The Notetaker Nobody Approved: When AI Bots Sit In on Your Business Meetings

The meeting starts. A new participant appears on the roster: “AI Notetaker.” No one remembers inviting it. The conversation continues, and the bot quietly records, transcribes and summarizes what is said.

That meeting invitation was not the decision. The important decision is what happens to the recording and transcript afterward: who retains them, who can access them, whether they’re used to improve a vendor’s models, and whether everyone on the call understood that recording was happening.

For small businesses, governing meeting assistants is a practical risk-management issue, not a reason to reject useful AI. B&R Computers recommends approaching it through four steps: identify, quantify, mitigate and monitor.

Identify: Find out what is joining your meetings

Start by determining which AI assistants are in use and how they were added. Meeting assistants include third-party services such as Otter.ai, Fireflies.ai, Fathom and Read AI, as well as tools built into platforms such as Zoom AI Companion, Microsoft Teams Copilot and Google Meet Gemini. They don’t all have the same data arrangements.

Third-party bots may join as external participants through a calendar connection or app authorization. Platform-native assistants work within the meeting service, but still need appropriate settings and oversight. Check both categories rather than assuming that every AI assistant works the same way.

Ask employees directly which tools they use, including tools connected to personal accounts. Review calendar-connected apps and OAuth grants: the permissions that let an app access services such as a calendar. Also look at meeting rosters for unfamiliar “notetaker” participants. A personal install can become shadow AI: an employee’s well-intentioned shortcut that puts business information outside company-approved processes.

The adoption numbers help explain how this happens. A study cited by TechTarget reports that 80% of American office workers use AI at work, but only 22% rely exclusively on company-provided tools. The same article cites BlackFog research finding that 63% of employees believe using AI is acceptable when no company-approved list exists. These figures don’t show how many workers use unapproved meeting bots specifically. They do show why a clear policy, and a useful approved option, matters.

Quantify: Understand what a transcript can expose

A meeting transcript is more than a convenience. It may capture client names, pricing, contract terms, customer concerns, financial performance, employee matters, legal strategy or plans that haven’t been announced. A recording can also preserve voices and speaking patterns.

For a third-party assistant, meeting data may be processed or stored in the vendor’s cloud, subject to that vendor’s terms and settings. Determine who within the vendor’s organization or service providers can access it, how long it is retained, whether it can be deleted, and whether it may be used for model training. Don’t assume the transcript stays only with the meeting host.

Voice data deserves particular care. In a separate case, a class action filed in late 2025 alleged that Fireflies.ai collected, possessed and retained biometric voiceprints without consent, according to the TechTarget report. That is an allegation, not a finding of liability, but it underscores why owners should ask what a tool does with speaker identification data.

A recent ruling involving Otter.ai makes the distinction between an invited bot and an independent data user especially important. In In re Otter.AI Privacy Litigation, No. 25-CV-06911-EKL (N.D. Cal. Aug. 13, 2026), the court allowed several claims to proceed after plaintiffs alleged that OtterPilot recorded meetings without all participants’ consent, retained recordings and transcripts, and used them to train its speech-recognition and machine-learning models. The court reasoned that a tool that only transcribes and returns a recording may function as an extension of the host, while a service that independently retains and uses conversations for its own commercial purposes may be treated differently. It also rejected, at this stage, the argument that a commercial motive necessarily rules out a tortious purpose. The plaintiffs’ allegations about speaker tagging and identification supported their Illinois biometric privacy claim.

This was a motion-to-dismiss ruling, not a trial or final decision. The court found that certain claims (including claims under California’s CIPA, the federal ECPA, Illinois BIPA and California’s UCL) could proceed; other claims were dismissed. The allegations have not been proven, and the ruling does not establish that every meeting assistant is unlawful. Read the National Law Review’s report for details.

Consent is also a practical concern for Pennsylvania businesses. Pennsylvania’s Wiretap Act generally requires the consent of all parties to record or intercept a private telephone or electronic communication; criminal exposure and civil claims may be possible. See the Digital Media Law Project’s Pennsylvania recording-law guide. Rules and facts can vary, especially when participants are in different locations, so this is general information, not legal advice. Clear advance notice and consent are safer than assuming that a bot’s presence on the roster is enough. Consider the sensitivity of each meeting, too: an executive planning session or an HR discussion carries different exposure than a routine internal check-in.

One more risk: meeting assistants that interpret spoken or shared content may be vulnerable to prompt injection. As TechTarget explains, malicious instructions can potentially manipulate agents to record or share information. A bot can therefore be both a recordkeeper and a possible route for data exposure.

Mitigate: Set rules people can follow

A practical policy does not have to be complicated. Put the decision in a clear order:

1. Publish an approved and not-approved list. Identify which meeting assistants are permitted, for which purposes, and which are blocked. Offer employees an approved alternative where possible.
2. Block unknown assistants by default. Review Zoom, Teams and Google Meet settings to restrict or prevent unapproved third-party bots from joining. Check what controls are available under your specific plan.
3. Prefer platform-native tools when appropriate. Vendor documentation describes different data protections for built-in assistants. Zoom says customer communications are not used to train Zoom or third-party AI models, and that its third-party model providers are not allowed to retain or use customer data for model improvement. Microsoft says Teams intelligent recap data is stored in the organizer’s Exchange account and, when there is a recording, in OneDrive; it inherits organizational retention controls. Google says Workspace customer data is not used to train generative AI models without permission. Review the current Zoom documentation, Microsoft Learn guidance and Google Workspace privacy hub for your own plan, configuration and retention needs. These are vendor-documented defaults and commitments, not a blanket guarantee for every account or setting.
4. Ask third-party vendors direct questions. Do you retain recordings or transcripts? Are they used to train models? Can we delete them on demand? Where is the data stored? What happens when the account is closed? Get the answers in writing and check the contract.
5. Use company-managed accounts. Where a third-party tool is approved, connect it through a corporate account rather than an employee’s personal one. That makes access, ownership and offboarding easier to manage.
6. Make notice part of the meeting routine. Mention recording in the invitation and at the start of the call. Follow a consistent process for disclosure and consent, and consult your own counsel about requirements for your meetings and participants.
7. Review calendar permissions and outputs. Remove unnecessary app grants. Have a person check AI summaries before using them to make decisions, assign work or communicate commitments.

Monitor: Keep the decision current

A one-time review won’t keep up with changing tools and permissions. Re-audit approved meeting apps periodically. Alert on new calendar or OAuth grants where your systems allow it, and spot-check meeting rosters for unfamiliar participants. Revisit vendor terms and settings when tools change, and track incidents or near-misses, such as an unexpected bot in a client call or a transcript saved in the wrong place.

That record helps you see whether the policy is working and where employees need a safer, easier way to take notes.

AI meeting assistants can save time and help teams stay focused. The risk is not simply that a bot joins. It is that no one decided what it may record, retain or do with the conversation afterward. Put that decision where it belongs: identify, quantify, mitigate and monitor.

For more practical guidance, visit the B&R Computers resource hub. To review your organization’s technology and cyber risks and discuss next steps, request a Business Review or Strategy Session.