Where do my AI meeting notes actually go?

Every meeting tool now offers to take the notes. Teams has Copilot, Google Meet has Gemini, a dozen companies will send a bot to sit in the call, there is a recorder the size of a credit card for the meetings that happen across a table, and there are free tools that do the whole job on your laptop. What none of them puts on the box is where your meeting went to get the summary.

Does Copilot send my meeting to America?

Probably, sometimes. Microsoft makes two separate promises. The first is about storage. A UK company’s Teams recordings, transcripts and Copilot history are stored at rest in the UK. The second is about processing, and here the wording is careful: Copilot’s calls to the model go to the nearest data centre, but can be sent to other regions when capacity is short, and customers outside the European Union “may have their queries processed in the US, EU, or other regions”. The UK is outside the European Union’s data boundary, so that sentence is about us. The transcript lives here. The thinking about it may not.

What makes that acceptable to most firms is the wrapping. Copilot sits inside the same contract as the rest of Microsoft 365, including its data protection terms. Prompts, transcripts and responses are not used to train the models. Microsoft has opted out of the human review that its own Azure service normally does. And since the summer, Copilot can hand work to models run by Anthropic and OpenAI as subcontractors; for a UK company the Anthropic ones are off unless your administrator turns them on, and the OpenAI ones have been on by default since July.

Two things catch people out. Plain transcription is included with Teams, but Copilot in the meeting is an add-on at £23.10 a user a month paid yearly, before VAT, and the free Copilot Chat does not do meetings. And the prompt that asks each attendee to agree to being recorded exists, but is off by default. Out of the box, attendees get a banner and are included regardless.

Google Meet is simpler and less comforting. Its note taker comes with Business Standard and Business Plus, not Business Starter. Google promises not to train on your content without permission, but there is no UK region for Google Workspace at all. On a Business plan the closest you can get is Europe, and only for storage. Google’s own consent prompt arrived in May, also off by default, and since July the notes land in the organiser’s Drive with a shortcut in every attendee’s Drive, which is worth knowing before you invite a client.

Are the note-taker bots safe to use?

The bots are the tools that join the call as a participant: Otter, Fireflies, Fathom, Read.ai, and the ones that sit on your machine without a bot, like Granola. Almost all of them store your meetings in the United States. The one European exception among the well-known names is tl;dv, a German company with servers in Germany and Finland.

The question that matters is what the company may do with your meeting once it has it, and the answers vary more than the marketing suggests. Fireflies, tl;dv and Read.ai say they do not train on customer content. Fathom and Granola train their own models on anonymised meetings by default, with a switch to turn it off. Otter’s privacy policy says it trains its own models on de-identified recordings and transcripts, and there is no switch. Its marketing page says something that sounds like the opposite, because it is talking about its suppliers’ models rather than its own.

That distinction is now in front of a court. Otter is being sued in California by people who never signed up to it but were in meetings its bot attended. On 13 August this year the judge refused to throw most of the case out, saying it was plausible that Otter was a third party listening in rather than an assistant acting for its customer. The reason she gave was that Otter keeps the recordings and trains on them. Nothing has been proved, but the shape of the argument is the one your clients would make.

The platforms have noticed. Since the summer Teams holds these bots in the lobby marked as unverified until the organiser approves them, and Google Meet flags them as a potential risk. Neither is a ban. Both are a hint.

What about the recorder in my wallet?

The credit-card recorder is the Plaud Note, at £119 in the UK with 300 free minutes of transcription a month, which is about an hour a week, and then £99.99 a year for 1,200 minutes. It is good hardware and not a private device. It records; everything else happens in the cloud. Plaud says so in its own trust centre, and names the models it uses: GPT, Claude and Gemini. So an in-person meeting recorded on the table goes to Plaud’s servers and on to at least one of three other American companies before the summary comes back. Plaud holds those suppliers to no-training terms and publishes a proper data processing agreement with UK contract clauses, which is more than most of the bots do. It is not on the Data Privacy Framework list, so that agreement is what you are relying on.

The alternatives are thinner. Anker’s soundcore recorder costs a little more at £149.99, works the same way, and does not say which company’s AI reads your meeting. Limitless, the pendant, closed its UK service in December after Meta bought it. Amazon’s Bee cannot be bought here. If the recorder route appeals, Plaud is the one with paperwork you can read.

Can I keep everything on my laptop?

Yes, and for a lot of firms this is the right answer. Two free, open-source tools do the whole job on the machine: Meetily, which runs on Mac and Windows, and anarlog, which used to be called Hyprnote. Both listen to your microphone and to whatever meeting app is running, so there is no bot in the call, and both transcribe on the machine using the same speech models the big companies use. I used Meetily for months and it works. The one paid extra worth knowing about is speaker labels, which Meetily charges for at roughly £8 a user a month, priced in dollars.

Two honest limits. Words come out well: the current models get somewhere between two and seven words in a hundred wrong on ordinary English. Telling speakers apart is a different matter; the best free option gets it wrong roughly one time in five on real meeting audio. And “nothing leaves the laptop” is only true until you ask for the summary. Every one of these tools makes it very easy to send the finished transcript to a cloud model to write it. You can run a small local model for that step too, and on a modern laptop with 16 gigabytes of memory it does a decent job of an hour-long meeting, but it is a choice you have to make on purpose.

I now use a tool we built ourselves, for reasons that will not apply to most people. I use Teams, Meet and everything else, so a note taker tied to one of them was never going to work; I have taught it the words and company names I actually use; and it strips names, contact details and money out of the transcript before anything leaves the machine. I would not tell anyone else to build their own. Meetily does almost all of that already, free and maintained. Ours exists because experimenting is part of the job here.

What the laptop tools cannot do is the thing Copilot does best. Copilot knows who is in the meeting, so with ten people on a call it can say who agreed to what. A local tool hears voices, not names. Where the record of who committed to what is the point, that is a real advantage for the built-in option. In most of my meetings the point is the plan, so I live with it.

What does the law actually ask of me?

Less than people fear and more than most tools do for you. There is no UK rule about how many people in a meeting have to agree to a recording; that idea is imported from American state law. What UK data protection law asks is that you have a proper reason to record, that you are honest about doing it, and that you keep the result no longer than you need it. For a business, the reason is normally a legitimate interest, not consent. The regulator says consent is usually the wrong basis for staff, because they cannot freely refuse their employer.

Honesty is the part that bites. The Information Commissioner’s Office is direct about people outside the business: “You must tell these people that you are recording the call and why.” An employment appeal judge went further in a case about a member of staff who recorded a meeting without saying so, ruling that failing to announce a recording “will generally amount to misconduct”. Say it at the start, every time. Nobody has ever objected to me, and I think that is because I can say in one sentence what the tool is, that it runs on my laptop, that the notes go nowhere else, and that they will get the summary so they need not take their own.

The regulator also expects a data protection impact assessment before a business switches on an AI tool, in “the vast majority of cases”, and it wrote a 41-page one itself before enabling transcription in its own Teams meetings. Yours can be two pages: what is recorded, where it goes, who can see it, how long it is kept, and what happens when someone says no. For a US-based tool, lawful transfer rests on the UK’s data bridge with the United States. The tool has to be on the Data Privacy Framework list, the entry has to be active, and it has to include the UK extension. If it is not on the list, you need the standard contract clauses and a written risk assessment instead. The legal challenge to that framework in Europe failed last September, an appeal is pending, and the regulator has said the UK bridge would not automatically fall even if the European one did.

Accountants have one extra line to add. The Institute of Chartered Accountants says putting client information into a publicly available AI tool is likely to breach confidentiality unless the client has agreed, and suggests a sentence in the engagement letter saying AI-enabled software may be used. If you are an HR consultant, remember that a transcript of a sickness or grievance conversation is health data, and needs its own justification.

Which one should my firm pick?

It depends on what you already pay for, and I would distrust any article that said otherwise. If you are on Microsoft 365 and already trying Copilot, use it in Teams, internal meetings first, and turn the consent prompt on. If you are on Google Workspace Business Standard or above, the Gemini notes are inside a contract you have already signed. If you are not paying for any AI tool and do not want to start, install Meetily or anarlog and keep the summary local. If most of your meetings happen across a table, the Plaud recorder is the honest choice among the devices, or a laptop running Meetily does the same job for nothing.

Whichever it is, the five checks are the same.