AI note-taking tools are convenient. They join a video call, record it, produce a transcript, and summarize action items. For a busy attorney, that is appealing. For a law firm, it also creates a new copy of what may be privileged conversation, stored by a third party, possibly processed by AI models, and sometimes shared automatically with everyone invited to the meeting.
Before turning these tools on, a firm should work through confidentiality, consent, privilege, and retention. This post is general information, not legal advice, and state rules on recording consent differ.
What can go wrong
Unapproved bots joining calls
Individual attendees, including clients or opposing parties, may invite their own note-taking bots. A transcript of a settlement discussion may then exist on a vendor's servers outside your control. Some tools post summaries to all attendees by default.
Privilege and confidentiality
ABA Model Rule 1.6(c) asks lawyers to make reasonable efforts to prevent unauthorized disclosure of client information, and ABA Formal Opinion 512 discusses confidentiality in generative AI use. A third-party transcription vendor that stores or processes the audio may be an outside provider whose terms need review. Whether sharing with such a vendor affects privilege is a legal question for counsel in your jurisdiction. The point for administrators is not to assume it is harmless.
Recording consent
Laws on recording conversations vary by state, with some requiring consent from all parties. Many jurisdictions in which our clients practice have their own rules, and calls often cross state lines. Consult counsel on your obligations, and make notice and consent part of your routine.
Accuracy
Transcripts can mishear names, numbers, and legal terms, and AI summaries can omit or distort what was said. An attorney who relies on a summary without checking it risks an error in the file.
Retention and discovery
Recordings and transcripts may be discoverable and are subject to your retention obligations. A tool that keeps everything forever creates a large archive that might be requested later, or breached.
Questions to ask before approving a tool
- Where are recordings and transcripts stored, and for how long?
- Is audio or text used to train models?
- Who at the vendor can access content?
- Can administrators control retention and delete content on request?
- Can sharing be limited, with no automatic distribution of summaries?
- Does the tool announce itself to participants, and can it be disabled for particular meetings?
- What audit logs are available?
- Does it integrate with your single sign-on and enforce MFA?
- What are the breach notification terms?
Policy elements to consider
Approved tools only
Name the tools allowed, if any. Prohibit personal accounts and free consumer note-takers for client matters.
Meeting-by-meeting rules
Decide which kinds of meetings may use AI transcription and which may not. Many firms prohibit it for privileged client strategy sessions, settlement talks, and sensitive HR or internal matters, and allow it for internal administrative meetings.
Consent and notice
Require that participants be told when recording or transcription is on, and get consent where required. Check client outside-counsel guidelines, which may prohibit it.
Managing other people's bots
Set video conferencing controls so that the host must admit unknown participants and can remove bots. State in the invitation that third-party recording tools are not permitted without the host's agreement. Configure your conferencing platform to block or flag unrecognized recorders where it can.
Review and retention
Require attorney review of any transcript or summary before it is relied on or placed in a file. Apply the same retention rules as other client records, and delete drafts and recordings on a schedule.
Technical settings that help
- Restrict third-party app connections to calendars and meeting platforms by administrator approval
- Disable automatic recording and automatic summary sharing by default
- Use lobby or waiting room features
- Audit which meeting apps are authorized in your Microsoft 365 or other tenant
Training
Short examples work well: a bot joins a call uninvited, what do you do? An attorney finishes a client call and sees an auto-generated summary posted to the chat, what happens next? Practice the response.
When in doubt
Where privilege or sensitivity is high, the safest approach is still a human taking notes.
How we can help
Counsel Cyber helps law firms evaluate AI meeting tools, lock down conferencing settings, and write simple policies attorneys will follow. If you are seeing unapproved bots in your calls, we can help you get control of it.