AI note-taking tools that join video calls, record audio, and produce summaries and action items are spreading quickly. For a law firm, a meeting may involve privileged strategy, health information, or a client's business secrets. The convenience of an automatic summary is real, but so are the risks.
This post lays out the questions firm leaders should answer before these tools appear in client meetings. It is not legal advice; confirm requirements with your state bar and counsel.
Why Transcription Tools Are Different
A transcription tool creates new records: a full audio recording, a verbatim transcript, and a summary. These records are stored somewhere, possibly with a third-party vendor, and may be processed by AI models. That raises questions that a notepad never did.
- Who can access the recordings and transcripts?
- Where are they stored, and for how long?
- Is the content used to train the vendor's models?
- Can the transcript be subpoenaed or requested in discovery?
- Were all participants told, and did they agree?
Key Risk Areas
Confidentiality and privilege
ABA Model Rule 1.6(c) asks lawyers to make reasonable efforts to prevent unauthorized disclosure of client information. ABA Formal Opinion 512, on generative AI tools, discusses the need to understand how a tool handles information and, in some cases, to consider informed consent before inputting client information into a tool that may expose it. If a vendor's staff, subcontractors or other customers could reach your recordings, that is a concern. Third-party involvement can also raise questions about whether privilege is preserved, so involve counsel in setting policy.
Recording consent
Laws on recording conversations differ by state. Some require consent from all parties, others from one. When participants join from several states, the stricter rule may matter. Do not rely on a bot's join message alone; announce recording and obtain agreement, and confirm what your jurisdictions require.
Unapproved bots in meetings
Clients and opposing parties may bring their own AI note-takers into a call. Decide in advance what the firm will allow, and be prepared to ask that a recording tool be removed during privileged discussions. Some clients prohibit recording or AI processing in their outside counsel guidelines.
Accuracy
Summaries can omit nuance or insert statements nobody made. A summary that is wrong and then relied on is a risk of its own. Attorneys should treat AI notes as a draft, not a record.
Retention and discovery
Recordings and transcripts are records. If the firm does not need them, it should not keep them by default. If it does keep them, they need a retention schedule and a place in the file for the matter.
Evaluating a Tool
Ask the vendor, and get the answers in writing:
- Where is data stored, and is it encrypted at rest and in transit?
- Is customer content used to train or improve models?
- Who at the vendor can access content, and under what conditions?
- Can we set retention periods and delete content on demand?
- Does the tool support MFA, single sign-on and audit logs?
- What happens to our data if we cancel?
- Is there a business or enterprise agreement with confidentiality terms, as opposed to consumer terms?
Policy Elements
- Approve specific tools by name and plan, and prohibit others
- Require advance notice and consent before recording client meetings
- Prohibit recording of privileged discussions unless approved
- Set rules for what happens to recordings and where they are stored
- Require attorney review of summaries before they enter the file
- Address third-party bots joining firm meetings
- Provide training and a way to report accidental disclosures
Practical Steps for This Month
- Ask staff which transcription tools they use today
- Check which meeting platforms already offer built-in AI features and how they are configured
- Update your engagement letter if your practices change
- Add the question to client intake: do they have restrictions on recording or AI use?
Working Through It With Counsel Cyber
Counsel Cyber helps firms evaluate AI meeting tools, configure the options within platforms like Microsoft 365, and write policies that fit how attorneys really work. If you would like a second set of eyes on a vendor's security answers, we are glad to help.