On your next client call, the participant list may show one more name than there are people. The extra name is a note-taker that someone on your side connected to their calendar, which joins on its own, records the conversation and sends a summary after the call. It spreads easily, because it costs nothing to start and works without anyone doing anything after the first click.
Where a chat tool holds what your own person typed, a note-taker holds what everyone else on the call said, including clients, candidates and suppliers who never chose it.
Why it spreads without anyone deciding
Most note-takers ask for access to a person's calendar once, and from then on they join meetings by themselves. Depending on the product and its settings, that can mean every meeting with a video link, including ones the person set up and could not attend, or invitations they never answered. The person who connected it often forgets it is there, and the people on the other end of the call never agreed to anything.
So the first question is how many are connected, to whose calendars and on which accounts.
What is at stake
Four things change the moment one joins a call.
The first is consent. Whether you have to tell people they are being recorded, and how, depends on where they are, and some places require everyone on the call to agree. That is a question for your legal advisers. What you can control is that the people on your side know the answer and act on it, since the vendors' own terms generally put that responsibility on the person who brought the tool.
The second is what happens to the recording. Terms differ on whether recordings or transcripts can be used to improve the vendor's models, and on whether that can be switched off for a whole business.
In the United States, Otter.ai faces a class action alleging that its assistant recorded people without their consent and used the audio for training. Otter denies the claims and says audio is de-identified before it is used, and no court has found against it. The case is still a reason to read the training terms before anyone connects a calendar.
The third is where the summary goes. After the call, many tools email the notes to every attendee automatically, or save them to an account the business does not own.
The fourth is what leaves with the person. Recordings on a personal account leave the business with the person, along with every client conversation in them.
Five checks before one joins
- Which account is it on? Only a company-administered account can be audited, controlled and closed by the business.
- Can recordings be used for training, and can the business switch that off for everyone rather than relying on each person?
- Where are recordings kept, for how long, and who can delete them, including when a client asks?
- Who receives the summary automatically? Sending it to everyone outside the business by default is the setting most worth turning off.
- How does it announce itself, and what do your people do when someone asks for it to leave? The only workable answer is that it leaves.
Start with the one you already have
Microsoft Teams, Google Meet and Zoom each have meeting notes built into the platform: Copilot in Teams on the paid Copilot plans, Gemini in Meet under Google Workspace and AI Companion in Zoom. Each runs inside a service you already administer, under terms you have already accepted.
Zoom, for example, says it does not use customer audio, video or chat to train models. Although the consent question stays, the separate vendor and the personal account go, and so does most of the risk of a summary landing somewhere the business cannot see.
Stopping the ones you did not approve
There are three levers, and they work best together.
- Stop the calendar connection. Microsoft 365 and Google Workspace both let an administrator restrict which outside apps a person can grant access to their work account, which stops a new note-taker being connected in the first place.
- Use the meeting controls. Microsoft has been rolling out a Teams meeting policy for external bots that either holds detected note-takers in the lobby until someone admits them or blocks them outright. Because detection is not perfect and does not affect Copilot, treat it as a backstop rather than the whole answer.
- Write the rule down in your AI policy, with the approved tool on the register. A line that works reads something like this: "On any call with people outside the business, use only the company's meeting notes, say so at the start and switch them off if anyone asks."
Where this fits
The readiness snapshot looks for note-takers, because each one leaves a calendar permission behind in your Microsoft 365 or Google Workspace tenant, along with the account it belongs to. Bringing those under company sign-in is part of Govern, the same step that moves people off personal ChatGPT plans.
If you would rather get a first view on your own, ten questions take about two minutes and send nothing anywhere.