Who Can See What Your AI Note-Taker Records?

AI note-takers went mainstream fast. You start a Teams, Zoom, or Google Meet call, a bot joins to record the conversation, and minutes later everyone gets a tidy summary with action items. It saves real time — which is exactly why staff often adopt these tools on their own, before anyone has asked where the recording ends up.

The problem: every word of the meeting, including the parts you’d never put in writing, gets captured, stored somewhere, and readable by whoever has access. Few business owners have stopped to ask who that includes, or what happens to the recording afterward. Before you let one into a client or staff meeting, it’s worth knowing where the recording goes — and, in Canada, whose consent you need.

What an AI note-taker actually does

It’s a tool that joins a meeting, records the audio (sometimes video), turns the speech into a written transcript, and produces a summary. Common ones include Microsoft 365 Copilot in Teams, Otter, Fireflies, and Fathom. Most connect to your calendar so they can join automatically, and some will sit in on any meeting on your schedule unless you turn that setting off. The recording and transcript don’t disappear when the call ends — they’re saved, usually in the cloud, where they can be searched, shared, and exported later. Where they’re saved, and who can reach them, depends on the tool.

Who can see the recording?

Start with the obvious group: anyone the organizer shares the summary with. Many note-takers email the transcript to every attendee by default, and some send it to people who were invited but never joined. When the meeting covered a sensitive topic, that distribution list matters.

Then there’s the tool’s own access. With a cloud note-taker, the recording sits on the vendor’s servers — which means the vendor’s systems, and in some cases its staff, can reach it under the terms you agreed to. If the tool auto-joined from someone’s calendar, the recording may live on an account you don’t control, belonging to whichever employee connected the bot. A legal publication on the risks of AI note-takers has even warned that letting a vendor access or use your transcripts for its own purposes can risk affecting privilege for businesses handling legal matters.

Does the tool train its AI on your meetings?

This is where tools differ most, and it’s worth checking before you choose one. Microsoft states that Copilot in Teams does not use your prompts, responses, or meeting content to train its AI models, and that the data stays inside your organization’s Microsoft 365 environment — its privacy documentation says so directly. Third-party note-takers vary widely: some store recordings on their own servers and, depending on the terms you accept, may use that data to improve their models; others say they don’t train on customer data at all. The only way to know is to read the specific tool’s privacy terms — two tools that look almost identical can treat your data very differently.

The consent question — and PIPEDA

Recording a meeting isn’t always yours to decide alone. In Canada, PIPEDA treats a recording of an identifiable person as their personal information, which means you generally need to identify your purpose and obtain meaningful consent before recording — and Ontario health information adds PHIPA obligations on top. The rules get more complex when participants are in different jurisdictions: some U.S. states and most Australian states require everyone in a conversation to agree, while the UK and Europe treat recording as handling personal data under GDPR.

The safe approach everywhere is the same: tell people the meeting is being recorded, explain why, and give them a chance to object before the bot starts. For client meetings, HR conversations, and anything covered by confidentiality, that matters even more — and in some cases you should check with a lawyer before recording at all.

How to use AI note-takers safely

You don’t have to ban these tools to use them responsibly. Instead: pick an approved tool and say so — decide which note-taker your business uses and ask staff not to connect others to company meetings, keeping your recordings in one place you control; turn off auto-join so the tool records only when someone chooses to; announce recording and get consent at the start of every meeting, and skip recording when someone objects; prefer tools that keep data in your environment (a note-taker that stores recordings inside your own Microsoft or Google tenant and doesn’t train on your data is easier to control); control who gets the summary so transcripts aren’t emailed to everyone, including people who missed the meeting; and keep bots out of sensitive meetings — for legal, HR, financial, and confidential client conversations, the default should be no recording unless there’s a clear reason and everyone agrees. If you use Microsoft 365, an administrator can control whether Copilot and transcription are allowed in Teams meetings, giving you one place to set the rule.

Frequently asked questions

Is it legal to record a meeting with an AI note-taker in Canada?

Under PIPEDA, a recording of an identifiable person is their personal information, so you generally need to identify your purpose and get meaningful consent — and PHIPA adds rules for health information. The safe approach is to announce the recording and let people object before it starts, especially when participants are in different jurisdictions.

Does Microsoft Copilot use my meeting data to train its AI?

No. Microsoft states Copilot in Teams doesn’t use your meeting content, prompts, or responses to train its foundation models, and the data stays within your Microsoft 365 environment.

Can an AI note-taker join a meeting without me knowing?

Yes. Many tools connect to a user’s calendar and can auto-join meetings — sometimes ones the user isn’t even attending. You can turn auto-join off so the bot records only when someone starts it.

Where are AI note-taker recordings stored?

In the cloud. With Microsoft Copilot the data stays inside your Microsoft 365 tenant; with many third-party tools recordings sit on the vendor’s own servers. Where they live and who can reach them depends on the tool, so check its terms.

Should we let staff use Otter or Fireflies for work?

You can, with rules: choose one approved tool, turn off auto-join, announce recording and get consent, check how the tool handles your data, and keep it out of legal, HR, and confidential client meetings.

If you want a recording policy that holds up under PIPEDA, our Microsoft 365 support in Toronto covers the tenant settings, and we can configure the data privacy controls that decide who sees a transcript and how long it is kept.

Prepared by the EB Solution team — managed IT, Microsoft 365, and privacy-conscious IT for businesses across the Greater Toronto Area. Want a simple AI-recording policy that keeps you onside with PIPEDA? We’ll help you set one up.