The short answer: before an AI note-taker joins a call with a client, settle four things — whether everyone on the call knows and agrees, where the audio and transcript go, who receives the summary, and how long any of it is kept. Most tools make all four decisions for you by default, and the defaults are set for convenience rather than for your clients.
Of all the AI features arriving in small businesses, meeting note-takers are the ones that spread fastest and get decided on least. Someone tries one, it's genuinely useful, and within a month it's joining every call on their calendar — including the ones with clients who were never asked.
Why this one is different
With a chat window, a person chooses what to paste in. A note-taker doesn't choose. It captures everything said, including what the client mentioned in passing: a diagnosis, a separation, a dispute with a neighbour, the reason a payment was late. Information you would never have typed into a tool ends up in a transcript anyway.
Three other features make it easy to miss:
- It often joins automatically. Connected to a calendar, it attends any meeting with a link, whether or not the person who connected it is there.
- It's often on a personal account. The person who set it up signed in with their own email, so the recordings sit outside anything the business administers.
- It arrives inside software you already pay for. Video platforms, practice management systems and CRMs are adding transcription and summaries, sometimes switched on by default. The point in privacy basics applies here in full: your existing software counts too.
Consent is not one rule
Recording laws in Australia are set by each state and territory, and they are not consistent. In some jurisdictions, recording a private conversation without the consent of the people in it can be an offence, with exceptions that turn on the circumstances. A call between a Sydney office and a client in Perth may touch two sets of rules at once.
We're not going to summarise those laws here, because a summary would be wrong for someone. The practical position that holds up everywhere is simple: tell everyone at the start, in words, that the call is being recorded and transcribed by an AI tool, and get a clear yes. Then say it again once the recording has started, so the consent is in the transcript itself.
Regulated work adds a layer. Health, legal, financial and disability services carry professional and confidentiality obligations on top of the general law, and some clients' own policies prohibit recording outright. If your work is regulated, get advice on recording before it becomes a habit rather than after.
Where the recording goes
A note-taker sends audio to a vendor, which turns it into a transcript and a summary. The questions are the same ones you'd ask of any AI tool, and the answers vary between products and between the free and paid tiers of the same product:
- Where are the audio and transcript processed and stored, and is that onshore or offshore?
- How long are they kept, and can the business delete them?
- Are they used to train or improve the vendor's models, and is that on by default?
- Is the account the business's, administered by the business, or one person's?
The full set is on questions to ask any AI vendor, the printable version is the vendor checklist, and why the same product gives different answers by tier is in free tier, paid tier.
Settle these before the first client call
- Which note-taker, on which account, approved by whom
- How consent is asked for and recorded at the start of each call
- Where transcripts are stored, and when they're deleted
- Who the summary is sent to — and that it isn't sent automatically
- Which meetings it never joins
The summary becomes the record
Transcripts mishear. Names, street addresses, medication names, figures and anything said over a bad line come back wrong, confidently. Summaries go further: they smooth over disagreement, and they can describe as agreed something that was only discussed.
That matters because once a summary is filed or sent, it's a business document. If it says you agreed to a price, a date or a scope, the client will reasonably treat it as what was agreed. Turn off automatic sending to all attendees, and send the summary only after someone who was in the meeting has checked it — the same five checks in how to check an AI draft apply.
If you'd rather an outside party found out which note-takers are already attending your meetings, that's the first step of a policy and audit engagement.
See policy & auditMeetings it should never join
Some conversations don't belong in a third-party transcript at all, whatever the consent position. A reasonable starting list:
- Performance, disciplinary or grievance conversations with staff
- Calls with your own lawyer — ask them before anything is recorded
- Conversations about a person's health, unless you're a health service set up to handle that properly
- Internal discussions about a client complaint or dispute
- Any call where someone hasn't clearly agreed
Add your own, in your own terms, and put them on the same page as your never list. If the rule doesn't exist yet, a one-page AI policy has room for it.
Find out what's already running
The likeliest situation isn't that you're deciding whether to start. It's that a note-taker is already joining calls. Look for unfamiliar attendees in recent meeting invites, check the admin settings of your video platform for transcription and summary features, and ask the team — about the work, not the tool, so you get a real answer. How to run that conversation is its own article.
If your business uses software that summarises or scores people's information to make decisions, the Privacy Act change in December is relevant too: automated decisions and your privacy policy.