Artificial Intelligence Note-Taking in Client Meetings: Consent, Accuracy and Privilege

Sep 11

12 min read

The use of artificial intelligence note-taking tools in client meetings raises a question that is simple to state and difficult to answer well: can a firm record, transcribe and summarise a confidential conversation with a client using a third-party automated service without compromising the confidentiality, privilege and accuracy on which the lawyer-client relationship depends? The attraction of ai note taking legal tools is evident. Attendance notes are time-consuming, are often written from memory after the event, and are frequently incomplete. A transcript and an automatically generated summary promise a fuller record with less effort. The risks are equally evident once the technology is examined: the conversation is transmitted to and processed by a service the firm does not control, the output may contain errors presented with unwarranted confidence, and a recording is a new document that may be disclosable.

The question is therefore not whether such tools are good or bad, but whether and on what conditions a particular tool can be used for a particular category of meeting. That decision engages several bodies of law and professional rules at once: the duty of confidentiality, legal professional privilege and its equivalents, data protection law, the law governing the interception and recording of communications, the rules on the supervision and competence of fee earners, and the contractual terms between the firm and the technology provider. The rules vary by jurisdiction, and in several areas the law has not yet been settled by courts in respect of automated transcription. A cautious approach, supported by a written policy, is warranted.

This article addresses consent, accuracy and privilege in turn, followed by vendor due diligence, data protection, retention, internal policy and a procedure for use. It is intended for practitioners and practice managers deciding whether to permit these tools and, if so, on what terms.

What an AI note-taking tool actually does

To assess the risks, it helps to describe the process in stages, because each stage presents a different legal issue.

Capture. The tool records audio, and sometimes video, of the meeting, either by joining a video conference as a participant, by running on a device in the room or by receiving a feed from a telephone or conferencing system.
Transmission and storage. The audio is sent to a remote server, where it is stored for some period, possibly in a jurisdiction different from that of the firm or the client.
Transcription. Speech is converted to text. Accuracy varies with accents, audio quality, overlapping speech, technical terminology and names.
Summarisation and extraction. A language model generates a summary, a list of action points and sometimes proposed follow-up tasks. The model produces text that is plausible, but it is not a verbatim record and it may omit, distort or invent content.
Distribution and integration. The output may be emailed automatically to participants, stored in the provider's workspace or exported to the firm's systems.
Possible secondary use. Depending on the terms, the provider may retain the data, use it to improve its models, or share it with sub-processors.

Each stage must be understood before the firm can assess whether confidentiality and privilege can be maintained. A firm that has reviewed only the transcript quality has examined one stage out of six.

Consent: recording, notification and the rights of participants

Recording a conversation engages the law on interception and recording of communications, which differs between jurisdictions. In some jurisdictions a conversation may be recorded lawfully with the consent of one participant; in others, all participants must consent. Some jurisdictions treat the recording of a telephone or electronic communication across borders as engaging the law of each location. The firm must therefore consider the rules of every place where the participants are located, and should not assume that the rule in its own jurisdiction governs.

Consent as a professional and ethical requirement

Quite apart from the criminal or civil law on recording, a firm should treat informed consent as a professional requirement. Clients are entitled to know that their confidential disclosures are being recorded and processed by a third party. A client who has not been told may reasonably feel that trust has been breached, and a regulator or court may take the view that the duty of confidentiality required disclosure of the practice.

Elements of informed consent

A statement that the meeting will be recorded and transcribed using an automated tool, and the purpose of doing so.
The identity of the provider, or at least the category of service, and where the data will be processed and stored.
Who will have access to the recording and transcript, including whether any provider staff may review them.
How long the recording and transcript will be kept and how they will be deleted.
Whether the data is used by the provider for any purpose beyond providing the service.
The client's right to decline, and the assurance that declining will not affect the quality of service.
The client's right to withdraw consent, and what happens to material already recorded.

Consent should be recorded in writing, in the engagement letter where the practice is general, and confirmed orally at the start of each recorded meeting so that participants who were not party to the engagement letter, such as a client's spouse, colleague, accountant or an interpreter, also have the opportunity to object. A recording should not begin until the objection window has been given. If any participant declines, the tool must not be used, and the lawyer should revert to conventional note-taking.

Third parties and special cases

Meetings often include persons who are not clients: opposing counsel, experts, witnesses, officials or the other side in a negotiation. The consent of each must be considered separately. A firm should be particularly cautious about using the tool in meetings with witnesses, because a recording or transcript of a witness conversation may be disclosable in proceedings and may be treated differently from a lawyer's own attendance note. Vulnerable clients, minors and persons lacking capacity require additional care, since their ability to give informed consent may be limited. Meetings in which a client discloses matters concerning criminal conduct or sensitive personal data, such as health or immigration status, call for a higher threshold of justification.

Accuracy: the problem of the confident error

The professional duty of competence requires the lawyer to ensure that the record of a client's instructions is accurate. The danger of automated summarisation is that it generates fluent, well-formatted text that appears authoritative, which tempts the user to accept it without checking. Errors of several kinds are recognised in the use of speech recognition and language models.

Types of error

Transcription errors: misheard names, figures, dates, addresses and legal terms. A transcript that records a sum, a date or a party's name incorrectly can lead to a defective document or a missed deadline.
Attribution errors: statements assigned to the wrong speaker, which can be critical where the instruction of one party differs from that of another.
Omission: a summary that leaves out a qualification, a reservation, a condition or a caveat expressed by the client or the lawyer.
Distortion: a nuance rendered as a firm statement, or a hypothetical rendered as a decision.
Fabrication: content that was never said, introduced by the summarisation model, including invented action items or invented commitments.
Misrecorded advice: a summary that appears to record advice given by the lawyer that differs from the advice actually given, creating a document that could be used against the firm.

Verification as a mandatory step

The firm's policy should provide that the transcript and summary are never treated as the record of the meeting without review by the fee earner who attended. A workable procedure is to require the fee earner to read the summary against the transcript, and to check the transcript against the recording at any point where a figure, date, name, instruction or piece of advice is recorded. The fee earner should then correct the output or prepare a conventional attendance note adopted as the firm's record, and should record that verification has taken place. The automated output should be marked as unverified until that step is done.

Where the recording itself is retained, there is a tension: the recording is the most accurate evidence of what was said, but it also increases the volume of material that might have to be disclosed and the risk of embarrassing or damaging remarks being preserved. The firm should decide in advance whether it retains the audio, only the transcript, or only the verified note, and should be consistent in applying that rule rather than deciding case by case after a dispute arises.

Privilege and confidentiality

Privilege is the most consequential legal question. Communications between a lawyer and client made for the purpose of giving or receiving legal advice are, in many common law jurisdictions, protected by legal advice privilege, and communications made for the dominant purpose of litigation may attract litigation privilege. The details differ, and practitioners should consult the law of the relevant jurisdiction. In general, privilege depends on the confidentiality of the communication, and confidentiality can be lost if the communication is disclosed to third parties in circumstances inconsistent with it.

Does processing by a provider waive privilege?

The answer depends on the facts and the law, and in respect of generative artificial intelligence services it is not settled. The prudent view is that sharing privileged communications with a third-party provider creates a risk unless the provider is bound by confidentiality obligations, has no right to use or disclose the data for its own purposes and is acting as a processor or agent for the firm in a manner akin to other service providers such as secure cloud storage. A provider whose terms permit it to use the content to train models, to share it with unspecified third parties or to retain it indefinitely creates a materially greater risk. A firm should not assume that the terms offered to consumers and the terms offered to enterprise customers are the same, and should read the actual terms.

Practical privilege safeguards

Use only tools under a written agreement that imposes confidentiality, prohibits secondary use of content, restricts sub-processors and allows deletion on request.
Do not use consumer-grade or free versions for client meetings.
Restrict access to recordings and transcripts to the matter team, with permissions recorded in the matter file.
Disable automatic distribution of summaries to all invitees, since a summary forwarded to an external participant may disclose privileged advice or be sent to a person outside the privilege.
Mark transcripts and summaries as privileged and confidential, bearing in mind that a label does not itself create privilege.
Avoid recording discussions in which the firm is analysing its own exposure or discussing a client's matter with an insurer, unless the privilege position has been considered.

Disclosure and the status of the recording

A transcript or recording may be a document within the scope of disclosure or discovery obligations, or of a data subject access request. Where it contains the client's own communications with the lawyer, privilege may attach and protect it from disclosure. Where it records a meeting with a third party, such as a witness or counterparty, the position may be different, and the firm should assume that such a record could be required to be produced. Because the lawyer's own attendance note is ordinarily a privileged working document, a verbatim transcript that is not a lawyer's work product may be treated differently in some contexts. The firm should seek advice on how its jurisdiction treats such material before using it routinely in contentious matters.

Data protection and cross-border processing

An audio recording and its transcript contain personal data of the client and any other participant, and may contain special categories of data and information about third parties who are not in the meeting. The firm will generally be a controller of that data and the provider a processor, so data protection law, such as the UK GDPR in the United Kingdom or equivalent legislation elsewhere, is likely to apply. The firm should identify its lawful basis, consider whether a data protection impact assessment is required, and ensure that a compliant processing agreement is in place.

Matters to establish with the provider

Issue	Question to ask
Role of the provider	Does the provider act only on the firm's instructions as processor, or does it determine purposes of its own?
Use for training	Is customer content used to train or improve models, and can this be switched off contractually and technically?
Location of processing	In which countries is data stored and processed, and what transfer mechanism applies?
Sub-processors	Who are the sub-processors, and will the firm be notified of changes?
Retention and deletion	How long is content kept, and can the firm delete recordings and transcripts, including from backups?
Security measures	Encryption in transit and at rest, access controls, logging, and testing arrangements.
Breach notification	What are the notification timings and obligations if there is an incident?
Access by provider staff	Can provider personnel view content, and under what conditions?
Exit	What happens to data on termination, and in what format can it be returned?

Cross-border transfer is a particular concern where clients and participants are in several jurisdictions. The firm should record the transfer mechanism relied on and consider whether any client or regulator imposes data location requirements. Where a client is a regulated entity or a public body, its own contract may prohibit processing by unapproved providers.

Vendor due diligence and contract terms

A firm should treat the adoption of an ai note taking legal tool as it would the engagement of any critical supplier. Due diligence should be documented, and the decision should be approved by a named partner or a risk committee.

Due diligence checklist

Read the full terms of service, privacy notice and data processing agreement, not just the marketing summary.
Confirm whether the product on offer is the enterprise version with the contractual protections described, since many providers offer several tiers with different terms.
Establish whether the tool joins meetings as a visible participant and whether it can be configured to announce itself, since silent recording is a consent hazard.
Check whether the tool can be restricted by user, by matter type and by meeting, and whether administrators can disable it for sensitive matters.
Test the tool on non-confidential material to assess accuracy with the accents, terminology and audio conditions typical of the firm's meetings.
Assess the provider's insurance, financial standing and its willingness to give contractual commitments about confidentiality and security.
Seek confirmation from the firm's professional indemnity insurer that use of the tool does not prejudice cover.
Review the firm's own client engagement terms and any outside counsel guidelines or client contracts for restrictions on the use of third-party artificial intelligence tools.

Some clients, particularly large corporate and institutional clients, now include provisions in their instructions to external counsel that restrict or prohibit the use of generative artificial intelligence on their matters, or require prior written consent. A firm should check its instructions before using such tools on any matter and should record the answer.

Retention, deletion and the audit trail

Recordings and transcripts are records of the firm and, depending on content, of the client. The firm must determine how long they are kept, where they are stored and how they are deleted. A rule that is commonly sensible is that the verified attendance note is the permanent record on the matter file, while the audio is deleted promptly after verification, unless there is a reason to retain it. The reasons for retaining a recording, such as an anticipated dispute about instructions, should be recorded, and the recording should then be held securely under the same retention rules as the file.

The firm should be able to demonstrate who used the tool, for which meetings, with whose consent, and when the output was verified and deleted. An audit trail serves the firm's accountability to clients and regulators and assists if a client later asks what was recorded and who had access. Where the tool integrates with the firm's practice management system, the transcript and verified note should be stored against the matter, and the provider's own workspace should not become a shadow repository of client information.

Writing the firm's policy on AI note taking

A written policy should state the permitted tools, the permitted uses, the prohibited uses, the consent procedure, the verification step, the retention rules and the person responsible. The following elements should be included.

Approved tools only. A list of tools that have passed due diligence, and a prohibition on personal or unapproved tools, including those installed by individual fee earners on their own initiative.
Scope. The categories of meeting in which use is permitted, and categories in which it is prohibited, such as meetings concerning criminal matters, matters involving vulnerable persons, highly sensitive transactions, internal disciplinary or regulatory matters and any matter where the client has restricted the use of artificial intelligence.
Consent. The text of the disclosure, the method of obtaining and recording consent and the requirement to stop if anyone objects.
Verification. The requirement that the fee earner review and adopt the output before relying on it, with a record of the verification.
Distribution controls. Automatic sharing disabled by default.
Retention and deletion. Defined periods and responsibilities.
Incident handling. What to do if a recording is made without consent, shared incorrectly or retained improperly.
Training and review. Mandatory training for users and a scheduled review of the policy as the technology and the law develop.

Practical next steps

Decide whether the firm wishes to permit AI note-taking at all, and, if so, for which meeting types, recording the decision and the reasons.
Check the law and the regulator's guidance on recording and on the use of artificial intelligence in the firm's jurisdiction and in the jurisdictions of regular clients.
Shortlist enterprise-grade tools and carry out documented due diligence, including a review of terms, data location and secondary use.
Obtain the insurer's confirmation and check client instructions and outside counsel guidelines for restrictions.
Draft the consent wording for the engagement letter and the oral statement at the start of meetings.
Adopt the verification procedure and make adoption of the fee earner's note, not the machine summary, the firm's record.
Configure the tool to disable automatic distribution and to apply the firm's retention rule.
Train staff, run a pilot on a limited set of non-sensitive meetings and review the accuracy and the consent experience before wider rollout.

How practice management software supports compliant note taking

Whatever tool is used to capture a meeting, the verified note belongs on the matter file, with a record of who approved it and who may see it. Legalytech is practice management software that holds matters, clients, documents and tasks together, with role-based permissions and an activity record, so that attendance notes, consent records and follow-up actions can be stored against the matter and access to them controlled in the same place.

This article is provided for general information only and does not constitute legal advice. Practitioners should consult the rules of their own jurisdiction and regulator.