the court filings to learn from it. The lesson has three parts. A bot that joins automatically from a calendar is a consent problem waiting to happen. “The user is responsible” is what suppliers say, and it means you are. And whether a supplier trains its models on your recordings is a contract question you should settle before you switch the tool on. If you are choosing between products, our comparison of Otter, Fireflies and Copilot covers how each handles recording, summaries and what they do with the data.

Where does the Data go?

Where a recording goes after the meeting matters as much as whether you were allowed to make it. Four questions settle it.

Where is it stored? Many note-taking tools keep audio and transcripts on cloud servers, sometimes outside the UK or the EU. Moving personal data across a border needs a lawful transfer mechanism. Our entry on data residency explains why the location of the processing is a legal fact and not just a technical one.

Is it used to train a model? A consumer product may use your recordings to improve its AI unless you turn it off. A business account under a data processing agreement often does the opposite. Check the setting and the contract. Our guide to choosing an AI vendor lists the contract questions worth asking.

Who can read it? Transcripts often include sensitive things said casually, and by default they may be visible to everyone who was invited. Check the sharing settings, and keep access to the people who need it.

How long does it stay? Set a deletion period, and check it works. If you let a tool connect to your calendar, email or files, our article on connecting ChatGPT to Gmail, Drive or SharePoint covers what each permission opens up. If you are already in the Microsoft world, the difference between a free chat tool and a licensed assistant is covered in Copilot Chat versus Microsoft 365 Copilot.

Can AI notes be used in HR or legal meetings?

This is where caution pays most. Linklaters, a UK law firm, published a note on AI transcription for employers on 1 July 2026 that lists the risks clearly, and they are worth reading in full.

• Special category data. HR meetings can involve health information or union membership, which carry stricter rules.
• Accuracy and fairness. Tools can mishear technical terms, accents or names. If error rates are higher for people with certain accents or disabilities, that could support an indirect discrimination claim.
• Privilege. Transcripts, summaries and action lists create a wider paper trail around legal advice. Privilege can be lost if the material reaches people outside the group entitled to it, and a supplier’s terms that allow reuse make this worse.
• Disclosure. A transcript creates a record that never existed before, and it may have to be handed over in litigation or an investigation.
• Accidental recording. A tool left running after the formal part of a meeting can capture informal comments and send them to the people discussed.
• Candour. People speak less openly when they know every word is transcribed, which can make a difficult conversation harder to resolve.

The same note recommends a clear transcript policy with an accountable owner, reviewing whether transcription should be on by default, and leaving out sensitive meetings such as board discussions, legal advice and formal HR meetings. That is sound advice for a small business too. For those meetings, a human note-taker whose notes are checked by the people present is usually safer, and keeps a human in the loop where it counts.

Does the EU AI Act apply to meeting notes?

For plain transcription, mostly not, but there is one firm line to know about.

Law firm commentary says pure speech-to-text tools are generally not high-risk, as long as they do not go on to assess or decide anything. The position changes if transcription is combined with analysis, such as monitoring employee performance, because AI used in employment can fall into the high-risk category. Our summary of what the EU AI Act requires of a small business shows how to check where a tool sits.

The firm line is a ban. Since 2 February 2025, the EU AI Act prohibits using AI to infer people’s emotions in the workplace, with narrow medical and safety exceptions. That matters because some meeting tools advertise features such as engagement scores, mood tracking or “sentiment per speaker”. Commentators differ on exactly how far the ban reaches into meeting tools, and text-only sentiment analysis is generally treated as outside it. The simple rule for a small business is to switch off any feature that scores how people feel, and to ask the supplier in writing what it does before you rely on it.

What are the biggest Risks of AI note-takers?

Most real-world problems with meeting notes are not exotic. They are ordinary and avoidable.

1. An uninvited bot. A tool linked to one person’s calendar joins calls that person did not expect it to join, including with clients.
2. Shadow use. Staff sign up for a free tool on a personal account, which puts your meetings outside your contract and your control. This is shadow AI, and banning tools without an alternative tends to push it further out of sight.
3. A wrong summary. AI summaries can invent a decision no one made or leave out the one that mattered. A summary that goes to a client unchecked is a liability, so use the method in our guide on checking AI output.
4. Long retention. Old recordings are a data breach waiting for the wrong person to open them.
5. Open access. A transcript shared with everyone on the invite list can reach people who should not see it.
6. Training on your data. Meeting content is some of the most confidential material a business creates.

Notice that none of these is solved by a ban on the technology. They are solved by choosing a tool on purpose, configuring it and writing down the rules.

How to use AI meeting notes legally

Here is a checklist a small business can finish in a week. It follows the order in which things go wrong.

1. Pick one approved tool and account. List the tools in use, including the unofficial ones, in an AI tool inventory. Choose one business account and make it the easy option.
2. Read the contract and the settings. Confirm there is a data processing agreement, that training on your data is off, and where data is stored.
3. Decide your lawful basis and write it down. One page: the purpose, why a recording is needed, what less intrusive options you considered and why they fell short.
4. Do a short risk assessment. Where it is likely to carry a high risk, do a full data protection impact assessment. Otherwise a short note is still worth the time.
5. Write the notice. One line for the invitation, one for the start of the call.
6. List the meetings that are off limits. Board, legal advice, formal HR meetings, anything involving special category data. Say in advance what happens instead.
7. Switch off sentiment and engagement features. And say so in the policy.
8. Set a retention period. Keep the summary and actions, delete the audio and full transcript once the notes are approved.
9. Name an owner and a reviewer. An unowned tool drifts. Governance is simply knowing whose job it is.
10. Check summaries before they leave the building. A person reads and corrects them.
11. Keep a record. An audit trail of who switched what on and when helps if a complaint arrives.

Put the rules in your AI policy. Our guide on writing an AI use policy gives a one-page structure, and AI governance for small and mid-sized businesses shows how a policy, a named owner and a review date fit together. Our definition of AI transcription is a good page to share with colleagues who are new to the idea.

If you would like help finding out which note-takers are already in use in your business and what each is doing with the data, an AI audit maps it in a structured way and gives you the inventory and the rules in one pass.

Verdict

AI meeting notes are legal to use, and for most teams they are worth using. The tools save real time, and the legal risk comes from how they are used, not from the technology. The cases that go wrong share a pattern: a bot that no one was told about, a free account no one approved, a supplier that kept the recordings, or a transcript of a meeting that should never have been recorded.

The fix is dull but effective. Tell people, pick one tool, switch off what you do not need, keep sensitive meetings out, and write the rules on one page. Do that and AI meeting notes become an ordinary, defensible part of how your business works. If your meetings cross borders or involve employment matters, ask your own legal adviser to check the details for the countries involved.

Further reading

• What is safe to paste into AI tools
• How to write an AI use policy for your team
• What the EU AI Act requires of a small business
• How to choose an AI vendor
• Otter, Fireflies or Copilot: which meeting tool

Sources

• Regulation (EU) 2016/679 (GDPR): the lawful bases, transparency, processor, retention and access duties referred to above.
• Regulation (EU) 2024/1689 (the EU AI Act): the text, including the prohibited practices in Article 5.
• EDPB, Guidelines 05/2020 on consent under Regulation 2016/679: consent must be freely given, specific, informed and unambiguous.
• EDPB, Guidelines 1/2024 on processing personal data based on Article 6(1)(f) GDPR: the regulator’s guidance on legitimate interests.
• ICO, Legitimate interests: the three-part test of purpose, necessity and balancing.
• Microsoft Learn, Manage participant agreement for recording and transcription: how the Teams consent setting works and that it is off by default (page updated May 2026).
• Linklaters, On the record: AI transcription and the legal risks for employers: published 1 July 2026; the employer risks and practical steps.
• Heuking, Legally compliant use of AI transcription tools in businesses: 30 April 2026; German criminal law on recording, consent and legitimate interest, and the AI Act position.
• NPR, Class-action suit claims Otter AI secretly records private work conversations: the allegations and Otter’s response, reported August 2025.
• Lewis Silkin, Understanding the EU AI Act’s prohibited practices: the workplace ban on emotion recognition and its limits.