AI note-taking is among the easiest tools for staff to adopt without asking. A bot joins a video call, produces a transcript and a summary, and emails it to everyone. For a law firm, that convenience raises several questions: where is the recording stored, who can read it, did everyone consent, and could its existence affect privilege?
This post lays out the issues and a sensible approach. It is not legal advice, and recording laws and ethics rules vary by state, so consult your state bar and counsel.
The risks to understand
Confidentiality
Transcripts contain exactly what you most need to protect: client strategy, facts and advice. If the tool's vendor stores the recording, its employees or subcontractors might access it, and the terms might permit use of the content to improve products. ABA Formal Opinion 512 on generative AI discusses the need to understand how a tool handles information, and Rule 1.6(c) asks for reasonable efforts to prevent unauthorized disclosure.
Consent and recording laws
Some states allow recording with the consent of one party, and others require all parties to consent. Federal and state rules differ, and a call can involve participants in several states. Many meeting platforms announce recording, but an unannounced third-party bot may not. Get legal advice on your jurisdiction and your clients' locations.
Privilege
Allowing a third-party service to receive privileged communications can raise questions about whether confidentiality was maintained. Courts analyze this on the facts, and the outcome may depend on the vendor's terms and how access is controlled. This is a point to raise with ethics counsel before adopting a tool.
Who else gets the transcript
Automatic summaries are often emailed to all invited participants, including outside parties or people who were invited but did not attend. A summary that goes to the wrong person is a disclosure.
Accuracy
Transcripts and summaries can contain mistakes, misattribute statements or omit nuance. Treating a summary as a record without review can introduce errors into the file.
Retention and discovery
Recordings and transcripts are firm records. They may be subject to retention policies, legal holds or discovery obligations. Creating them by default means managing them.
A safer approach
1. Decide whether to allow it at all
Many firms permit transcription for internal meetings, training and marketing calls, and prohibit it for privileged client communications unless specifically approved. Others allow only a firm-approved tool with a business agreement.
2. Approve specific tools
If you allow it, vet the vendor the way you would any other that handles client information:
- Does it use your content for training? Is that disabled by contract?
- Where is data stored and how long is it retained?
- Who at the vendor can access it?
- Does it integrate with your single sign-on and offer administrator controls?
- Can you delete recordings and transcripts, and will deletion be confirmed?
3. Control the settings
- Disable automatic joining of bots to every meeting
- Restrict who can start recording
- Turn off auto-sharing of summaries
- Store recordings in the firm's approved repository, not the vendor's default location
4. Obtain and document consent
Announce recording at the start, ask for agreement, and note it. For client calls, include recording terms in the engagement letter where appropriate.
5. Control outside bots
Participants from other organizations may bring their own note-taker. Decide in advance how you respond: ask that it be removed for privileged discussions, or require agreement on handling.
6. Train staff
Short guidance covers most of it: do not add personal AI note-takers to client meetings, check before recording, and report any accidental recording.
7. Include it in your retention policy
Define how long transcripts are kept, where they are filed, and who may delete them.
Questions for partners
- In which meetings would a transcript be valuable, and in which is it too risky?
- Who approves exceptions?
- How will we handle clients who ask us not to use AI?
Where Counsel Cyber helps
We configure meeting platforms and approved AI tools so recording is controlled and consistent with firm policy. Ask us to review your current settings.