Yes, a small business can use an AI note-taker, as long as everyone in the meeting is told before it starts, anyone can say no, and you know where the transcript goes afterward. That is the common thread in UK data protection guidance and US recording law. A note-taker that cannot be switched off for a single meeting does not belong in your business.
Most owners meet this question the wrong way round. A team member starts using a note-taker because it saves them an hour, on a Tuesday, in a client call, and the question of permission arrives months later, usually when a client asks who else was listening. This article puts the steps in the right order: a rule, a table of which meetings get a note-taker and which do not, a sentence to say out loud, and a card that settles where the transcript lives. It is general information, not legal advice, and the rules differ by state and country.
What is the real risk of letting an AI note-taker join a meeting?
The risk is not the notes. It is that a third party joins the conversation, keeps a word-for-word copy, and may use it in ways nobody in the room agreed to. Four things can go wrong, and each has a different owner.
The first is the people: someone in the meeting did not know a recording was running and finds out from the follow-up email. The second is the law, because recording and data protection rules apply to a transcript just as they do to audio. The third is the transcript itself: who in your business can read it, how long it is kept, and whether the provider uses it for anything else. The fourth is the record: an AI summary that gets a date or a promise wrong becomes the version everyone remembers.
How common is this? In a survey of 1,000 full-time professionals, last updated September 23, 2026, the comparison site Software Finder reported that 40% never use AI note-taking and 19% use it frequently. The page does not state the country or the fieldwork dates, and the answers are self-reported, so read it as a signal, not a measurement. Its more telling finding is that 3 in 10 said they had skipped a meeting assuming AI would cover for them. When the transcript replaces the person, it becomes the only record.
Your staff may already be doing this on their own accounts. If so, start with what to do about shadow AI, then come back here for the rule.
What does the law say about recording a meeting?
In the US, federal law requires the consent of one party to a conversation, but a minority of states require everyone's. The Reporters Committee for Freedom of the Press, in its recording guide for journalists, says "about 11 states primarily have all-party consent requirements" and lists California, Delaware, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, New Hampshire, Pennsylvania and Washington. A further group applies the stricter rule only to phone calls or only to in-person talks, and the guide warns that rules can vary even within a state. The page carries no printed date, and I read it on November 6, 2026.
Which state's law governs a call between people in two states is a question for a lawyer. The working assumption I suggest is the stricter rule: if anyone on the call might be in one of those states, treat the call as needing everyone's agreement.
Lawsuits are testing the same ground. On August 6, 2026, the Robinson & Cole privacy blog described a new California federal lawsuit against one AI note-taker provider. It alleges that the provider recorded a participant on a virtual meeting without telling them an AI note-taker was present, and that meeting content was used for AI training by default unless the user turned that off. The claims include the federal Electronic Communications Privacy Act and several California statutes. The allegations are unproven. The post's advice to businesses is plain: check that participants get clear notice before recording starts, that consent is obtained from all required parties, that people can object, and whether the data trains models by default.
In the UK, the broker Lockton wrote on October 24, 2025 that the Investigatory Powers Act 2016 makes it a criminal offence to intercept a private communication without appropriate authority or consent. Its advice: "The safest course is to obtain all participants' explicit consent before enabling any AI notetaker." I have not read the Act itself, so check the point with a solicitor before you rely on it.
Is consent the right word for your own staff?
For your own staff, usually not. The Information Commissioner's Office (ICO) guidance on monitoring workers says: "consent is not usually appropriate in the employment context, due to the imbalance of power between you and your workers." The same page says you "must tell workers about monitoring in a way that is accessible and easy to understand," and that legitimate interests may not be the right lawful basis if "you are monitoring in ways workers do not understand and would not reasonably expect." It also requires a data protection impact assessment (DPIA) before processing likely to cause high risk to workers. The page is undated, notes that it is under review since the Data (Use and Access) Act became law on June 19, 2025, and does not mention meeting transcription by name. What follows is my reading, not the ICO's.
A yes given to your boss is not freely given. So with your own team, tell people in writing what the note-taker is for, what is kept and for how long, and how to ask for a meeting without it, and decide on a lawful basis you could explain to a regulator. With clients, suppliers and candidates, ask. Advisers disagree on the word: Data Protection People, a UK consultancy, says explicit consent is required "in most cases" before recording or transcribing a meeting. They agree on the practice, which is to tell people first and give them a way out. My piece on telling clients when you use AI covers the wider question.
What is the Open Room Rule?
This is my suggested way of thinking, not established research.
The Open Room Rule is one rule for any AI that listens to a meeting: nobody in the room should learn from the transcript that it was there. Everyone is told before it starts, in words they cannot miss, anyone can say no without penalty, and a named person owns what happens to the transcript. A tool that cannot meet that rule does not join the meeting.
Take a hypothetical 12-person bookkeeping firm. A partner has been running a note-taker on client calls for three months. A client asks in an email whether last week's call was recorded. Under the Open Room Rule, the partner could have answered before the client asked: the invitation said so, the first sentence of the call said so, one client had asked for it to be off and it was, and the firm's card says the transcript is deleted after 30 days. Nothing about the tool changed. The firm simply stopped letting the room find out by accident.
Which meetings should get an AI note-taker, and which should not?
Use this table as a starting default and change it with your adviser. It is my suggestion, not law.
| Meeting | Default | Condition |
|---|---|---|
| Routine internal team meeting | Allowed | Staff told in writing; anyone can ask for it off; transcript stays in the company account |
| Client or customer call | Ask first | Say so in the invitation and again at the start; if anyone declines, it stays off |
| Supplier or partner call | Ask first | Same as a client call |
| Any call where someone might be in an all-party consent state, or you do not know | Ask first | Treat as a client call and get a clear yes from everyone |
| Job interview | No by default | If you use one, send the notice before and never let the summary decide; see AI and screening applicants |
| Performance, disciplinary, grievance or redundancy conversation | No | A person takes notes the employee can see |
| Meeting with your lawyer, accountant or other adviser | Ask them first | Their confidentiality terms may be affected |
| Board or strategy meeting with commercial secrets | Only with the card complete | Training use off, retention set, owner named |
What should you say at the start of the meeting?
Say it in the invitation, and say it again out loud at the start. A sentence in a calendar invite is easy to miss; a sentence spoken to the room is not.
"Before we start: I'd like to use an AI note-taker on this call so I can listen instead of writing. It records and transcribes, and the transcript stays in our company account for 30 days. Is anyone not comfortable with that? If so, I'll switch it off and take notes by hand."
Pick your own number of days. Then do what you said: if one person says no, it goes off for everyone, and you do not ask twice. If the conversation turns to something sensitive, pause it and say so.
Where should the transcript live, and who checks it?
Settle it in five lines. I call this the Note-Taker Card, and you fill one in for each tool in use.
| Line | What you write |
|---|---|
| Whose account | The company account, never a personal one |
| Who can read transcripts | The people in the meeting and one named manager |
| Training | Is our content used to train the provider's models? Find the setting and turn it off |
| Retention | How many days, and who deletes them |
| Owner | One named person who answers if it goes wrong |
Then check the summary. A transcript is a record of what was said; a summary is a claim about what it meant, and it can be wrong with great confidence. Use the Loop Test I put to any leader who says a human checks the output:
The Loop Test is three questions I ask before accepting "a human checks it" as an answer: Would that person notice a wrong result without being told to look for it? Would they notice in time to stop it mattering? And if they missed it, could the work be put back? Oversight that survives all three is a safeguard. Oversight that fails any of them is a signature.
A summary that says a client agreed to a delivery date passes the test only if the person reading it was on the call and reads it before it is sent on. Someone who skipped the meeting cannot notice the error. My guide to training staff to check AI output shows how to teach that skill. If the transcript contains customer or staff data, is your business data ready for AI covers what to settle first.
What I See When I Train Business Teams
Across the business teams I train, the note-taker arrives before the rule does. Someone finds it saves an hour a day, adds it to their calls, and nobody has asked the client. The tool is rarely the problem. The missing sentence at the start of the call is.
As a former teacher, assistant headteacher and Director of Digital Strategy in further education, I think of rules as things a person must be able to say out loud. That is why I treat this as a habit to teach, not a setting to configure. Outsource the doing, not the thinking: a note-taker can record what was said, but a person has to own what it means.
What can a 20-person business do this week?
Do these five things in five working days, with no project and no budget meeting.
- Ask who is already using one. Send one message to the team asking who uses an AI note-taker, on which calls, and on whose account. Make it clear nobody is in trouble.
- Fill in a Note-Taker Card for each tool you find. Check the training and retention settings yourself rather than trusting the default.
- Adopt the table. Mark the "No" meetings in the calendar so nobody has to decide on the day.
- Add the sentence. Put one line in your invitation template and the spoken script where every meeting leader can find it.
- Name an owner and a date. One person owns the card, and in four weeks you review it. If you have not yet written down your wider rules, does a small business need an AI policy and the UK small-business AI policy template are the place to put them. If you are choosing suppliers who record or transcribe on your behalf, questions to ask suppliers who use AI is the matching checklist.
Where to go next
If your team is already using AI in meetings and nobody has shown them how to do it well and safely, that is what my AI training for teams is built for. If you want to know where your business stands before you decide, take the Business AI Readiness Scorecard. And if you run a chamber, trade association or industry event, you can book me to speak. This article is general information and not legal advice.
Sources and further reading
- Kathryn Rattigan, "AI Meeting Tools Face Wiretapping Wake-Up Call", Data Privacy + Cybersecurity Insider, Robinson & Cole LLP, August 6, 2026. dataprivacyandsecurityinsider.com
- Information Commissioner's Office, "Data protection and monitoring workers", ICO guidance (undated; under review since June 19, 2025; read November 6, 2026). ico.org.uk
- Reporters Committee for Freedom of the Press, "Introduction to the Reporter's Recording Guide" (undated; read November 6, 2026). rcfp.org
- Software Finder, "AI Note Taking at Work: Benefits and Drawbacks", last updated September 23, 2026. softwarefinder.com
- Lockton, "AI notetaking: risk management best practices", October 24, 2025. lockton.com
- Data Protection People, "AI Note-Takers in the Workplace" (undated). dataprotectionpeople.com
Dan Fitzpatrick is a keynote speaker, Forbes contributor and five-times bestselling author who has trained more than 150,000 educators in 30+ countries.
