eudaiGovernance reference

AI notetakers

	The question	What to set	Why	Legal basis
1	Who owns the transcript?	The company owns the record. The meeting organizer is its named owner, answerable for whether the notes are accurate, who receives them, and whether they are kept. IT retains administrative control.	When notes belong to individuals, they get left behind when people change jobs or leave. Someone has to answer for whether a record is accurate; the company has to control who sees it and when it gets deleted.	Notetaker output is a searchable, discoverable record. The decision to record belongs at the organizational level, not with individual employees, because it sets what enters the corporate record.¹⁶
2	Who can see it?	Only the people invited to the meeting, plus the owner. No company-wide search. No automatic sharing. Outsiders get access only when someone approves it.	People should see what they need to do their jobs and no more. Wide access is how confidential material ends up in the wrong inbox.	Broad access weakens confidentiality and can waive privilege; keep privileged output with need-to-know personnel.¹² In United States v. Heppner (S.D.N.Y. 2026) a court declined to extend privilege to material prepared with a consumer AI platform.¹
3	Should we keep the audio or video?	Off by default, and not recorded at all for sensitive meetings. If there is a real reason to turn it on, delete it on a short, documented cycle.	The written notes usually do the job. The recording adds privacy, security and litigation risk without adding much value.	Collect and keep only what the purpose requires,¹³ and use a tiered model in which sensitive meetings are not recorded at all.¹

AI notetakers · continued

	The question	What to set	Why	Legal basis
4	How long should transcripts be kept?	Fold them into the retention schedule you already have rather than inventing an AI-specific number. Set defined periods that line up with litigation-hold obligations, industry rules and data-disposal laws, and treat recordings, machine transcripts, AI summaries and approved minutes as separate items.	An arbitrary period is hard to defend either way. A period tied to obligations you already have can be explained to a regulator or a court. The four artifacts do not equate to the same level of risk.	Mayer Brown: define periods aligned to holds, industry requirements and disposal laws; indefinite retention is hard to justify.¹ Foley: fold AI output into existing schedules rather than set an arbitrary AI-specific period.⁶ White & Case: address recordings, transcripts, summaries, decks and minutes separately.⁷ The ICO sets no fixed period and expects you to justify and review the one you set.³
5	Can we keep something longer?	Yes, but only through a documented exception: why, until when, who owns it, how sensitive it is, and who approved it. Senior approval only for sensitive or long extensions.	Requiring an executive signature every time creates a bottleneck people work around. Requiring nothing creates an archive nobody controls.	Set standard periods, review them, and allow early deletion where appropriate.³
6	What should be kept as the official record?	Decide in policy which version governs: the reviewed, approved record, stored in your system, not the notetaker. Applies whenever a regulator, contract, audit, complaint, lawsuit or formal decision requires a record.	A raw transcript is rarely the right official record. An approved decision, action log or set of minutes is easier to manage and easier to defend.	Define which version controls if the AI summary and the human record conflict.¹ Where they differ, an adverse party will rely on the more detailed one, and the discrepancy itself invites questions about accuracy and process.⁷

AI notetakers · continued

	The question	What to set	Why	Legal basis
7	What happens during a legal hold?	Assume recordings, notes and transcripts may be discoverable. Make sure automatic deletion can be suspended, freeze only what the matter covers, and lift the hold as soon as it ends.	Holding everything defeats the purpose of a retention policy and creates a mountain of material someone has to review. Being unable to suspend deletion is the worse failure.	Assume all recordings, notes and transcripts are discoverable, and confirm the system can override its automated deletion schedule.⁵⁷ Material held outside official channels creates production gaps and spoliation exposure under FRCP 37(e).⁶
8	Can the vendor train its AI on our conversations?	No, and it should be written into the contract. Rule out model training, product improvement, evaluation, human review outside delivering the service, advertising, profiling and unrelated analytics, unless legal approves it separately.	These meetings contain confidential information, personal data, trade secrets, privileged discussion and regulated data. “We don't train on your data” needs to be a contract term.	There is no AI exemption from existing law: a provider must honor its promise not to train on customer data, and the promise binds wherever it was made — terms of service, marketing or a marketplace listing.⁴ Vendor access to recordings has also been argued as unauthorized interception under California's CIPA.¹
9	Is it enough that nobody objected?	No. For external meetings, participants in states that require everyone's consent, and sensitive meetings, give clear notice up front and get an affirmative yes before recording starts. For routine internal meetings, use clear platform notice and a process you can evidence.	A bot in the participant list, a line in the invite, or silence in the room is a weak record if anyone later challenges the recording.	Federal law requires one-party consent; roughly a dozen states, California and Illinois among them, require all parties. Map participant locations and apply the strictest standard.¹⁵ Announce the tool, let objectors leave, and document consent — a click-through box does not cover late joiners.²⁷

AI notetakers · continued

	The question	What to set	Why	Legal basis
10	Can employees use their own notetaker?	No. Block personal and consumer tools. Allow only the approved company account, with central controls.	Personal tools skip procurement, contract terms, security review, retention rules, access controls and the ability to preserve records for litigation.	Name the approved tools and disable automatic activation, including notetakers built into the conferencing platform.² Where policy does not forbid unauthorized transcription, the employer can face vicarious liability, and opposing counsel can compel the transcript from the employee directly.⁶
11	Which meetings should never be recorded?	Legal advice, litigation strategy, investigations, HR and employee relations, discipline and terminations, union matters, M&A, security incidents, health information, material nonpublic information and other restricted material. Exceptions only with legal or compliance approval.	In these conversations the value of a transcript rarely outweighs the risk to privilege, confidentiality and the people involved.	Use a tiered meeting model: routine meetings may use an approved tool; legal advice, investigations, HR matters, board deliberations and sensitive data default to no notetaker.¹² Recording investigations chills candor, accommodation discussions capture ADA-protected information, and wage or organizing discussions raise NLRA concerns.¹
12	Can notes be used in HR or other big decisions?	Not on their own. Treat them as drafts. Require a qualified person to review them, plus supporting evidence, before any decision about performance, discipline, employment, credit, care, legal or regulatory matters.	Transcripts get speakers wrong, miss tone and context, and contain errors. Treating them as fact builds bias into decisions.	Transcripts misquote and misattribute, and accuracy is weakest for accents and non-native speech — the disadvantage a Title VII discrimination or disparate-impact claim is built on.¹⁵ A verbatim record of a termination meeting is discoverable without the tone that accompanied it.¹

AI notetakers · continued

	The question	What to set	Why	Legal basis
13	What about board and committee meetings?	No notetaker in executive sessions or in director-to-director conversations. For regular board and committee meetings, use AI only to help draft the minutes, and treat the material as restricted.	A word-for-word record of a board discussion preserves every preliminary view and half-finished argument. Minutes exist to record what the board decided, and the minutes are what a regulator or a court will read.	Foley advises against AI-generated verbatim transcripts of committee meetings and prefers AI-assisted minutes.⁶ White & Case: high-risk meetings should be manual minutes only, and directors who know a verbatim record exists engage differently.⁷
14	Should AI notes be labeled?	Yes: “AI-generated draft — human review required.” Keep the corrections, and record who approved the final version.	The label sets expectations and stops a rough summary from being mistaken for official minutes or a word-for-word record.	Review immediately, document corrections, and label output for what it is — including “confidential and privileged” where that applies.²⁵ No AI output should become a formal record without human review and version control.⁷

AI notetakers · continued

	The question	What to set	Why	Legal basis
15	How should deletion work?	Automatically, when the retention period ends, and across everything: recordings, transcripts, summaries, prompts, exports, connected systems and the vendor's own copies. Keep proof it happened and test it periodically.	Pressing delete in the app often leaves copies in exports, integrations, backups, logs and the vendor's systems.	The ICO treats deletion as putting data beyond use, not taking it offline. Delete from backups too, or anonymize where the insight matters and the identities do not.³
16	What proof of good governance should we keep?	A short audit trail, kept longer than the conversations themselves: the tool used, meeting ID, owner, sensitivity, whether notice and consent were given, who accessed or exported it, the retention rule, the deletion date, and any exception or hold.	It lets you show the process worked without keeping the substance of every conversation the company has had.	A retention schedule should list what you hold, why, and for how long, with a process for reviewing it and deleting early where appropriate.³ Documented governance is how accountability is demonstrated.¹