Somebody on your team is probably already using an AI notetaker. It may be on an approved account, or a guest may have brought one to your call, or an employee may have connected one to their calendar months ago and forgotten. Security teams call software that handles company information without anyone having reviewed it "shadow AI", and meeting notetakers are one of the easiest ways for it to spread: a bot joins a call from a calendar link, and each new person it meets is invited to give it access to their own calendar too.
A ban rarely works, and it takes away something people value. A short written policy works better. It names the tools that are allowed, says what attendees are told, limits who sees the notes and sets when they are deleted. This article explains the decisions a policy has to make, suggests defaults for common meeting types, and gives you a template to copy. It is a starting point, not legal advice, so have a lawyer look at it if your work involves regulated information.
Lawsuits have made notice and consent a business question. Class actions in California accuse well-known notetakers of recording people who never agreed to it. We summarise what is alleged, and what is not decided, in our guide to the Otter.ai and Granola cases.
Tools spread from person to person. One person connects a notetaker to their calendar, it joins a call, and the other attendees are offered the same. Without a policy, nobody decides which of them is allowed.
Notes are records. A transcript holds names, figures and things said off the cuff. Where it is stored, who can read it and how long it stays are decisions, and they are easier to make once than to untangle later.
These are suggested defaults, to be adjusted to your industry and the laws that apply to you.
| Meeting | Suggested default | Why |
|---|---|---|
| Internal planning, standups, retrospectives | Record, with a notice in the invite | Low sensitivity, and the notes become shared memory |
| Customer or client calls | Record after telling them at the start, and agree it in advance for regulated clients | Outside parties have their own rules and expectations |
| Sales discovery and demos | Record after telling them at the start | The write-up feeds follow-up, and the notice sets the tone |
| Job interviews | Ask the candidate first, and follow your recruiting rules | It involves a person's data and a hiring decision |
| Performance reviews and HR conversations | Do not record unless HR approves | Sensitive, and often covered by extra rules |
| Legal advice or privileged discussions | Do not record unless counsel agrees | Records can affect privilege |
| Health, therapy or other regulated settings | Only with a tool and setup approved for that regime | Extra obligations apply |
| Board meetings | Agree it in the board's own rules, and check records retention | Minutes are corporate records |
Adapt the wording to your company. Where it says the policy owner, name one person.
1. Purpose. This policy sets out when and how AI notetakers may be used in company meetings. It protects the people we meet with, our customers and our own information.
2. Approved tools. Only tools on the approved list may record or transcribe company meetings. The policy owner keeps the list. A tool is approved after a review of where it stores data, whether it trains models on content, who can access recordings and how content is deleted. Personal notetaker accounts, and bots connected to a calendar without approval, may not be used for company meetings.
3. Notice and consent. Everyone on a call is told before recording starts. Where a bot joins, its presence in the participant list is not enough on its own: the host also says that the call is being recorded and written up. Where recording happens without a bot, the host says so aloud or writes it in the invite. If anyone objects, recording stops or does not start. Calls with people in other countries or states follow the stricter rule.
4. Meetings that are not recorded. HR matters, performance conversations and legal advice are not recorded unless the policy owner or counsel approves in writing. Meetings in regulated settings are recorded only with a tool and setup approved for them.
5. Access. Notes are visible to people who attended and to colleagues who need them for their work. A public share link needs a manager's approval, is given an expiry date and is revoked when no longer needed. Transcripts are not sent outside the company without checking that the people in them would expect it.
Still writing meeting notes by hand?
Notepik joins the call, writes the summary, and hands you the action items before you have closed the tab.
Read our security overview6. Retention and deletion. The policy owner sets a retention period for each type of meeting and writes it down. Notes that are no longer needed are deleted. When someone leaves, the ownership of their recordings is reassigned.
7. Vendor use of content. Approved tools may not use our meeting content to train models for anyone, and must delete content when asked.
8. Mistakes and complaints. Anyone can ask for a recording of them to be deleted. Anyone can report an unapproved tool or a recording nobody announced to the policy owner. Mistakes are corrected, not punished, so that people report them.
9. Review. The policy owner reviews this policy every year, and whenever the tools or the law change.
A policy only works if people can follow it without friction.
We built Notepik to be easy to govern, and we will be plain about where it needs your help.
We do not have SOC 2 or ISO 27001 certification today. If your vendor review requires one, say so early. Our security page and consent page set out what we do and do not claim.
One page is enough for most companies. Long policies are not read, and the decisions that matter are few: which tools, when to record, what people are told, who sees the notes and how long they stay.
Whoever owns security, legal or operations, as long as it is one named person. Shared ownership usually means nobody reviews it.
It depends on where everyone is located, and the rules differ widely. The safe default is to tell them at the start and let them decline. For regulated clients, agree it in advance.
No. It sets your own rules and makes them visible. Whether those rules satisfy the law that applies to you is a question for a lawyer.
Notepik has a free plan for one person, with no card required, so you can test the bot or the extension on a real meeting and see whether the write-up is useful. See pricing.
Try Notepik on your next meeting
Free to start, no card required. Connect a calendar or paste a link, and the summary is waiting when the call ends.
Two class actions in California accuse AI notetakers of recording people who never agreed to it. Here is what is alleged, what no court has decided, and what to check before your team records another call.
Evaluating the most secure AI meeting transcription for enterprises requires a deep dive into data protection. Learn what security features matter most.
Evaluating an AI meeting assistant with on premise data options? Understand the critical security, encryption, and data handling considerations for enterprise adoption.