AI note-takers have become part of the furniture fast. You start a Teams, Zoom, or Google Meet call, a bot joins to listen, and a few minutes later everyone’s got a tidy summary with action items sitting in their inbox.
It’s a real time-saver, which is exactly why staff turn one on before anyone’s asked the obvious question: where does that recording actually go?
Here’s the part that gets skipped. Every word said in that meeting — including the parts nobody would ever put in an email — gets captured, stored somewhere, and read by whoever has access to it. Most business owners haven’t stopped to ask who “whoever” includes.
What an AI note-taker actually does
An AI note-taker joins a meeting, records the audio (and sometimes video), turns the speech into a transcript, and writes up a summary. Microsoft 365 Copilot in Teams, Otter, Fireflies, and Fathom are the ones we see most.
Most of these connect straight to a calendar so they can join automatically — and some will sit in on every meeting on your schedule unless someone turns that setting off.
The recording doesn’t disappear when the call ends. It gets saved, usually in the cloud, where it can be searched, shared, and pulled up months later. Where it lives, and who can reach it, comes down to which tool you’re using.
Who can actually see the recording?
Start with the obvious group: whoever the meeting organizer shares the summary with. A lot of these tools email the transcript to every attendee by default — and some send it to people who were invited but never actually showed up. If the meeting covered something sensitive, that distribution list matters more than people realize.
Then there’s the tool’s own access. With a cloud note-taker, the recording sits on the vendor’s servers, which means the vendor’s systems — and in some cases its staff — can reach it under whatever terms you agreed to when you clicked “accept” without reading them (we’ve all done it).
If the bot auto-joined from someone’s calendar, the recording might be sitting on an account you don’t control at all, tied to whichever employee connected it in the first place.
One law firm’s write-up on the legal risks of AI note-takers put it plainly: letting a note-taker vendor access or use your transcripts for its own purposes can risk waiving attorney-client privilege for businesses handling legal matters.
Does it train the AI on your meetings?
This is where the tools split, and it’s worth checking before you pick one.
Microsoft says Copilot in Teams doesn’t use your prompts, responses, or meeting content to train its AI models, and that the data stays inside your organization’s own Microsoft 365 environment. That’s stated directly in Microsoft’s privacy documentation.
Third-party note-takers are all over the map. Some store your recordings on their own servers and, depending on the fine print you agreed to, may use that data to improve their models. Others say flatly they don’t train on customer data at all. The only way to actually know is to read that specific tool’s privacy terms — two note-takers that look identical on the surface can treat your data completely differently underneath.
The consent question
Recording a meeting isn’t always yours to decide alone, and the rules shift depending on where the people on the call are sitting.
In about a dozen U.S. states, and most Australian states, everyone on the call has to agree to being recorded. Federal U.S. law, most other states, and the UK only require one participant’s consent. On top of that, the UK and Europe treat a recording as handling someone’s personal data, so under GDPR you generally have to tell people you’re recording, explain why, and have a real reason for it.
Our take: the safest habit, everywhere, is to just say it out loud — “this meeting is being recorded” — explain why, and give people a chance to object before the bot joins. For client calls, HR conversations, and anything under an NDA, that matters even more. Sometimes it’s worth a quick check with a lawyer before you record at all.
How to use these tools without the headache
You don’t have to ban AI note-takers to use them safely. A few habits go a long way:
- Pick one approved tool, and say so. Decide which note-taker your team uses, and ask everyone else not to connect their own to company meetings. Keeps your recordings in one place you actually control.
- Turn off auto-join. Set it to join only when someone chooses to record — not automatically for every meeting on the calendar.
- Announce it, every time. Make “this call is being recorded” a normal opening line, and skip recording if someone objects.
- Favor tools that keep data in your environment. A note-taker that stores recordings inside your own Microsoft or Google tenant — and doesn’t train on your data — is a lot easier to control than one holding everything on its own servers.
- Check who gets the summary by default. Make sure it’s not auto-emailing the transcript to everyone, including people who missed the meeting entirely.
- Keep bots out of sensitive meetings. Legal, HR, financial, and confidential client conversations should default to no recording unless there’s a clear reason and everyone’s on board.
If you’re on Microsoft 365, an admin can control whether Copilot and transcription are even allowed in Teams meetings — one setting, instead of hoping every employee gets it right on their own.
Frequently Asked Questions
Is it legal to record a meeting with an AI note-taker?
Depends on who’s in the room and where they’re sitting. About a dozen U.S. states and most Australian states require everyone’s consent. The UK, federal U.S. law, and most U.S. states allow it with just one person’s consent — though the UK and Europe also require you to inform people and have a valid reason under data-protection law. Safest move everywhere: announce it and let people object before it starts.
Does Microsoft Copilot use my meeting data to train its AI?
No. Microsoft states that Copilot in Teams doesn’t use your meeting content, prompts, or responses to train its foundation AI models, and the data stays inside your organization’s Microsoft 365 environment.
Can an AI note-taker join a meeting without me knowing?
Yes — plenty of tools connect to a user’s calendar and auto-join, sometimes for meetings that user isn’t even attending. Turning off auto-join means the bot only records when someone actually chooses to start it.
Where do AI note-taker recordings get stored?
In the cloud. With Microsoft Copilot, it stays inside your Microsoft 365 tenant. With a lot of third-party tools, recordings sit on the vendor’s own servers. Where it lives and who can reach it depends entirely on the tool — check its terms.
Should we let staff use Otter or Fireflies for work?
You can, with a few rules in place: pick one approved tool, turn off auto-join, announce recording and get consent, understand how the tool actually handles your data, and keep it out of legal, HR, and confidential client meetings.
Graham’s Take
I’ve seen more than a few businesses turn on an AI note-taker without ever asking where the recording lands. It’s not usually a bad-actor problem — it’s a “nobody thought to check” problem. That’s exactly the kind of thing we look at in a free IT checkup: not scare tactics, just a plain-language look at what’s actually connected to your systems and who can see it.
