AI use policy for a company using AI transcription in meetings

AI note-takers join video calls, record everyone, transcribe what they say, summarise it and store it, often invited by one attendee without the others' agreement and often on a free account whose terms nobody read. The result is a record of the business's confidential meetings, its customers' calls, its legal advice and its staff's conversations, held by a provider, searchable, and disclosable in a dispute or a subject access request. The policy sets when a note-taker may be used, who must be told and asked, which meetings are excluded, how transcripts are retained and checked, and what the business's terms with customers, suppliers and staff say about it. I draft both (the AI use policy and the contract provisions that accompany it) for the business for £995 fixed in five working days.

Who this is for

Businesses in England and Wales whose staff use AI note-takers, meeting assistants or transcription tools in internal meetings, customer calls, sales calls, interviews or board meetings.

What matters in an AI meeting transcription policy

The bot that joins the call and the people who did not agree

A note-taker that joins a call records the voice and words of every participant, which is personal data and often confidential, and the participants from other organisations (customers, suppliers, candidates, advisers) did not agree to be recorded by a tool they may not recognise; the policy requires the host to tell all participants at the start that a tool is recording and transcribing, to ask whether anyone objects and to remove the tool if they do, to disable automatic joining (most tools join every calendar meeting by default), to disable the tool's distribution of transcripts unless the business wants it, and to use only the business's approved tool on the business's account.

Lawful basis, notice and the consent the regulator expects

putting personal data into an AI tool is processing under the UK GDPR, so it needs a lawful basis, transparency to the individuals, an Article 28 agreement with the provider and, for uses that affect people, an Article 35 impact assessment, and recording a meeting is processing of every participant's data; the policy sets the basis for internal meetings (legitimate interests, with staff told in the employee privacy notice and the handbook) and for external meetings (legitimate interests with the notice at the start and the objection honoured, or consent where the meeting is sensitive), requires the business's privacy notice to describe the tool, requires the tool to be under a data processing agreement with training excluded and retention limited and the transfers under Article 46 known, and requires the impact assessment where the tool is used on customers or candidates at scale.

Confidential meetings, privilege and the transcript that should not exist

confidential information, trade secrets and clients' data must not be entered into tools whose terms permit the provider to use inputs for training or to retain them, which the Trade Secrets (Enforcement, etc.) Regulations 2018 and the business's own confidentiality obligations make a question of reasonable steps, and a transcript of a meeting is the business's confidential information held by a third party; some meetings must not be transcribed at all: meetings with the business's lawyers (a transcript held by a provider risks waiving privilege and creates a disclosable document), meetings under an NDA that prohibits recording, board meetings (where the minutes are the record), disciplinary and grievance meetings, meetings about personnel or health matters, and meetings where a participant has objected; the policy lists the excluded categories and tells staff to switch the tool off.

Employees, monitoring and the meeting that becomes a performance record

Transcribing and analysing staff meetings (and the tools' features that score participation, sentiment and talk time) is monitoring of workers, which the Information Commissioner's guidance on monitoring expects to be necessary, proportionate, disclosed in advance, assessed and limited, and the policy requires the employee privacy notice and the handbook to describe the transcription and any analysis, prohibits the analysis features unless the business has assessed and justified them, prohibits using transcripts as performance evidence unless the staff were told that was a purpose, sets who may access transcripts of meetings they did not attend, and addresses the transcript's status in a dispute (a disclosable document, and within a subject access request from anyone who appears in it).

Retention, accuracy and the summary that was wrong

Transcripts and recordings should be retained for a stated short period and then deleted (the tool's default is often indefinite), with the summary kept where the business needs a record and the recording deleted sooner than the transcript, and the policy sets the periods and requires the tool's settings to apply them; generated summaries misattribute statements, invent action items, mistranscribe names and figures and omit what mattered, and the policy requires the summary to be checked by an attendee before it is circulated or relied on, prohibits summaries being sent to customers or external parties as a record of what was agreed without that check, and makes the meeting owner responsible for the circulated summary.

The contract provisions that go with the policy

The contract provisions drafted with the policy go into the customer terms and the business's engagement terms (the recording and transcription of calls disclosed, the customer's right to object, the summaries not forming the contractual record), the supplier agreement with the transcription provider (training excluded, retention set, the data processing agreement, the location, no distribution of transcripts outside the business, deletion on request), the staff contracts and handbook (the transcription and any analysis disclosed, the excluded meetings, the policy incorporated), and the NDAs the business signs; the policy is issued with the tool's settings configured to match it (automatic joining off, distribution off, retention set), because the tool's defaults are the opposite of the policy.

What it costs

AI use policy, £995. Internal policy plus the accompanying contract provisions. Five working days.

AI provisions in a contract, £595. Review or draft AI-specific terms in a supply or customer agreement. Five working days.

Email me at geoffrey@caesar.co.uk with what you need and any documents, and I will confirm the scope and the fee in writing, usually the same working day.

What you get

• An internal AI use policy your staff will follow, rather than a document that bans everything and is quietly ignored
• Contract provisions covering output ownership, training data, confidentiality and liability
• A defensible position to give customers who ask what your AI governance looks like
• Review of your AI suppliers' terms, including what they reserve the right to change
• Practical guidance on what to permit, what to restrict and what to prohibit outright
• One round of amendments

What is not included

• Technical AI assurance, model testing or bias auditing
• Sector-specific regulatory approval
• Advice on non-UK regulatory regimes beyond flagging where they apply
• Ongoing regulatory monitoring

Questions I am often asked

Can we use an AI note-taker on customer calls?

With the customer told at the start, able to object and the tool removed if they do, on the business's approved tool under a data processing agreement with training excluded and retention set, and described in the privacy notice. Not on a free account one attendee invited.

Which meetings should never be transcribed?

Meetings with your lawyers (privilege), meetings under an NDA that prohibits recording, board meetings, disciplinary and grievance meetings, meetings about personnel or health matters, and any meeting where a participant objects. The policy lists them and staff switch the tool off.

Can we use transcripts to assess staff performance?

Only if staff were told that was a purpose, the monitoring is assessed and proportionate, and the analysis features are justified. A transcript used in a disciplinary process that staff did not know was kept is the grievance and the claim.

Related guidance and services

• AI contracts and AI use policies, £995, the service this page describes
• Data protection agreements and privacy terms, £795
• Employment contracts and handbooks, £595
• Employee privacy notice
• AI use policy for a sales team

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: October 2026. Email geoffrey@caesar.co.uk.