Who's Taking Minutes? The AI Notetaker Sitting in Your Client Calls

It usually starts innocently enough. Someone has a diary full of calls, a pile of action points, and a free trial of an AI notetaker. They click allow, invite the bot to the next meeting, and suddenly there's a transcript, a summary, and a list of next steps in their inbox. Brilliant. Except the bot is now a third party in the room, and nobody in the business has agreed what happens to the recording afterwards.

This isn't a niche problem. AI meeting assistants are being bundled into video platforms, added to browsers, and installed on phones. They join Teams, Zoom, and Google Meet calls without much ceremony. For a UK small business, the productivity gain is real. So is the data protection question.

How the bot gets in without anyone noticing

Most AI notetakers arrive through the side door. A manager sees a demo on LinkedIn. An account manager wants better client records. A director tries a tool on a Saturday and likes it. The tool then gets an OAuth permission to read calendars, join meetings, and store transcripts in its own cloud. No procurement form, no IT review, no mention in the staff handbook.

That is classic shadow IT, but with a twist: the data isn't just sitting in a spreadsheet. It is a verbatim record of conversations. Client calls often contain pricing, complaints, personal circumstances, staff names, and commercial plans. Some contain special category data, such as health details or trade union membership, even when nobody intended to share it.

Once a transcript exists, it can be searched, exported, and retained for years. It can also be used to train a model unless the settings say otherwise. That last point is worth checking carefully. Not every vendor trains on customer data, but the default is not always obvious.

What UK data protection actually expects

Under UK GDPR and the Data Protection Act 2018, you need a lawful basis for processing personal data. Consent is one option, but it is not the only one and it is often the wrong tool for a business call. If you rely on consent, people must be able to refuse without consequence, which is awkward when the client is on the other side of a contract renewal.

More often, a small business will rely on legitimate interests or contractual necessity. That does not mean anything goes. You still need to be transparent. Participants should know a recording or transcript is being made, why it is being made, who can access it, and how long it will be kept.

The ICO's guidance on AI and data protection is clear that accountability matters. You need to understand what the tool does with the data, where it is stored, and who else can see it. If the vendor processes data outside the UK, you need appropriate safeguards. If the tool records calls, you need a retention rule, not a vague hope that someone will tidy up eventually.

And if you are recording client calls, do not bury the notice in a 40-page terms document. Say it at the start, put it in the calendar invite, or use the platform's recording indicator. Transparency is not a legal ritual; it is basic courtesy with a compliance edge.

The 30-minute audit

You can get a useful picture in half an hour. Do this with a laptop, a notepad, and access to the relevant admin consoles.

1. List the tools. Ask the team which AI notetakers they use, including browser extensions and mobile apps. Check calendar integrations for bots you do not recognise.
2. Check the permissions. In Microsoft 365 or Google Workspace, review third-party app access. Look for anything that can read calendars, join meetings, or access files. Remove what nobody can justify.
3. Find the storage. For each tool, identify where transcripts are held, who owns the account, and whether the business can export or delete them. A personal free account is a red flag.
4. Read the privacy settings. Check whether the vendor trains models on your data. Find the retention default. Look for a data processing agreement.
5. Sample the content. Open two or three recent transcripts. Would you be comfortable if a client asked to see that record? If not, the tool is capturing more than you want.
6. Check the meeting default. Some tools auto-join every calendar event. That means internal HR chats and client calls are treated the same. Turn off auto-join and require a manual start.
7. Write down the gaps. You do not need a完美 policy in 30 minutes. You need a list of what is running, what it holds, and what needs fixing.

A meeting-bot policy people will actually follow

A policy that says "no AI tools" will be ignored by Friday. A better approach is to set clear rules for the tools you are willing to support.

• Approved tools only. Publish a short list of AI notetakers that have been reviewed. Anything else needs sign-off from whoever owns IT and data protection.
• Tell people at the start. Add a line to the calendar invite and say it out loud on external calls: "We use an AI notetaker to capture actions. It will be recorded and stored in our workspace. Is that okay?" If someone objects, turn it off.
• Use business accounts. No personal Gmail or free trials holding client transcripts. The business needs control of the account and the ability to delete data.
• Set a retention period. Thirty days is a sensible starting point for many small firms. Ninety days if you need a longer record. "Forever" is not a retention policy.
• Limit access. Transcripts should be available to the meeting owner and relevant team members, not the whole company by default.
• Review quarterly. Tools change their terms. A quick quarterly check of permissions and retention settings stops small drift becoming a big problem.

The productivity win is worth keeping

None of this means banning AI meeting notes. Used properly, they are genuinely useful. They help smaller firms keep accurate client records, reduce the "who agreed to what?" email chain, and make meetings more accessible for people who struggle with live note-taking.

The point is to make the choice deliberate. A bot in the room should be a decision, not an accident. Spend half an hour understanding what is already running, then write a one-page policy that tells staff what good looks like. Your clients get the same helpful follow-up email. You get a clearer answer when someone asks where that recording lives.