AI note-takers in your meetings: a fill-in set-up sheet and meeting notice for small EU businesses (GDPR and EU AI Act)
What you get: a finished AI note-taker set-up sheet: 17 decisions to fill in once for each meeting assistant or transcription bot you use, each with the GDPR or EU AI Act article it supports. Plus a paste-ready meeting notice (calendar line, spoken line, privacy-notice paragraph), a never-record list, a meeting-type sheet, a 30-second check before each call and a short list of what to do this week. Built from the GDPR, the consolidated AI Act on the Commission's AI Act Service Desk, the Commission's guidelines on prohibited AI practices and the Spanish data protection authority's note on AI voice transcription.
The short answer
An AI note-taker records or listens to a meeting and turns it into a transcript or summary. Voices, names, what people said and the call metadata are personal data, so the GDPR applies in full: a legal basis (Article 6), a notice before it starts (Article 13), processor terms with the supplier (Article 28), and keeping the material no longer than needed (Article 5(1)(e)). A DPIA is likely to be expected where you record staff regularly, record job interviews, or the meeting touches health or other special category data (Article 35).
The EU AI Act does not ban transcription or summaries. It adds one hard line that already applies: since 2 February 2025 it is prohibited to use AI to infer the emotions of people in the workplace, including job candidates, from biometric data such as voice or facial expressions, except for medical or safety reasons (Article 5(1)(f), read with the definition in Article 3(39)). The Commission's guidelines on prohibited practices give "AI systems monitoring the emotional tone in hybrid work teams by identifying and inferring emotions from voice and imagery of hybrid video calls" as a prohibited example, and say inferring emotions from written text alone is outside the ban. Fines for prohibited practices go up to EUR 35 million or 7% of worldwide turnover; for SMEs, the lower of the two applies (Article 99(3) and (6), see our fines guide).
AI note-taker set-up sheet (fill once per tool)
| # | Decision | What to write down | Why (source) |
|---|---|---|---|
| 1 | Tool and owner | Name of the note-taker, where it runs (built into your video-call app, a bot that joins the call, a phone app), who in the business decides when it is switched on, and whether it joins meetings automatically. Set automatic joining to off unless you have a reason. | Accountability: GDPR Art. 5(2) and 24 |
| 2 | Meetings it may join, and never joins | Write two short lists. A typical 'never' list: disciplinary, grievance and performance talks, health or sick-leave conversations, legal advice, works council or trade union matters, and client meetings where the client has not agreed. | Data minimisation Art. 5(1)(c); special category data Art. 9 |
| 3 | What it captures | Choose the least you need: summary only, transcript, audio recording, or video. If a summary is enough, do not keep audio or video. | Data minimisation Art. 5(1)(c); data protection by default Art. 25(2) |
| 4 | Legal basis per meeting type | For example: internal team meetings = legitimate interest (write down the short balancing test); calls with clients or suppliers = legitimate interest or consent; job interviews = think twice, because candidates and staff may not feel free to say no. The Spanish authority (AEPD) notes consent may be impaired in an employer-employee relationship. Check the official source and your national employment rules. | GDPR Art. 6(1); Art. 7 (consent); Art. 88 (national employment rules) |
| 5 | Notice before the meeting | Paste the notice below into the calendar invite and say the one-line version at the start. Link to a fuller privacy notice. | Information duty Art. 13 |
| 6 | How someone says no | Name the person who switches it off on request, and make it easy: one message before the call or one sentence at the start, no questions asked. | Right to object Art. 21 (where you rely on legitimate interest) |
| 7 | Emotion, mood, tone or 'engagement' features | Switch off any feature that reads emotions or intentions from voice, face or video for staff, contractors or job candidates. This is a prohibition, in force since 2 February 2025, not a setting preference. Text-only sentiment on a transcript is outside this ban but is still personal data; we suggest off. | AI Act Art. 5(1)(f) and Art. 3(39); Commission guidelines on prohibited practices; dates Art. 113(a); fines Art. 99(3) |
| 8 | Speaker scores used to judge staff | Talk-time, interruption or 'performance' scores used to evaluate staff can turn a note-taker into a workplace monitoring tool. If you plan to use them for decisions about people, run the high-risk check first (duties apply from 2 December 2027). In Germany and some other countries a works council has a say before such tools are introduced. | AI Act Annex III point 4(b); Art. 113(c)(i); for Germany § 87(1) no. 6 BetrVG |
| 9 | Supplier terms | Signed GDPR processor terms, the list of sub-processors, where recordings and transcripts are stored, and the legal basis for any transfer outside the EEA (for example the EU-US Data Privacy Framework adequacy decision for participating US companies, or standard contractual clauses). Ask the supplier to name it in writing. | Processor contract Art. 28(3); transfers Art. 44-46; Implementing Decision (EU) 2023/1795 |
| 10 | Training on your meetings | Is the supplier allowed to use your recordings or transcripts to train or improve its models, and can people at the supplier listen to them? Turn this off in settings or get a written 'no'. The AEPD notes that a supplier who retrains on your data acts as a separate controller for that, with its own legal basis. This is a GDPR point, not an AI Act rule. | GDPR Art. 5(1)(b), 28; AEPD blog, 14 Jan 2026 |
| 11 | Retention | Write a number for each thing kept: audio/video [__] days, transcript [__] days, checked summary [kept with the project file]. Set auto-delete in the tool if it has one. The numbers are your choice; the law asks for no longer than necessary. | Storage limitation Art. 5(1)(e) |
| 12 | Who can see and share | Limit access to the organiser and named people. Turn off automatic sharing of full transcripts to every invitee, especially external ones; send a checked summary instead. | Security Art. 32 |
| 13 | Human check | Someone who was in the meeting reads the AI summary before it is sent or relied on. AI summaries can attribute words to the wrong person or miss a 'no'. | Accuracy Art. 5(1)(d) |
| 14 | Access and erasure requests | Transcripts and recordings that relate to a person are their personal data. Know how to search, export and delete one person's data in the tool before the first request arrives. | Right of access Art. 15(3); erasure Art. 17 |
| 15 | Records and DPIA screening | Add the tool to your record of processing activities and do a DPIA screening. The under-250-staff exemption from records does not apply to processing that is not occasional, which regular meeting recording usually is. Check your national authority's DPIA list. | Art. 30(1) and (5); Art. 35(1), (4) |
| 16 | Staff know how to use it | Short briefing for anyone who switches it on: the 'never' list, the notice, the emotion-feature rule, how to delete. Keep a record of who was briefed. | AI Act Art. 4 (AI literacy, as amended) |
| 17 | Local recording and works council rules | Some countries treat recording a private conversation without authorisation as a criminal offence (in Germany § 201 StGB covers the non-publicly spoken word), and some give employee representatives a say on monitoring tools. Check the official source for each country where participants sit. | National law, for example § 201 StGB and § 87(1) no. 6 BetrVG (Germany) |
Keep the filled sheet with the tool's entry in your AI register, together with the supplier's written answers. If the supplier refuses a point (for example, will not stop training on your data), record the refusal and decide which meetings, if any, the tool may still join.
Never-record list (starting point)
- Disciplinary, grievance, performance and dismissal conversations
- Health, sick leave, pregnancy, disability or family matters
- Legal advice and dispute strategy
- Works council, trade union or employee representative meetings
- Job interviews, unless you have done the legal-basis and DPIA work and told the candidate in advance
- Client or supplier meetings where the other side has not agreed, or has asked you not to
- Any meeting where someone asks for it to be switched off
Paste-ready meeting notice
Calendar invite line
This meeting will use [tool name], an AI note-taker, to [record audio and] produce a [transcript and] summary for [purpose, e.g. action points for the project file]. [Business name] is responsible for this. The [recording/transcript] is deleted after [30] days; the checked summary is kept [with the project file]. If you would prefer not to be recorded or transcribed, tell [name] before or at the start and we will switch it off. More information: [link to privacy notice].
Spoken line at the start
"Before we start: [tool name] is taking notes for us [and recording the audio]. If anyone would rather it didn't, say so now or message me, and I'll switch it off."
Saying this line is about transparency and giving people an easy way to object. It does not by itself make consent your legal basis; record the basis you actually rely on in row 4.
Privacy-notice paragraph
AI meeting notes. When we use an AI note-taker in a meeting, [business name, address, contact email] is the controller. We use it to [produce accurate notes and action points]. Our legal basis is [our legitimate interest in keeping accurate records of meetings / your consent / performing our contract with you]. The tool is provided by [supplier], which acts as our processor[, and may store data in [country] under [transfer basis]]. We keep recordings and transcripts for [__] days and checked summaries for [__]. You can ask for access to, correction or deletion of your data, object to this processing, or ask us not to use the tool in a meeting, by writing to [contact]. You can also complain to your data protection authority.
These are the main Article 13 items (who, why, legal basis, recipients, transfers, retention, rights). Check the official source for the full list and adapt the wording to your situation.
Meeting-type sheet (one row per kind of meeting)
| Meeting type | Note-taker allowed? | Captures | Legal basis | Who is told, how | Retention | Emotion/sentiment features | Reviewed by |
|---|---|---|---|---|---|---|---|
| [weekly team call] | [yes] | [transcript + summary, no audio] | [legitimate interest, test written 20/10/2026] | [calendar line + spoken line] | [transcript 30 days] | [off] | [team lead] |
| [client project call] | [only if client agrees in writing] | [summary only] | [consent of client contacts] | [email before first call] | [summary with project file] | [off] | [account manager] |
| [job interview] | [no] | [n/a] | [n/a] | [n/a] | [n/a] | [n/a] | [owner] |
The three rows above are made-up examples to show how to fill the sheet, not legal conclusions for your business.
30-second check before each call
- Is this meeting on the never-record list? If yes, note-taker off.
- Did the invite carry the notice line? If not, say the spoken line and offer to switch it off.
- Are there people from outside the business, or in another country? Check row 17.
- Emotion, tone or engagement features still off?
- After the call: check the summary before sending it, and send the summary, not the full transcript.
Do this week
- Find every AI note-taker in use, including ones staff switched on in their own video-call accounts (SME AI inventory template)
- Turn off automatic joining and any emotion, mood or engagement feature
- Fill the set-up sheet for each tool and send the supplier the open questions (AI vendor questions, supplier clause sheet)
- Add the notice line to your calendar template and the paragraph to your privacy notice
- Set retention and delete old recordings you no longer need
- Tell staff the rules in your staff AI use policy and use the staff and applicant notice if AI is used about them
This sheet is a starting point, not a legal opinion or proof of compliance. AI Act references were checked on 20 October 2026 against the consolidated text on the Commission's AI Act Service Desk (including the Digital Omnibus amendments: Articles 3, 4, 5, 99, 113 and Annex III) and the Commission Guidelines on prohibited AI practices (C(2025) 5052 final). GDPR references are to Regulation (EU) 2016/679 on EUR-Lex; the EUR-Lex page did not load from our checker on 20 October, so check the official source for exact wording. Retention periods and the suggested wording are our suggestions, not legal requirements. National laws on recording conversations, employee monitoring and works councils differ by country and are only given as examples; check the official source and ask a lawyer before you rely on this. Spot an error in this guide? Write to mininglife7@gmail.com.
For accountants and tax advisers
Many clients now have a note-taker in every call, including calls with you about payroll, staff or health-related absences. At the next review, ask which meeting tools record or transcribe, hand over this set-up sheet with the client AI inventory workshop, and agree for your own calls with them which ones the note-taker may join. Stay inside your professional rules and pass legal drafting to a lawyer.
Keep the sheet with your AI register
The EURO AI Register free edition runs in your browser with no account and no upload. It covers your first 10 AI systems and 10 evidence records, the screening questions, duties by role with dates, and a printable Article 4 AI-literacy record. List each note-taker once, pick your role (usually deployer), and store the filled set-up sheet and the supplier's terms as evidence records against it.
When you need more than 10 systems, the EURO AI Register membership starts at $19 a month and adds unlimited systems, rule updates and email help. Neither tool is legal advice or proof of compliance.
Partner programme opening soon
Partner programme opening soon: join the free waitlist. Planned terms are 50% of each referred sale (75% once you have 5+ paying customers), single level, paid through Gumroad only from revenue received.
Free start: list your AI tools in the EURO AI Register free edition, then fill one set-up sheet per note-taker. Related: Article 5 prohibited practices list · Annex III high-risk check · record-keeping and logs · AI Act deadline sheet.
Sources
- European Commission AI Act Service Desk: Article 5, prohibited AI practices (consolidated text with Digital Omnibus amendments)
- AI Act Service Desk: Article 3, definitions (point 34 biometric data, point 39 emotion recognition system)
- AI Act Service Desk: Article 4, AI literacy (as amended)
- AI Act Service Desk: Annex III, high-risk AI systems (point 4, employment)
- AI Act Service Desk: Article 99, penalties
- AI Act Service Desk: Article 113, application dates (as amended)
- Commission Guidelines on prohibited AI practices, C(2025) 5052 final (PDF): Article 5(1)(f) section, biometric data and workplace examples
- Regulation (EU) 2024/1689 (AI Act) and Regulation (EU) 2026/1744 (Digital Omnibus on AI)
- Regulation (EU) 2016/679 (GDPR): Articles 5, 6, 7, 9, 13, 15, 17, 21, 24, 25, 28, 30, 32, 35, 44-46 and 88
- Commission Implementing Decision (EU) 2023/1795: EU-US Data Privacy Framework adequacy decision
- AEPD (Spanish data protection authority): AI voice transcription, implications for data protection (14 Jan 2026)
- Germany: § 201 StGB and § 87 BetrVG (examples of national rules)
Unadhi Guides are free, independent explainers. We correct errors as soon as we find them: write to mininglife7@gmail.com.