The AI Notetaker on Your Sales Calls Might Be Your Biggest Legal Risk

Straight answer: AI notetakers such as Otter.ai, Fireflies, Fathom and the built-in Zoom or Teams versions are recording, transcribing and often auto-sharing everything said on your client calls, including things that were never meant to leave the room. Most small businesses have never checked the retention settings, the sharing defaults or the consent wording, which means many are breaching UK GDPR or their own client contracts without knowing it. This isn't a reason to ditch the tools, it's a reason to spend twenty minutes fixing them this week.

Everyone talks about the time saved, nobody talks about what's leaking

Every marketing blog and LinkedIn post about AI meeting tools says the same thing: you'll save four hours a week on notes, your follow-ups will be sharper, you'll never miss an action point again. All true. I use one myself on client calls and it has changed how fast I turn discovery calls into proposals.

What almost nobody writes about is the other side of that convenience: the transcript of your call, including whatever the client said off the cuff about their finances, their staff problems, their competitor, their divorce, their supplier they're about to fire, is now sitting on a third-party server, often in the US, often set to auto-share with your whole team by default, and often used to train the vendor's models unless you've specifically switched that off.

This is where I want to say the uncomfortable bit plainly: if you are recording client calls with an AI notetaker and you haven't checked the settings, told the client, or read the clause in your contract about confidentiality, you are probably already in breach of something. Not because you're careless. Because the tools are designed to make recording effortless and the disclosure part optional, and optional things don't happen when you're running a small business alone or with three staff.

What happened to a client of mine, and it wasn't even the worst version

A seven-person marketing agency I worked with in Leeds used Otter.ai on every discovery call. Standard setup, nothing exotic. One of their account managers ran a call with a prospective client who, near the end, mentioned in passing that they were unhappy with their current agency and named them specifically, along with the fee they were paying. Fair enough, prospects say this kind of thing all the time.

The transcript auto-posted to the agency's Slack, which is normal Otter behaviour when it's connected to a workspace. What nobody had noticed was that the integration was set to post to a general channel rather than a private one, and that channel included a freelancer who also did occasional work for the competitor named in the transcript. The freelancer didn't do anything malicious, but the prospect found out their comments had been visible to someone connected to their current supplier, and the deal, worth roughly £42,000 a year in retainer fees, fell apart before it even started. Not because of anything said on the call itself, but because of what happened to the words after the call ended.

That's the pattern I see over and over when I go through a client's tech stack as part of an AI implementation review: the AI tool itself is fine, the default settings around it are the problem, and nobody built time into onboarding to check them.

The consent problem people skip

Under UK GDPR, recording a phone or video call where personal data is discussed generally requires you to tell the other party it's being recorded, what it's being used for, and roughly how long you'll keep it. A pop-up bot joining a Zoom call with a name like "Otter Notetaker" is not the same as informed consent. Plenty of clients notice the bot and say nothing because they assume it's normal now, which is not the same as agreeing to it.

The Information Commissioner's Office has been clear for years that consent needs to be specific and informed, not implied because a bot silently joined the call. You can read the ICO's own guidance on this directly on ico.org.uk, and it's worth ten minutes of your time if you record calls regularly.

In practice this means one sentence at the start of every call: "Just so you know, I use an AI tool to transcribe our calls so I can focus on the conversation rather than typing, is that alright with you?" That's it. Nine times out of ten people say yes immediately. The problem isn't that clients object, it's that almost nobody asks.

The audit that takes twenty minutes and fixes this

Here's the checklist I run through with clients, and you can do this yourself in one sitting:

• Check your retention window. Log into your notetaker's admin settings and find how long recordings and transcripts are stored. Otter's free and lower-tier plans have historically kept audio for a limited window before deleting it, but transcripts often persist far longer unless you delete them manually. Set a calendar reminder to clear anything older than 90 days.
• Check where the data lives. Most of these tools store data on US servers. If you work with EU clients under contracts that specify data residency, this alone can be a breach regardless of anything else you do.
• Check the training clause. Look in the terms of service for language about using your content to "improve" or "train" the product. Most tools, including Fireflies and Otter, let you opt out in a settings menu, but it's rarely on by default.
• Check who sees the transcript automatically. If it posts to Slack, Notion, or a shared drive, check the specific channel or folder permissions, not just "who's on the team." A freelancer, a part-time bookkeeper, or a former employee who still has access can see it too.
• Pick one tool company-wide. If three people on your team use three different notetakers, you have three different sets of settings, three different retention policies, and three times the risk. Standardise on one and configure it once,.
• Add a line to your contracts and privacy policy. One paragraph stating that calls may be recorded and transcribed using AI tools, how long data is kept, and how a client can ask for a transcript to be deleted. This is not optional if you're serious about client trust.

Why this matters more for small businesses than big ones

Large companies have legal teams who negotiate custom terms with these vendors, enterprise contracts with data processing agreements, and IT departments that lock down integrations before anyone touches them. A five-person consultancy or a solo coach doesn't have any of that. You signed up for the free plan, connected it to your calendar, and never thought about it again.

That gap is exactly where the risk concentrates. Under UK GDPR, a small business can be fined up to £17.5 million or 4% of global turnover for serious breaches, though in reality most enforcement against small firms starts with a complaint from an unhappy client or a former employee, not a raid. The financial risk is real but the reputational risk is faster and more common: one client who feels their private conversation was mishandled will tell other people in your industry, and industries talk.

The brands that win long term treat trust as something they build into every process, not a box they tick after a problem happens. I wrote about this when I broke down how Wix built a brand people trust and how Red Bull manages risk inside every campaign rather than reacting to it afterwards. Data handling is the unglamorous version of the same principle. Nobody posts about their consent script on LinkedIn, but it's doing more for client retention than most content calendars.

When AI notetakers are the right call

I'm not telling anyone to stop using these tools. On a busy week I run four or five client calls back to back and there is no way I'd retain the detail without a transcript doing the heavy lifting. The productivity gain is real and I'd rather have the twenty extra minutes per call to think about strategy than to type notes.

Where it's fine, no caveats needed: internal team meetings where everyone in the room already knows and agrees to the recording, brainstorms, training sessions, and calls where nothing commercially sensitive about a third party is likely to come up. Where you need to slow down and check: sales calls, client onboarding calls, anything involving a prospect's current supplier, pricing, staff issues, or legal matters, and any call with someone outside your own organisation who hasn't explicitly agreed to being recorded.

A useful middle ground some of my clients use: transcribe everything, but set a rule that nothing gets shared outside the two people on the call until someone has skimmed it and redacted anything that shouldn't circulate. Takes two minutes, catches almost everything.

The bit that connects to your wider AI setup

This isn't really a notetaker problem, it's a "we adopted AI tools faster than we adopted the habits around them" problem, and it shows up everywhere once you start looking. The same business that never checked its Otter settings often hasn't checked what its chatbot is storing from customer conversations, what its AI-generated content assistant is doing with client briefs it's been fed, or whether its curated content sources are being pulled into a tool without permission from the original creators.

Being careful about this stuff isn't just risk management, it's also becoming a visibility advantage. As more buyers ask AI tools to research companies before they call them, the businesses that can point to a clear, specific privacy and data-handling page tend to come across as more credible when they're checked, in the same way I've written about how AI search engines decide who to cite in my 15-minute AEO audit. A vague "we take your privacy seriously" line does nothing. A specific paragraph about which tools you use and how long you keep data reads as trustworthy, to humans and to AI systems summarising you.

If your business is at the point where AI tools are woven through sales, marketing, and operations and nobody has looked at the whole picture at once, that's a half-day's work with someone who knows what to check, not a project you need to fear. I do this exact audit with small business clients, mapping every AI tool touching customer data and fixing the settings that matter, through hands-on AI implementation coaching rather than a generic policy document nobody reads.

What to do this week, in order

If you take one thing from this post, do it in this order:

• Open your notetaker's settings today and check retention, sharing, and the training opt-out. Twenty minutes, done.
• Write one sentence of verbal consent and use it on your next external call. Test it once, notice nobody bats an eyelid.
• Add a short paragraph to your privacy policy or client contract template about AI transcription. Copy the structure from any competitor's public privacy page if you're stuck on wording, it doesn't need to be original, it needs to be true.
• Pick one notetaker for the whole team and delete the others from anyone's account by the end of the month.

None of this stops you using AI to save time on calls. It just means the time you save doesn't come at the cost of a client relationship, or a fine, or a very awkward conversation six months from now.

This guide is part of my AI for Small Business: 25 Plain-English Guides to Automation, Marketing, Sales and Admin.

Related: legal: guidelines and how to pitch.

Frequently asked questions

Do I legally have to tell clients an AI notetaker is recording the call?

Under UK GDPR you need informed consent to record and process personal data on a call, and a silent bot joining a meeting doesn't meet that bar on its own. A short verbal heads-up at the start of the call, plus a line in your privacy policy, covers you and takes almost no time.

Which AI notetaker is the safest for client data?

None of the major ones (Otter, Fireflies, Fathom, Zoom AI Companion) are inherently unsafe, but their default settings usually favour convenience over privacy. The safest choice is whichever one you configure correctly: retention limits set, sharing locked to the right people, and training on your data switched off in the settings.

Can an AI notetaker transcript be used against my business legally?

Yes. Transcripts have been used as evidence in disputes about what was agreed on a call, and if the transcript was obtained without proper consent, that itself can become part of the complaint. Keep transcripts organised and delete anything past your stated retention window rather than letting years of raw call data pile up unmanaged.

Is it worth stopping AI notetakers altogether to avoid the risk?

No, the productivity gain is too useful to give up over a fixable settings problem. The fix is a twenty-minute audit of retention, sharing permissions, and consent wording, not abandoning tools that save small business owners hours every week.