Getting the notes is a setting. Deciding who can start them, who receives them and how long they live is the part that takes an afternoon and saves a year.
Key takeaways
AI notes from Zoom are switched on at the account level by an administrator, enabled for the meetings you choose, and delivered after the meeting to whoever the account settings say. They are not a per-user choice in a firm that has done this properly — they are a configuration decision made once, by someone who has thought about where transcripts live.
Zoom’s own AI assistant product documentation describes what the current generation does: summarising conversations, producing recaps in formats you define, generating follow-ups and documents from meeting content, and searching across past transcripts, chats and files. Meeting-note structure is customisable, which matters more for a firm than it sounds, because the default recap is a narrative and a firm needs a record.
Who can start it. If any host can start note-taking on any call, then note-taking is happening on calls nobody reviewed the appropriateness of — recruitment conversations, partner discussions, a client describing something they would rather not see transcribed. Restrict it, then widen deliberately.
Who receives the summary. The default distribution is usually every participant. For an internal partners’ meeting that is fine. For a call with a client and their counterparty, it is a disclosure decision. Decide per meeting type, not per meeting.
How long transcripts persist and where. A meeting platform is not a document management system. Transcripts that live there indefinitely are outside your file structure, outside your retention schedule and inside your discovery obligations.
What external participants are told. Platform notification is a floor, not a policy. Firms that handle this well say it out loud in the first thirty seconds and put a line in the meeting invitation.
Zoom publishes its privacy statements, global data processing addendum, subprocessor list and regional infrastructure fact sheets through its privacy resources. Those documents — not the feature page — are what answer the questions a client or an insurer will ask: what is processed, by which subprocessors, under what terms, and where.
When you send a recording of a client conversation into any vendor’s system, you have transferred personal information to a third party for processing, and the OPC’s cross-border processing guidelines are clear that responsibility stays with you: the organisation must use contractual or other means to provide a comparable level of protection, and must be satisfied that the processor has policies, staff training and effective security measures in place. That is a procurement task with a named owner, done once, and revisited when the vendor changes its terms.
Internal meetings are straightforward: you set the policy and your people work under it. External meetings are not, because the other participants did not agree to anything when they clicked a link.
Two practical moves. Put a line in the standing meeting invitation stating that AI-assisted notes may be taken and that participants can ask for them to be turned off. Then actually turn them off when asked, without making it a negotiation. The OPC’s generative AI principles put openness among the core expectations — informing individuals what, how, when and why personal information is collected and used — and a request that is technically honoured but socially penalised is not openness.
This is the question firms skip and later regret. If a generated recap describes what a client instructed, it is evidence of what a client instructed. It does not become less so because it was produced automatically or because nobody read it.
Two defensible positions exist. Either the recap is a firm record, in which case it is reviewed, corrected where wrong, filed to the matter and retained on your schedule. Or it is a transient working aid, in which case it is deleted on a short cycle and the file note a person writes is the record. What is not defensible is an indefinite archive of unreviewed transcripts that nobody has decided about, sitting in a platform outside your document management.
Whichever you choose, the Office of the Privacy Commissioner’s guidance for businesses is the right starting point for the retention and safeguards side of the decision.
The firm ran roughly forty external calls a week. Note-taking was inconsistent, and two engagements had drifted because a scope change discussed on a call was never written down.
The configuration they landed on: notes enabled for client delivery calls and internal project reviews; disabled by default for business development calls and anything involving personnel; recaps delivered only to the internal engagement team, never auto-sent to clients; transcripts retained thirty days in the platform; a standing line in every external invitation. A client-facing recap is sent only after a human has edited it, which turns a compliance step into the deliverable clients notice.
What moved: scope changes now appear in writing on the day they are discussed. What did not move: the amount of thinking required to run a good meeting. The tool records the meeting; it does not chair it.
Can I turn AI notes on for some meetings and not others?
Yes, and a firm should. The decision belongs to the meeting type — client delivery, business development, internal, personnel — and should be written down once rather than made by whoever is hosting.
Do participants get told automatically?
Platforms provide notification, but treat it as a floor. Say it aloud and put it in the invitation, particularly where participants outside your firm are on the call.
Should client-facing recaps be sent automatically?
No. An unreviewed recap sent to a client is an unreviewed firm communication. Edit it, then send it — and the edited version is usually the best client-service artefact the whole workflow produces.
A 30-minute call is enough to tell you whether AI pays for itself here.
