What should our AI policy say about recording and transcribing meetings?

21 October 2026

Set a clear default: ask, explain and offer an alternative

Your AI policy should say that nobody may start a meeting recording or transcription bot without telling every participant first, explaining the purpose and checking that the meeting is suitable. The rule applies to employees, clients and suppliers, whether the tool joins visibly as a bot or records through a laptop. A calendar notice is useful, but the chair should also say it aloud at the start. If someone objects, stop and offer notes taken by a person or a written summary approved afterwards.

Do not confuse courtesy with legal basis. Under UK GDPR, organisations need an appropriate lawful basis for processing personal data. Consent is not always the right basis, especially where an employee may feel unable to refuse. Your data protection lead should document the basis for each use case and update privacy notices. The ICO guidance on AI and data protection covers accountability, transparency and accuracy. Its guidance is being reviewed after the Data (Use and Access) Act, so check the current version before finalising a policy.

Write a practical meeting-opening script: “We would like to use our approved tool to make a transcript and action summary for the project team. The recording will be accessible only to named staff and deleted after 30 days. Is anyone uncomfortable with that?” This is an example, not a claim that a verbal yes cures every compliance issue. Staff should know exactly what to do when somebody says no. A client contract may prohibit recording outright, in which case the answer is no regardless of the tool's convenience.

Make the rule apply to mobile apps and built-in meeting features too. If the policy only names a bot such as Otter.ai, staff can accidentally bypass it using Teams, Zoom or a phone recorder. The policy should control the activity, not merely the supplier name.

Decide which meetings must never be recorded

Put exclusions in writing. Do not record disciplinary or grievance meetings, confidential legal advice, sensitive health discussions, safeguarding matters, negotiations covered by a confidentiality restriction, or any meeting where the client agreement forbids it, unless a named senior owner and data protection contact approve a specific exception. A recording can capture far more than the intended action list: private remarks, screen-shared files, family information and third-party names may all be retained.

Staff should pause recording when an unexpected sensitive topic arises. They should not try to edit the recording later and pretend the collection never happened. Stop the capture, note what was collected, and follow the deletion or incident process. An AI note-taker that automatically joins every calendar event is a particularly poor default. Disable auto-join. Require the organiser to select eligible meetings deliberately.

Do not use a transcript as a secret performance-monitoring tool. If management wants to analyse employees' speech or sentiment, that is a separate purpose requiring its own assessment and clear notice. A transcription policy should not smuggle surveillance into a routine productivity workflow. The UK's ICO guidance on monitoring workers is relevant when recordings could be used to assess staff.

Practical test: ask whether you would be comfortable giving every attendee a copy of the exact recording and explaining why you kept it. If not, take notes instead. This is not a legal test, but it catches many poor decisions before data is collected. For board, HR and commercially sensitive meetings, a human note-taker may be cheaper than the later cost of correcting an unnecessary recording.

Choose approved tools and control where the data goes

The policy should list approved products and accounts, not allow any employee to connect a free app to their calendar. Microsoft Teams, Zoom and specialist tools such as Otter.ai offer different recording, storage, sharing and AI-summary settings. Microsoft says Teams notifies participants when recording starts, but that product notification does not replace your own explanation of purpose and retention. Review the specific plan you will use. Ask where recordings and transcripts are stored, whether a supplier or its subprocessors can use the content to improve models, who can access it, what happens on account closure and whether deletion propagates to backups.

Use a company-owned account with single sign-on and multi-factor authentication where possible. Limit permissions to the meeting organiser and necessary project team, not everyone with the link. Disable automatic external sharing and public transcript links. Check integration permissions: a note-taking bot may ask for access to every calendar event, chat and file when it only needs one meeting. Start with the narrowest workable access and review it quarterly.

A data processing agreement is important when a vendor processes personal data for you. Check international transfers and retention settings. UK GDPR does not say that every recording must remain physically in the UK, but the arrangement must meet the law's requirements. “Hosted in Europe” is not a complete answer to who can access data or where backups sit. If the meeting includes special category data, seek specific advice before turning on capture.

Make a named owner responsible for the tool inventory and settings. A simple register can record supplier, plan, purpose, lawful basis, retention, administrator and last review date. Without an owner, a trial subscription can become an unmanaged archive of confidential conversations. Give new starters a 15-minute walkthrough showing how to start, pause, delete and share recordings correctly.

Set retention, access and correction rules

Do not write “keep recordings as long as needed” and leave everyone guessing. Choose a default retention period for each purpose, such as 30 days for raw audio and 90 days for approved action summaries, then document why. Those are example policy choices, not statutory periods. Client contract terms, legal holds and regulated records may require a different schedule. Configure automatic deletion rather than relying on an organiser to remember.

Separate raw audio, transcript and edited minutes. They are not the same record. The transcript may mishear names, amounts and commitments; the summary may omit a caveat or invent an action. Require the organiser to check decisions, dates, figures and owners against the recording before sending minutes. For high-value client commitments, ask participants to confirm the written outcome. A transcript is supporting evidence, not an infallible account.

Record who may download material, whether it may be sent to external parties and how a person can request correction or deletion. A meeting attendee may exercise data rights, subject to applicable exemptions. Have a route to locate recordings across accounts and exports. If staff can download a transcript to a personal device, your central retention setting alone does not solve the problem.

Include a breach path: if a recording goes to the wrong recipient or a public link is exposed, staff must report it immediately to a named contact, not quietly delete the link. The organisation can then contain it, assess the risk and decide whether notification is required. Do not put a blanket “AI summaries may contain errors” disclaimer on every email and consider the job done. Verification is an operational step, not a disclaimer.

Use a short policy staff can actually follow

A useful one-page rule has seven parts: approved tools; meetings that are excluded; notice to participants; lawful-basis and privacy-notice requirements; access and retention; human review of outputs; and the incident route. Add a link to the fuller data-protection assessment for managers. Staff should not need to read a 40-page governance document before a client call. Put the checklist where meetings are scheduled.

Try a four-week pilot with one team and a narrow use case, such as internal project meetings. Measure whether summaries are accurate, whether action follow-up improves and whether anyone feels pressured by recording. Sample at least 20 meetings and log errors, objections and accidental captures. Do not judge success by the number of transcripts produced. If the meeting already has a reliable note-taker, a bot may add risk without saving meaningful time.

At the end of the pilot, review the policy with the staff who actually used it. Ask what the tool got wrong and what they found awkward. If clients object regularly, change the workflow rather than training staff to persuade them. If action summaries save 15 minutes but checking them takes 20 minutes, stop or choose a simpler template. The right answer is a controlled process, not a universal recording mandate.

When this is not right for you: if you handle exceptionally sensitive conversations, lack a clear owner for recordings, or cannot verify the vendor's data terms, do not deploy an AI meeting bot yet. Human notes are a perfectly good alternative. If you want an outside review of an existing policy, bring your actual tool settings, retention plan and sample meeting types to the discussion. That makes the advice practical rather than generic.

Is This Right For You?

Use AI transcription for suitable meetings when a named owner can manage notice, security, deletion and review. It is not right for confidential or sensitive discussions without specific approval, or for teams that cannot control where recordings go.

Human notes remain a valid alternative. If you want to review your current tool and policy, bring the supplier settings and a few real meeting types to an initial conversation.

Frequently Asked Questions

Do we always need consent to record a meeting?

Not necessarily. Identify and document an appropriate UK GDPR lawful basis. Employee consent may not be freely given.

Can we record a client call if the contract is silent?

Check your privacy information, purpose, lawful basis and participant notice first. Silence in a contract is not automatic permission.

Should an AI bot join every meeting automatically?

No. Disable auto-join and select suitable meetings deliberately.

How long should transcripts be kept?

Set a justified period for each purpose and configure automatic deletion. Thirty days for raw audio is an example, not a legal rule.

Can we send an AI transcript straight to a client?

No. Check names, figures, decisions and commitments, then send an approved summary if appropriate.

What if someone objects to recording?

Stop and use human notes or another agreed method. Follow any contractual restrictions as well.