September 23, 2026 · 22 min read · Professional secrecy

AI notetakers in client meetings: what lawyers must know before the bot joins the call

Q: Where should an AI notetaker never be used?

As a default, not in criminal defence or regulatory matters, where a recording becomes something a search warrant can reach; not with witnesses or prospective clients, where US ethics guidance defaults to not recording at all; and not in settlement talks without an express written agreement from everyone beforehand.

AI NotetakersRecording ConsentProfessional SecrecyData Protection

On 13 August 2026, a federal judge in San Jose declined to dismiss claims that Otter.ai's meeting bot behaves as a third party inside the meetings it joins rather than a tool the person who invited it controls. The plaintiffs had alleged that Otter uses what it records to train its own models (1). A week earlier, the New York City Bar's ethics committee had set the default rule for lawyers reaching for the same kind of tool with a witness, a prospective client or an opposing party: absent a good reason, do not record the conversation at all (2). Together, the two events change what a firm has to work out before an AI notetaker comes near a confidential conversation: which safeguards apply, and in which jurisdiction.

The short answer: no European bar association or data-protection authority has yet issued guidance written specifically for AI meeting notetakers. Older rules on recording, professional secrecy and data protection already answer most practical questions once you see how they apply to a bot on a call. The Netherlands requires an advocate to announce any recording, including an automated one, before it happens. Germany makes a participant's own recording of a conversation a potential criminal offence. France presumes consent to an open recording, but only where nobody objects when they could have. None of that changes because the tool calls itself an assistant rather than a recorder.

What an AI notetaker actually does

An AI notetaker looks like note-taking, but it changes the conversation in ways a lawyer listening and writing by hand does not. The vendor becomes a third party present in a call that would otherwise involve only the people invited to it. An audio record now exists where none did before, and it can outlive the meeting indefinitely. The written summary it produces is not something anyone in the room actually said. And the audio, the transcript and the summary are all stored outside the room, on infrastructure the lawyer did not choose, sometimes feeding back into the vendor's own product.

Three designs currently do this work, and each carries a different risk. Otter and Fireflies use a visible bot that joins as a named participant, at least giving the room a chance to object. Teams, Zoom and Meet build the feature in natively, so a host can switch it on without the other participants specifically agreeing. Granola, the subject of the lawsuit discussed below, goes further still: it runs on one participant's own device with no visible presence at all. A companion piece in this Journal covers the related question of typing privileged material into a chat-based AI tool rather than talking near one.

What changed in the past nine months

NYC Bar 2025-6: consent, review and the "predicate recording" problem

On 22 December 2025 the New York City Bar's ethics committee issued the first opinion written for lawyers who record, transcribe or summarise client conversations with AI (3). A lawyer must obtain the client's consent before an AI tool records the call, even in a one-party-consent state. The ethical duty of loyalty goes further than the criminal-law floor: a recording can be disclosed to a vendor, retained beyond the meeting, and reached by subpoena, so confidentiality and privilege are at risk from the moment recording begins. Vendor due diligence must cover storage, retention, discoverability, whether the vendor trains on the material, deletion rights and security. Every AI-produced recording also needs independent human review soon after creation, because the risk lies in "the creation and existence of the predicate voice recording" itself, not only in a summary read later. Where the client runs the notetaker, the engagement letter should require advance notice, treat an unreviewed summary as not binding, and require prompt disclosure to counsel.

NYC Bar 2026-2: the default is not to record

On 5 August 2026 the committee turned to conversations with everyone who is not the lawyer's own client (2). Its default rule: absent a good reason, do not record. That default applies to prospective clients, witnesses, an opposing party's staff, co-counsel and settlement talks. Even where recording is technically allowed, lawyers must separately ask whether it is tactically wise, since a casual remark becomes formal evidence once transcribed. For a prospective client the opinion calls this a paradox: recording could document a proper conflict check, but it also creates the very record the check is meant to protect. It addresses this article's core scenario directly: a call where an opposing party or the client's employer brings a tool the lawyer did not choose, leaving no control over its security and often no access to the transcript. Competence, it says, now includes knowing how to turn a recording function off.

Otter, Fireflies and Granola: the litigation that named the problem

In re Otter.AI Privacy Litigation consolidated four class actions filed in 2025 before Judge Eumi K. Lee in the Northern District of California, alleging Otter's bot joins Zoom, Teams and Meet calls, records and retains them without every participant's consent, and uses the material to improve its own models. Otter's answer was that its bot joins as an invited participant and works as the host's own recording tool. On 13 August 2026 the court held that, at this stage, the answer did not dispose of the case (1): plaintiffs had plausibly alleged Otter acts as a third-party eavesdropper, not an extension of an invited participant, because it independently uses recordings for its own commercial purposes. The Wiretap Act claim, a California privacy claim and two Illinois biometric-privacy claims survived; several others were dismissed with leave to amend. Nothing has been proved, and the case remains at the pleading stage.

Two further suits sharpen the same point. Cruz v. Fireflies.AI Corp., filed 18 December 2025 in Illinois, was brought by a participant who never created an account or consented to voiceprint collection at a videoconference her host had enabled Fireflies to join (4). Chamberlain v. Granola, filed 30 July 2026 in California, targets a tool marketed as never joining the call visibly at all, while by default feeding recordings into its own training (5). If Otter turns on what a vendor does with a recording, Granola adds a prior question: whether anyone had a chance to notice a recording at all.

England and Wales has no notetaker-specific rule either, but the Solicitors Regulation Authority's warning notice of 17 August 2026 sets the temperature (6). It is a general AI-misuse warning, not a recording rule. It notes that AI systems, free or paid, may put confidentiality at risk because inputs can be stored or used to improve the tool, and points to the Upper Tribunal's warning that careless AI use with client material can permanently waive privilege. Solicitors remain accountable for everything delivered under their name, whatever tool produced it.

Two ethics opinions, one federal ruling and two further lawsuits arrived within eight months, all versions of the same fact pattern: a third party listening to a professional conversation and doing something with what it hears. No European bar association or data-protection authority has yet issued guidance for that fact pattern specifically. The silence does not mean the law is silent. A firm in Amsterdam, Frankfurt or Paris has to assemble the answer from criminal law, professional-conduct rules and data-protection law, none of it written with AI notetakers in mind, but together they say more than the gap in guidance suggests.

May the conversation be recorded at all?

Netherlands: consent to record is not compliance with the rules of conduct

Dutch criminal law is a participant-consent regime. Articles 139a and 139b of the Criminal Code only penalise recording by someone who is not a participant, or other than on a participant's instruction; a party to the call may record it lawfully (7). On that basis the Disciplinary Council for Arnhem-Leeuwarden, on 13 May 2019, admitted a client's own secret recordings of his lawyer as disciplinary evidence (8); the decision says nothing about what the lawyer may do.

What binds the lawyer is Rule 4 of the Rules of Conduct: an advocate who lets a third party listen in, or who records a call, must announce it beforehand, a duty the explanatory note extends expressly to automated recordings; making notes is excluded, storing audio is not (9). Whether a text-only summary tool falls inside that duty is debated; the safer reading treats a vendor listening in as a third party being let in, so every notetaker should be announced, whatever it technically stores.

Germany: the transcription bot is a criminal-law question first

Section 201(1) no. 1 of the Criminal Code makes it an offence, punishable by up to three years' imprisonment, to record the non-publicly spoken word of another without authorisation, reaching a participant, not only an outside eavesdropper (10). A closed client video call is non-public, so a transcription bot raises a criminal-law question before a data-protection one: whether every participant has authorised the recording itself, not just the summary that follows. The Federal Constitutional Court's 2002 decision grounds the point constitutionally, protecting a person against a conversation partner secretly bringing in a third-party listener (11), exactly what an AI vendor is when it listens through one participant's device. Commentary distinguishes transient live transcription, where audio is never stored, from tools that buffer or store it, which on that view fall within section 201; a January 2026 analysis concludes most off-the-shelf notetakers fail the narrow test for dispensing with consent (12). No German court has yet decided a case on AI transcription specifically.

France: silence after notice may count as consent, so object

Article 226-1 of the Criminal Code punishes capturing or recording private or confidential words without consent, but presumes consent where the capture happened in the sight and knowledge of those concerned, without objection, when they could have objected (13). A visible, announced bot can trigger that presumption, so silence is not a safe response if a lawyer disagrees; the objection has to be made expressly, while it can still be heard.

Most US states require only one party's consent to record; a minority, including California and Illinois, require everyone's. The New York City Bar does not let a lawyer rely on the more permissive rule: disclosure and permission from every participant are required regardless of which state's law applies (2). In England and Wales the SRA's notice says nothing about recording consent as such; the discipline there comes from the general duty of confidentiality (6).

Is the AI vendor inside the circle of secrecy?

Recording rules decide whether a conversation may be captured; a separate question is whether the vendor that captures it may be professionally involved at all. In the Netherlands, article 11a of the Advocates Act extends confidentiality beyond the advocate to the people involved in the practice, the hook for any outside vendor (14). Rule 3(2) of the Rules of Conduct requires appropriate measures in the choice of communication tools, data processing and data storage, and in the security of those tools (9), and the Dutch Bar's 2025 AI recommendations add that confidential data should go only to tools with solid contractual safeguards or hosted within the firm, ruling out an unvetted consumer notetaker (15).

German law is the most granular. Section 43a(2) of the Federal Lawyers' Act states the basic duty; section 43e is the statutory basis for using any outside provider, requiring careful selection, a text-form contract on confidentiality, limits on the provider's own use and retention, subcontracting rules, and comparable protection abroad (16). Section 203 of the Criminal Code backs this criminally: a lawyer may share a secret with participating persons only so far as needed, and a participating person, including vendor staff, who then discloses it is separately liable (17). Section 2(2) of the Rules of Professional Practice adds a risk-adequate technical standard (18). The Federal Bar's December 2024 guidance notes that the mere possibility of access, not actual knowledge, is enough, and, because it is unsettled whether providers based in the United States offer comparable protection, recommends preferring providers with servers in Germany or Europe where possible (19).

French law starts from the position that almost the whole file is covered already. Article 66-5 of the 1971 Law lists meeting notes alongside consultations and the case file as covered by professional secrecy (20), so an AI transcript falls inside secrecy the moment it is made. Article 4 of the 2023 deontology decree calls that secrecy a matter of public order, absolute, general and unlimited in time (21); breach is an offence under article 226-13 (22). The National Bar Council's guide on ethics and AI, published 17 March 2026, tells lawyers never to feed secrecy-covered information to a generative AI tool, and sets a four-point hosting check: where client data sit, who operates that infrastructure, where the model's data sit, and who provides the model (23). It does not mention meeting transcription anywhere, so the check, written for drafting tools, has to be applied to it by analogy.

The Otter reasoning and the professional-secrecy reasoning converge: a vendor that uses a recording for its own purposes sits outside the circle these rules describe. Inside it sits a provider bound by contract, limited to what the service needs, unable to use the material for anything else.

Data protection: who is the controller, and who trains on what

Under the GDPR, the firm is the controller, and the vendor should be a processor only where it acts solely on the firm's instructions under article 28. A vendor that also trains on recordings for its own benefit, the allegation that survived the motion to dismiss in the Otter litigation, is processing for a purpose of its own. For that processing it is not acting as the firm's processor, and how the roles are then divided depends on the facts; the simpler course for a firm offered such terms is to have training excluded or to choose another tool. Every participant, not only the host's client, must be informed under articles 13 and 14 of the controller's identity, purpose, legal basis, recipients and retention. A lawful basis under article 6 is normally legitimate interest or performance of the engagement, not consent, which sits awkwardly where one party depends on the other. Article 9's special-category regime applies only where voice is used to uniquely identify a speaker, not to every recording that captures one. A data protection impact assessment under article 35 is needed for systematic or high-risk processing, such as a notetaker used across all client calls. The article 44 transfer rules apply whenever recordings leave the EU, which they often will, since many vendors are based in the United States. Minimisation and limited retention under article 5(1)(c) and (e) mean a tool that keeps the whole call by default has a problem independent of consent (24).

Article 5(1)(f) of the AI Act, in force since 2 February 2025, bans AI systems intended to detect emotional state in a workplace setting (25), reaching a sentiment layer some notetakers sell on top of transcription, not the transcription itself.

National practice adds detail the GDPR text does not. In Germany, the Datenschutzkonferenz's guidance on videoconferencing systems, from October 2020, requires a processing agreement wherever a provider has access to personal data, and full Chapter V compliance for transfers outside the EU (26). In the Netherlands, a December 2024 impact assessment for the Dutch state found four high risks in Microsoft 365 Copilot, mainly insufficient transparency, and central government bodies were advised not to use it pending mitigation (27), a measure of how much diligence a platform-native tool needs. In France, the authority's only guidance on call recording dates from 2009 and is flagged by the authority itself as outdated (28); it still recommends a short buffer, listen within days, write a note, then delete the raw audio, mapping onto the predicate-recording risk the New York City Bar identified.

The transcript is a new document, and it is not always a correct one

A recording changes the character of what was said. An off-hand remark becomes a fixed, timestamped piece of the file the moment it is transcribed. The New York City Bar's 2025 opinion makes this central: do not rely on an AI transcript without independently verifying it, and re-review any informal remark that now looks like formal advice (3). Summaries also fail in predictable ways: they misattribute speakers on multi-party calls, drop a negation and reverse a meaning, and turn a tentative hypothesis into settled-looking advice. None of that argues for avoiding the tool. It argues for treating every AI note as an unreviewed first draft, checked by the lawyer who was there.

Once a recording exists, control over it is not entirely in the firm's hands. France's Cour de cassation ruled on 22 December 2023 that unlawfully or unfairly obtained evidence is no longer automatically inadmissible in civil proceedings; a court instead weighs whether admitting it would be indispensable and proportionate (29). In the Netherlands, the 2019 disciplinary decision took a client's secret recordings of his own lawyer into account (8). Germany's 2002 decision shows the same balance running the other way: a bare interest in securing evidence was not enough to justify admitting testimony about a secretly overheard telephone call (11). None of these systems guarantees a recording will stay out of court; assume that once it exists, it can surface.

When the other side brings the bot

Often the firm does not control the notetaker: opposing counsel, a counterparty, an expert, a mediator, or the client's own employer, may bring an AI tool to a call the firm's lawyer did not choose. Check the participant list at the start, ask whether a tool is recording, state whether the firm consents, and if not, ask for its removal before the substantive discussion begins. If the other side declines, do not proceed on the assumption the point can be revisited, and confirm what was agreed in writing afterwards.

Silence is not safe anywhere, though the stakes differ by jurisdiction. In France, staying quiet once a bot is visible risks the article 226-1 presumption operating against the silent party (13); object expressly, while it can still be heard. In the Netherlands, Rule 4 binds the opposing advocate too, a disciplinary lever the criminal law does not give (9). In Germany, an opposing party's bot recording without every participant's authorisation exposes whoever deployed it to section 201, and the 2002 reasoning applies equally to a counterparty's tool (10) (11). The New York City Bar's 2026-2 opinion is written for exactly this scenario: no control over the tool's security, no way to verify the transcript and no access to it afterwards are reasons enough to decline (2).

Where an AI notetaker belongs, and where it does not

Not every conversation carries the same risk. The following is not exhaustive, but it covers the situations that come up most often.

Internal knowledge sessions and training. Low risk with notice to attendees; no client relationship or third-party confidentiality to protect.
First client intake. Usually no. Nothing is yet known about conflicts or sensitivity, and the 2026-2 opinion calls recording here a paradox: it could document a proper conflict check, but it also records the very information the check protects (2).
Criminal defence and regulatory investigations. No audio recording, as a rule; seizure of a device or account is a real prospect.
Witness interviews. Default no: a decontextualised transcript or exposed work product usually outweighs the convenience (2).
Negotiations and settlement discussions. Only with an express written agreement from every side beforehand.
Board-level or workplace investigations for a client. Check the client's own obligations first. French labour law, for example, forbids collecting information about an employee through a device the employee has not been told about in advance (30); check the equivalent rules elsewhere.
Routine status calls with a client who agreed in the engagement letter. Acceptable with an approved tool and the controls below.

A firm policy in eight controls

Default off. No AI notetaker joins a call automatically; remove calendar integrations that invite a bot to every meeting.
An approved-tool list, in tiers. Consumer tools nobody uses for client work, business tiers needing a contract and location check, and tools the firm has actually contracted under the safeguards below.
Contract to the German standard, everywhere. A written secrecy undertaking, purpose limitation, no training on the firm's recordings, disclosed subcontractors, and comparable protection where the provider is abroad (16).
Announce at the start, and record the fact. A short spoken notice naming the tool and asking for consent, with the answer noted in the file, meets the Dutch announcement duty and obtains the consent German and French law look for.
Review within 48 hours. The lawyer who was on the call checks the transcript against what was said and flags anything that reads as advice but was only a hypothesis (3).
Delete the audio once the note is filed. Keep the raw recording only long enough to review it, per the buffer logic still recommended in France (28); the recording, not the summary, usually creates the exposure (3).
Put client-run notetakers in the engagement letter. Require advance notice, treat an unreviewed summary as not binding, and require prompt disclosure to counsel (3).
Train people, including how to switch it off. Competence now includes disabling a recording function (2), part of the AI-literacy duty in article 4 of the AI Act (25); see our guide to AI literacy under Article 4.

What to actually say

A script only works if it sounds like something a person would say, not a disclaimer read from a card. Something close to this covers the Dutch, German and French requirements at once, adapted to the language of the meeting:

"Before we start, I should mention that we'll be using [name of tool] to record and transcribe this call so we have an accurate note. It will pick up everyone's voice, and I'll check the transcript myself before anything goes into the file. Is everyone happy with that, or would you rather I just took notes by hand?"

If someone else's AI tool is running and the firm's lawyer has not agreed to it: "I'd like to ask that [tool] be switched off, or I'll need to leave the call. I've no way of knowing where that recording ends up, and I'm not in a position to agree to it." Silence after that request is not consent; follow it up in writing the same day.

How this fits the way LexVera supports legal work

Every rule above comes back to one question: is the material still inside the circle of people allowed to hold it, and can the lawyer prove it. LexVera is not a meeting notetaker. The principle behind a trustworthy meeting note, that a summary is only as good as its trace back to what was actually said, is the one LexVera applies to legal research and to the documents in a matter. The platform is provided to the firm for the firm's own use, with access the firm controls; matter material stays inside the context the firm has approved, and it is not used to train models.

When a reviewed meeting note becomes part of a matter file, the same discipline applies: analysis built on it should point back to the passage it relies on, so a lawyer can check the statement rather than take it on trust. A qualified lawyer, not the tool, decides what becomes advice, correspondence or a filing; that is the standard set out in our editorial policy.

Frequently asked questions

Do I need a client's consent before an AI notetaker records a call?

Yes. The New York City Bar's 2025 opinion requires consent before an AI tool records a client call, even in a one-party-consent state, since the ethical duty goes beyond the criminal-law floor. Dutch, German and French law reach similar results through an announcement duty, a recording offence and a consent presumption. Announce it every time.

Is it a crime to record a client call in Germany without saying so?

It can be. Section 201 of the Criminal Code makes recording the non-public spoken word of another an offence without authorisation, reaching a participant, not only an eavesdropper. A closed client call is non-public, and no German court has yet decided a case on AI transcription, so treat the safer reading as operative.

What if the other side brings their own AI notetaker to a call?

Ask at the start whether a tool is recording, and say clearly whether you consent. If not, ask for it to be switched off or ask to be removed. In France, silence after a visible bot appears can be read as consent under article 226-1, so object expressly and confirm it in writing.

Does an AI notetaker vendor count as someone a lawyer may share client information with?

Only if it meets the tests for any outside provider: appropriate safeguards under Dutch rules, a written contract meeting the German section 43e standard, or a documented hosting check under French deontology. A vendor that uses recordings to train its own models, as alleged against Otter, sits outside that circle.

Does the GDPR require consent from everyone on the call?

Not necessarily as the legal basis, though everyone must be informed. The firm is usually the controller and can rely on legitimate interest or performance of the engagement rather than consent, which sits awkwardly given the power imbalance involved. Every participant must be told who is processing their voice, and why.

Where should an AI notetaker never be used?

Not in criminal defence or regulatory matters, where a recording becomes something a search warrant can reach; not with witnesses or prospective clients, where US ethics guidance defaults to not recording; and not in settlement talks without an express written agreement beforehand.

Sources and methodology

This guide reflects legislation, court and regulatory decisions, bar guidance and litigation filings available on 23 September 2026. Some of what it describes is commentary or a pleading-stage filing rather than settled law, and that is noted in the text where it applies. It is general professional information rather than advice on a specific matter; provider terms and the status of pending litigation should be checked at the time of use.