1 August 2026

Who Can See What Your AI Note-Taker Records?

Photo by Diva Plavalaguna on Pexels

AI note-takers have become normal in a short space of time. You start a Teams, Zoom or Google Meet call, a bot joins to record the conversation, and minutes later everyone gets a tidy summary with action points.

It saves real time, which is exactly why staff often start using these tools on their own, before anyone has asked where the recording actually ends up. Here at Atema, we work with a lot of small and mid-sized businesses across the South West, and we're seeing this pattern show up more and more: someone connects Copilot, Otter or Fireflies to their calendar because it's genuinely useful, and nobody has stopped to check who else can see what it records.

The issue is that every word of the meeting, including the parts nobody would ever put in writing, gets captured, stored somewhere, and read by whoever has access. Before you let one of these tools into a client or staff meeting, it's worth knowing exactly where that recording goes.

What an AI note-taker actually does

An AI note-taker is a tool that joins a meeting, records the audio (and sometimes the video), turns the speech into a written transcript, and produces a summary. Common examples include Microsoft 365 Copilot in Teams, Otter, Fireflies and Fathom.

Most of these tools connect to your calendar so they can join automatically, and some will sit in on any meeting on your schedule unless you specifically turn that setting off.

The recording and transcript don't disappear when the call ends. They're saved, usually in the cloud, where they can be searched, shared and exported later. Where they're saved, and who can reach them, depends entirely on which tool you use.

Who can actually see the recording?

Start with the obvious group: anyone the meeting organiser shares the summary with. Many note-takers email the transcript to every attendee by default, and some send it to people who were invited but never actually joined. When the meeting covered something sensitive, that distribution list matters more than most people realise.

Then there's the tool's own access. With a cloud note-taker, the recording sits on the vendor's servers, which means the vendor's systems, and in some cases its staff, can reach it under the terms you agreed to when you signed up. If the tool auto-joined from someone's calendar, the recording may live on an account you don't control at all, tied to whichever employee connected the bot in the first place.

If your business handles legally sensitive or privileged conversations, whether that's ongoing litigation, HR investigations or confidential client matters, it's worth thinking through with your usual legal adviser whether letting a third-party vendor store (and potentially retain) transcripts of those conversations is a risk you're comfortable with.

Does the tool use your meetings to train its AI?

This is where tools differ the most, and it's worth checking before you settle on one.

Microsoft states that Copilot in Teams does not use your prompts, responses or meeting content to train its underlying AI models, and that this data stays within your organisation's own Microsoft 365 environment rather than being fed into training for the wider service.

Third-party note-takers vary a lot more. Some store your recordings on their own servers and, depending on the terms you accept, may use that data to improve their models. Others state clearly that they don't train on customer data at all. The only way to know for certain is to read the specific tool's privacy terms, because two tools that look almost identical on the surface can treat your data very differently underneath.

The consent question in the UK

Recording a meeting isn't automatically yours to decide alone, and UK law treats it differently to how you might expect.

Under the Telecommunications (Lawful Business Practice) Regulations 2000, a UK business doesn't need everyone's prior consent just to record a call for legitimate business purposes. But that's only half the picture. Because a recording of people talking counts as their personal data, UK GDPR also applies, and the ICO's guidance is that you need a proper lawful basis for recording, and you generally have to tell the people in the meeting that it's happening and why.

In practice, that means the safest approach is the simplest one: say at the start of the meeting that it's being recorded, explain why, and give people the chance to object before the bot joins in earnest. For client meetings, HR conversations, and anything covered by confidentiality, that matters even more, and it's worth building it into how your team runs meetings as standard, not something you only think about after the fact.

How to use AI note-takers safely

You don't have to ban these tools to use them responsibly. A few sensible rules cover most of the risk:

• Pick one approved tool and say so. Decide which note-taker your business uses, and ask staff not to connect others to company meetings. This keeps your recordings in one place you actually control.
• Turn off auto-join. Set the tool to join only when someone deliberately chooses to record, rather than automatically for every meeting on a calendar.
• Announce recording and get consent. Make it normal to say a meeting is being recorded at the start, and to skip recording when someone objects.
• Prefer tools that keep data in your own environment. A note-taker that stores recordings inside your own Microsoft or Google tenant, and doesn't train on your data, is far easier to control than one that holds everything on its own servers.
• Control who gets the summary. Check the default sharing setting so transcripts aren't emailed to everyone, including people who missed the meeting entirely.
• Keep bots out of sensitive meetings. For legal, HR, financial and confidential client conversations, the default should be no recording unless there's a clear reason and everyone agrees.

If your business runs on Microsoft 365, an administrator can control whether Copilot and transcription are allowed in Teams meetings at all, which gives you one place to set the rule rather than relying on each person to get it right. This is exactly the sort of thing our Microsoft 365 & cloud support covers as part of ongoing management, rather than something left to whoever set the tenant up originally. If you'd like us to review how your team is using these tools and tighten up the settings, book a call with our team and we'll take it from there.