AI Meeting Assistant Security Guide: Controlling Notetaker Bots, Recordings and Consent

AI notetakers now join meetings that nobody invited them to, record conversations that participants assumed were private, and email transcripts to people outside the organisation. They arrive two ways: as built-in features of the meeting platform (Copilot in Teams, Gemini "Take notes for me" in Google Meet, Zoom AI Companion) and as third-party bots that a single employee connects to their calendar. This guide covers both: how each type gets in, the platform controls that detect and hold bots in the lobby, the identity controls that stop the calendar grant in the first place, recording consent, transcript retention and how to measure whether the policy works. It is written for collaboration platform owners, identity and security engineers, privacy and legal teams, and executives who chair sensitive meetings. Platforms are listed alphabetically throughout; order is never a ranking.

Key takeaways

• The calendar grant is the real control point. A third-party notetaker usually joins because one user gave it OAuth access to their calendar; blocking or reviewing that consent stops it across every meeting that user attends.
• Built-in and third-party assistants need different rules. Built-in assistants stay inside your tenant's retention and access controls; external bots copy audio and transcripts into another company's cloud under that company's terms.
• Platforms now detect bots, imperfectly. Microsoft Teams holds detected external bots in the lobby by default, but Microsoft states some bots may go undetected, so detection backs up policy rather than replacing it.
• Consent is a legal question, not just a banner. Some jurisdictions require every party to agree to a recording, and a 2025 US class action against a notetaker vendor centred on bots joining without participants' consent.
• Transcripts are records. Decide who can see them, how long they live and whether they can be used for model training before the first pilot, not after a transcript reaches the wrong inbox.

How AI meeting assistants get into your meetings

Understanding the entry route tells you which control works. There are four common paths, and most organisations have all four at once.

The calendar route is the one that surprises people. Carleton College's IT team documented in 2026 that once a user connects the Otter Notetaker to a calendar, it scans upcoming events for meeting links and joins Google Meet, Zoom and Microsoft Teams meetings, and keeps doing so after the user stops using the app. Ejecting the bot is temporary because it tries to rejoin. The same post found that a browser extension could record a meeting without notifying other participants.

A calendar-connected notetaker is a non-human identity: a vendor service holding a delegated OAuth token that reads your users' calendars and acts on their behalf. Treat it the way you treat any SaaS integration. See the SaaS and OAuth App Governance Guide.

Built-in assistant controls by platform

Built-in assistants are usually the safer choice because the data stays under your tenant's controls, but their defaults still matter. The table below records the settings as described in each vendor's documentation, checked 8 November 2026.

• Teams "only during the meeting": this mode is the closest thing to a no-record assistant. It suits board, HR and legal meetings where an in-meeting summary is useful but a saved transcript is not wanted. Remember that turning Copilot off for a meeting also turns off recording and transcription.
• Google Meet consent: turning on the explicit consent requirement makes every participant click Start, Join or Continue, or Leave. It is off by default, so it is a deliberate decision for regulated tenants.
• Google Meet sharing: "invited guests" means everyone on the Calendar invite, not just attendees. For meetings with external parties, set the default to internal guests or hosts only.
• Zoom locking: enabling a feature without locking it lets each user change it. Lock the account or group setting for populations such as legal, HR and deal teams.

Zoom states it does not use customer communications content to train its own or third-party models. Record each platform's training statement in your assessment with the date read, because these terms change.

Detecting and blocking third-party notetaker bots

Platform-side bot controls stop a bot that has already been invited. They are the second line, after the identity controls in the next section.

Microsoft Teams external bot detection

Teams has a meeting policy setting, "Manage external bots and their access to meetings", in the Meeting join and lobby section. The PowerShell attribute is ExternalBotAccessMode:

• RequireApprovalWhenDetected (default): "When detected, require approval before joining". Detected bots are labelled and held in the lobby regardless of the meeting's lobby configuration, and the organiser sees a reminder about the risk of admitting them.
• AllowBots: "Do not detect bots". Bots appear as ordinary external participants.

Detection uses infrastructural and behavioural signals during join. Microsoft states that some bots may go undetected and that humans are occasionally misclassified; an organiser can admit a person and mark them "This is not a bot" for that meeting. The setting applies to meetings, not events. Microsoft also recommends restricting lobby admission to organisers and co-organisers so presenters cannot bypass the check. Keep the default and pair it with that restriction.

Google Meet and Zoom

• Google Meet: use the meeting access settings so that only trusted participants join directly and others knock, and use host management so only hosts admit. Combine this with the consent requirement above so any recording or notes start visibly.
• Zoom: enable the waiting room for external participants and use the account setting that blocks users from specific domains from joining, adding the domains of notetaker vendors you have not approved. Carleton's guidance names blocking the vendor domain in Zoom as a host-side stopgap.

Approved notetakers

If you approve a third-party notetaker, make that explicit: one sanctioned product with an enterprise contract, SSO, admin-controlled auto-join and retention, and a named owner. Fireflies, for example, documents SSO, a Super Admin role, a Rules Engine for meeting access, Custom Data Retention, AES-256 encryption at rest and a Private Storage option on its Enterprise tier. Otter's trust centre lists SOC 2, HIPAA, GDPR and CCPA documentation and topics for conversation permissions and data erasure, with reports available on request. Ask each vendor for the same evidence set. See the AI Usage Control and Shadow AI buyer's guide.

Where identity fits: stopping the calendar grant

A notetaker that cannot read the calendar cannot find the meeting link. Controlling OAuth consent is therefore the single most effective technical control for third-party bots, and it also closes a wider consent phishing risk.

1. Inventory existing grants first. Consent policy changes only affect future consents. Export current grants for calendar, mail and online meeting scopes and list the notetaker vendors among them.
2. Revoke unapproved grants after notifying the users concerned, and remove the service principals or app access entries.
3. Restrict future consent using the settings above and route requests through the admin consent workflow.
4. Allowlist browser extensions on managed browsers so that local capture extensions cannot be installed. See the Browser Extension Security Guide.

Delegated calendar access is exactly the kind of grant attackers abuse too. See the Consent Phishing and Illicit OAuth Grants Guide.

Recording consent and transparency

Recording and transcription laws differ by jurisdiction, and AI notetakers make it easy to record without anyone deciding to. This section is orientation, not legal advice; your legal team should set the rule.

• All-party and one-party consent: US federal wiretap law permits recording with the consent of one party, but several states, including California under Penal Code section 632, require the consent of all parties to a confidential communication. A meeting with participants in several states or countries should follow the strictest rule that applies.
• Data protection law: in the UK and EU, a recording or transcript of identifiable people is personal data. You need a lawful basis, must tell people about the processing (UK GDPR Article 13) and must apply retention limits.
• The 2025 class action: in August 2025 a proposed class action filed in the US District Court for the Northern District of California alleged that a notetaker vendor's bot could join meetings through a host's linked calendar without the consent of participants, and that recordings were used to train its models. The allegations are unproven.
• Visible indicators are not consent: a roster entry or a pencil icon tells people something is happening; it does not capture agreement. Where your rule requires consent, use the platform's explicit consent prompt or state the recording at the start and give a route to object.

Make the rule practical: a default (for example, recording and AI notes off for meetings with external parties unless all parties agree), named exceptions (HR investigations, legal privilege, board sessions where assistants are banned) and a short script organisers read when recording starts.

Transcript retention, access and confidentiality

A transcript is a searchable, quotable record of what people said, often less guarded than email. It can be disclosable in litigation and subject access requests, and it may capture privileged legal advice.

• Classify meetings: apply your data classification to meetings, not just documents. Restricted meetings (deal teams, HR cases, security incidents, legal advice) should ban third-party assistants and default to no saved transcript.
• Set retention explicitly: built-in transcripts follow your platform retention (Purview, Meet retention policy, Zoom cloud recording settings). Set periods that match your records schedule and make sure deletion actually happens. See the AI Data Retention and Deletion guide.
• Control sharing: default notes sharing to internal attendees or the organiser, never "all invited guests" for meetings with external parties.
• Watch summary distribution: automatic summary emails go to inboxes outside your retention controls and can be forwarded. Prefer links to the stored record over attachments.
• Training and secondary use: require contractual confirmation that meeting content is not used to train models, and note where vendor wording differs between pages. Fireflies' security page, for example, says customer data is not used for training "by default" in one section and "never" in another, which is a point to clarify in contract.
• Prompt injection through meeting data: assistants that read calendars and meeting content can be manipulated by text an outsider places there. In the Gemini calendar prompt injection of 2026, a crafted invite led the assistant to leak private meeting details into an event the attacker could read.

Implementing a meeting assistant policy

1. Discover (weeks 1 to 2): export OAuth grants for calendar and meeting scopes, list installed meeting-related browser extensions, and pull meeting participant reports for display names and domains of known notetaker vendors. See the Shadow AI Discovery Guide.
2. Decide (weeks 2 to 3): pick the approved assistant (built-in, a sanctioned third party, or both), the consent rule and the restricted meeting categories. Write them into the acceptable use policy. See the Shadow AI Policy Template.
3. Configure in audit mode (weeks 3 to 5): enable Teams bot detection and lobby admission limited to organisers, Meet consent prompts and host controls, Zoom waiting rooms and locked AI settings, for a pilot group first. Turn on admin consent workflow requests without yet revoking grants, to see demand.
4. Enforce (weeks 5 to 8): restrict user consent, revoke unapproved grants with a notice to each user, block unapproved vendor domains and extensions, and lock built-in assistant settings for restricted populations.
5. Test: invite an unapproved notetaker to a test meeting from a pilot account and confirm it is blocked at consent or held in the lobby; confirm transcripts land in the right location with the right sharing and retention.
6. Roll back safely: every change here is a policy setting. Keep the previous values recorded (for example the prior ExternalBotAccessMode and consent policy IDs) so you can revert a pilot ring quickly if legitimate accessibility or captioning tools break.

Accessibility: transcription and captions are reasonable adjustments for some colleagues. Provide an approved route (built-in captions or an approved assistant) before you block anything, so the policy does not push people back to unmanaged tools.

Choosing an approach: small and large organisations

Detection and measurement

• What to log: OAuth consent events for calendar and meeting scopes in your identity provider audit logs; meeting participant reports; Teams lobby admissions of detected bots; changes to meeting and AI policies in each admin centre.
• Alert on: a new consent to an unapproved notetaker vendor, any policy change to ExternalBotAccessMode or Copilot settings, and bot participants appearing in restricted meetings.

Framework mapping

Common failure patterns

• Kicking the bot out instead of revoking the grant: removing a notetaker from a meeting does nothing about the calendar token; it rejoins the next meeting.
• Turning detection off because of one false positive: switching ExternalBotAccessMode to AllowBots tenant-wide to fix a single misclassified attendee, rather than using "This is not a bot" for that meeting.
• Sharing notes with every invitee: leaving notes sharing at "all invited guests", so an external party on the invite receives the internal discussion that happened after they left.
• Assuming a banner equals consent: relying on a roster entry or icon in jurisdictions or contracts that require agreement.
• Banning without an alternative: blocking every assistant without an approved option, which drives staff to browser extensions and personal accounts that capture audio with no roster entry at all. The Samsung ChatGPT source code leak of 2023 shows how quickly confidential material reaches consumer AI tools when the sanctioned route is missing.
• Forgetting the retention side: controlling who records but not how long transcripts live, so years of candid conversation accumulate as discoverable records.

Practitioner checklist

• Export and review all OAuth grants with calendar or online meeting scopes; revoke unapproved notetakers.
• Restrict user consent (Entra verified publishers with selected permissions, or Workspace API controls) and enable the admin consent workflow.
• Keep Teams ExternalBotAccessMode at RequireApprovalWhenDetected and limit lobby admission to organisers and co-organisers.
• Decide the Copilot policy value per group, using "only during the meeting" for sensitive populations.
• Turn on Google Meet explicit consent for notes, recording and transcription where your consent rule requires it, and default notes sharing to internal guests.
• Lock Zoom AI settings at account or group level and enable waiting rooms for external participants.
• Allowlist meeting-related browser extensions on managed browsers.
• Publish a recording consent rule with restricted meeting categories and an organiser script.
• Set and test transcript retention and deletion against your records schedule.
• Track the five metrics above monthly and review exceptions quarterly.

Standards and references

• Microsoft Learn: Manage external bots and their access to meetings hosted in your organization
• Microsoft Learn: Manage Copilot for Teams meetings and events
• Google Meet Help: Take notes for me in Google Meet
• Zoom Support: Enabling or disabling Zoom AI features
• Microsoft Learn: Configure how users consent to applications
• Google Workspace Admin Help: Control which third-party and internal apps access Google Workspace data
• NIST: SP 800-53 Rev. 5
• Carleton College ITS: An uninvited guest, what you should know about Otter.ai's notetaker

Related NHI Mgmt Group resources: Collaboration Tool Security Guide · SaaS and OAuth App Governance Guide · Top 10 Shadow AI Risks · AI Usage Monitoring Guide