AI Meeting Notetakers: The Compliance Risk No One Is Auditing

One in three US employees has already had an AI notetaker sit in on a work meeting, and only 34.7% of them recall being asked for real permission before it recorded. Otter.ai and Fireflies.ai, two of the most widely used assistants, are now facing active class-action lawsuits in US federal courts for recording without consent. If your company uses one of these tools in board, HR or legal meetings, chances are no one in IT or legal has actually reviewed what that AI does with the audio.

What changed in 2026

On August 13, 2026, Judge Eumi K. Lee (US District Court, Northern District of California) ruled on the motion to dismiss in the consolidated case In re Otter.AI Privacy Litigation. She dismissed part of the claims, but let the core ones proceed: the Electronic Communications Privacy Act (ECPA), California’s Invasion of Privacy Act (CIPA §631), and the Illinois Biometric Information Privacy Act (BIPA). The argument that convinced the court: plaintiffs allege Otter doesn’t just transcribe for the user who invited it — it retains the audio and trains its own technology on those conversations and on each participant’s “voiceprint,” even for people who never installed the app or created an account. That, the judge found, makes Otter a third-party eavesdropper, not merely a tool acting on the host’s behalf.

Fireflies.ai faces a similar problem: a lawsuit filed December 18, 2025 (Cruz v. Fireflies.AI) and another filed in March 2026 (Fricker v. Fireflies.AI) accuse its “Speaker Recognition” feature of creating biometric voice identifiers without the written consent BIPA requires — again from people who never signed up for the service. Otter’s own privacy policy, updated June 16, 2026, now lists among its purposes “training our proprietary AI technology on de-identified audio recordings”: what looks like a meeting note to the user can be training data for the vendor.

A survey commissioned by Kolmogorov Law (via Pollfish, July 8, 2026, 500 employed US adults) confirms this isn’t a fringe issue: 33.4% of employees have had an AI notetaker in a work meeting, and of those, only 34.7% say they were always asked for permission beforehand; 25.1% were never asked. 18.8% of all respondents discovered after the fact that a meeting had been recorded without their knowledge.

Why this isn’t just a US problem

The lawsuits above rest on US statutes (ECPA, CIPA, BIPA) that don’t apply directly to a company operating in the EU or the Gulf. But GDPR sets an even stricter consent bar on one specific point: a generic “this meeting is being recorded” notice is not enough. What an AI assistant actually does — transcribing, summarizing, indexing, and in some cases using the content to train a model — is data processing separate from the recording itself, and GDPR (Articles 6 and 7) requires consent that is informed, specific, and cannot be delegated to a single participant clicking “accept” on everyone’s behalf. For meetings involving customer data, employee data, or protected legal information, data protection authorities recommend a data protection impact assessment before rolling these assistants out systematically.

What nobody says out loud

Companies treat these assistants like any other productivity app — the same drawer as a shared calendar. In practice, it’s software an employee connects to their own calendar without going through IT or legal, that joins every video call on its own as a silent participant, and that records, transcribes, and stores on a third party’s servers conversations that can include a salary negotiation, a layoff decision, an unpublished financial figure, or legal strategy. Nobody is auditing which AI assistants are actually connected to the company’s meetings, what retention policy each vendor applies, or whether those recordings could end up as evidence in a dispute — which is exactly the question now being tested in US courts: whether an AI transcript strips attorney-client privilege from a conversation that would otherwise be protected.

Illustrative example (not a real case, used here to show the mechanism): a board is discussing a possible acquisition. One of the directors has had an AI meeting assistant connected to their personal calendar for months, originally for their own team’s standups. The bot also joins the board meeting, without anyone having invited it on purpose, transcribes the full conversation, and stores it in that director’s personal account — outside the control of legal or IT. Months later, in a shareholder dispute, that transcript surfaces as evidence requested during discovery.

What to check before it becomes a problem

• Who activated each AI assistant that is currently connected to the company’s calendars and video calls, and with what permissions.
• What the vendor actually does with the audio and transcript: does it retain them, train models on them, truly anonymize them, or just claim to?
• Whether “voiceprints” of participants are being generated, and under what legal basis.
• Whether the bot can auto-join sensitive meetings (board, HR, legal, finance) without notice or specific consent from each attendee.
• What the vendor’s current privacy policy actually says — not the version you read when you signed up, because it changes: Otter changed its own in June 2026.

This is the same pattern we’ve already flagged with Shadow AI: tools an employee adopts on their own, genuinely useful, but with no one responsible for legal or security risk even aware they exist or what they do with the data. The same “nobody approved it, but everyone uses it” problem we already covered with AI voice cloning fraud.

At OptimaQuantum, we audit which AI assistants — meeting bots or any other tool — are actually connected to your company’s systems, assess the legal and security risk of each one, and leave you with a clear policy on what’s allowed and what isn’t, backed by a team that has already done this work for government and regulated-sector clients. Start with our AI & Automation services or contact us directly to review your case.

Frequently Asked Questions

Is it illegal to use Otter.ai or Fireflies in my company? Not by itself, but without informed, specific consent from every participant — a generic “this meeting is recorded” notice doesn’t cover it — the processing can breach GDPR, especially when the meeting involves customer data, employee data, or confidential information.

What’s the difference between recording a meeting and using an AI assistant? A plain recording stores audio or video. An AI assistant also transcribes, summarizes, indexes, and in some cases uses the content to train its own technology (as Otter’s privacy policy has acknowledged since June 2026): that’s additional data processing that needs its own legal basis.

Can an AI transcript be used as evidence in litigation? That’s exactly one of the questions US courts are now exploring in the cases against Otter.ai and Fireflies: if the transcript is stored outside the company’s control, it can end up being requested as evidence, even when the original meeting would otherwise be covered by attorney-client privilege.

What can my company do right now? Inventory which AI assistants are connected to the company’s calendars and video calls, disable auto-join for sensitive meetings, and require specific consent from every participant before enabling any of these tools.

Does this only apply to video-call meetings? No: any tool that transcribes or summarizes a work conversation with AI — including the ones built into Microsoft Teams or Zoom — processes the same data and is subject to the same consent obligations.

Sources consulted: August 13, 2026 ruling by Judge Eumi K. Lee in In re Otter.AI Privacy Litigation (US District Court, Northern District of California); Cruz v. Fireflies.AI Corp. (filed Dec. 18, 2025) and Fricker v. Fireflies.AI Corp. (filed March 2026); Otter.ai privacy policy (version effective June 16, 2026); Kolmogorov Law survey via Pollfish (July 8, 2026, 500 US employees); Articles 6 and 7 of the EU General Data Protection Regulation (GDPR).