Your AI notetaker joins the Zoom before you do. It introduces itself in the chat, records every word, emails a summary before you have left the call, and quietly adds the transcript to its training corpus in the cloud. It feels like a productivity win — until opposing counsel subpoenas the transcript, a client in California claims you recorded without consent, or a participant who never agreed to be recorded files a wiretapping claim.
In 2026, AI transcription and note-taking tools are in nearly every small business's meeting stack — Otter.ai, Fireflies, Fathom, and the built-in recorders in Teams and Meet. The lawsuits have arrived just as quickly. The central allegation in the Otter.ai cases, where non-users who were recorded without being account holders are plaintiffs, is that the tool's automatic joining and cloud processing violates all-party consent statutes and creates a witness out of your own software.
Here are the risks you take on when you turn the notetaker on, and the controls that let you keep the benefits without the exposure.
The Three Legal Exposures
1. Wiretapping and Two-Party Consent
In twelve states — including California, Illinois, Florida, Pennsylvania, and Washington — every party must consent to audio recording. In those states, a meeting with one California participant who did not consent can make the recording unlawful even if the host is in a one-party consent state like New York. The claim does not require that the non-consenting party be the account holder; being recorded as a participant is enough.
The class actions filed against Otter.ai allege exactly that: the notetaker automatically joins across Zoom, Teams, and Meet, records conversations of non-users, and processes them without the clear, informed consent state wiretap statutes require. The district court's wiretapping question — and whether a third-party service that records via a bot is itself intercepting — is unresolved and will not be for some time if appealed. Until then, the only safe course is to disclose and obtain affirmative consent from every participant, every time.
Even in one-party states, recording where participants have a reasonable expectation of privacy without notice can create civil liability and, in some states, criminal exposure for aiding and abetting interception.
2. Privilege Waiver and Confidentiality
Human notes taken by counsel can be protected by attorney-client privilege or work-product doctrine. AI-generated transcripts and summaries are often treated differently — as neutral, third-party-created documents that are readily discoverable. When a notetaker processes attorney-client communications in the cloud, a third party has gained access to privileged material, and a court may find the privilege waived.
The ABA's 2025 assessment put it bluntly: using transcription tools during privileged meetings may inadvertently destroy privilege or expose communications, because the audio is processed by a vendor's model and may be retained for training. A New York federal judge in February 2026 ordered a criminal defendant to produce AI-transcribed communications that would have been privileged if only human notes existed.
Beyond privilege, every confidential discussion — pricing strategy, trade secrets, HR decisions, health information — becomes a cloud-stored record that is broader in scope than any human would have taken. Where a human writes "discussed pricing options," the AI writes the options verbatim. That verbatim artifact is what gets subpoenaed.
3. Discoverability and Accuracy
AI transcripts are not just recordings — they are documents the business has chosen to create and retain. In litigation, those documents are discoverable. Opposing parties can demand every transcript, every summary, and every sentiment analysis the tool generated, across every meeting. A narrow dispute about one contract term can become a fishing expedition through a year's worth of auto-transcribed standups.
Accuracy compounds the problem. AI-generated transcripts and summaries hallucinate, misattribute statements, and invent sentiment analysis that was never spoken. If the transcript says a participant agreed to a term they did not, the business must either defend an inaccurate artifact it created or explain why its own records are unreliable — both damaging positions. Inaccuracies about emotion detection or speaker attribution are not correctable after the fact without the original audio, which the business may not have retained separately.
The Seven Controls Small Businesses Need
You do not need to ban notetakers. You need to treat them like any other system that creates legal records — with consent, notice, and retention discipline.
-
Disclose and obtain affirmative consent at the start of every meeting. Announce the notetaker verbally, ensure its presence is visible in the participant list and chat, and require an explicit acknowledgment — a button click or verbal confirmation — before recording begins. For recurring meetings, obtain consent each time, not just at the first meeting. Log the consent with the transcript.
-
Give participants a real opt-out. If anyone declines, turn the notetaker off or remove it from the meeting. Do not record the objector "in the background" while claiming the consenting participants remain recorded — the objector's voice remains on the audio and the recording remains unlawful as to them in two-party states. Provide a dial-in alternative without the bot where feasible.
-
Configure the tool for compliance, not convenience. Disable automatic joining. Require the host to actively invite the bot each time. Disable training-on-your-data if the vendor offers it, and confirm in writing where audio is processed, how long it is retained, and whether human reviewers can access it. If the vendor cannot answer, choose a vendor that can.
-
Limit where the notetaker is allowed. Prohibit its use in privileged meetings — attorney-client, board executive sessions, HR investigations, and any discussion of trade secrets — unless counsel has approved the specific tool and its privilege protections in writing. A one-line policy ("No AI notetaker in privileged or confidential meetings") prevents the most expensive mistake.
-
Correct the record promptly. Review AI summaries before they are shared or saved. Correct misattributions and hallucinations in a tracked edit, and retain both the original and the corrected version with a note. An uncorrected inaccurate summary that is later produced in discovery is worse than no summary at all.
-
Retain with discipline and delete on schedule. Do not retain every transcript forever. Adopt a retention schedule — e.g., 90 days for internal standups, longer for client-facing commitments — and delete on schedule. A disciplined deletion policy, applied consistently before litigation is anticipated, reduces discoverable volume. Once litigation is reasonably anticipated, however, a litigation hold suspends deletion.
-
Update your privacy notice and agreements. Disclose in your privacy policy and, where appropriate, in client engagement letters that you use AI notetakers, what data they process, and how participants can object. For employee meetings, update the handbook and consider a standalone acknowledgment.
What to Do Before the Next Meeting
If you bought a notetaker on a free trial and left it on auto-join, take 15 minutes this week:
- Turn off auto-join and training-on-data, and document the settings
- Draft a 30-second disclosure script and add it to the meeting template
- Designate which meeting types are off-limits for AI recording
- Set a retention and deletion schedule and assign ownership
Those four steps put you ahead of most small businesses and squarely within the "human-in-the-loop" approach the Labor Department and the FTC are signaling for all AI tools, not just notetakers: disclose, obtain consent, keep the human in the decision, and keep the record accurate.
Simplify Your Financial Management
AI notetakers promise faster follow-ups, but every transcript is a financial and legal record that must be handled with the same care as your books. Beancount.io gives you plain-text, version-controlled accounting where retention, access, and accuracy are built into the workflow — so your meeting records and your financial records meet the same standard. Get started for free and keep your business's memory accurate.