AI meeting notetakers

AI notetakers such as Otter, Fireflies, and Read join meetings, record them, transcribe them, and summarize them. To do their job they hold a standing OAuth connection to the host's calendar, and per the vendors' own documentation, often contacts as well. Once connected, the bot joins meetings automatically, including ones the employee forgot it would.

The output is a permanent record: audio, transcript, summary, action items, stored in the vendor's cloud, searchable, and shareable. Useful is the whole point. The governance questions arrive with the usefulness: whose meetings, stored where, under what terms, recorded with whose consent.

Notetakers spread person by person, because the value is personal: one signup with "continue with Google," and meetings take their own notes. No procurement step, no review, and in most companies no policy that mentions them.

The grant then outlives everything around it. The employee changes roles or leaves; the calendar connection keeps working. Meanwhile the bot's reach is defined by the calendar, so one person's tool quietly processes conversations with clients, candidates, and leadership who never made any choice at all.

The legal exposure is real and current. Otter.ai faces a 2025 US federal class action (Brewer v. Otter.ai) alleging its notetaker recorded meeting participants without their consent. In the EU the same pattern raises GDPR questions: recording and processing identifiable people's speech needs a lawful basis, and a tool one employee installed rarely has one. Client calls add confidentiality obligations on top.

There is also a plain data question. Transcripts concentrate the most sensitive things a company says aloud: deals, disputes, salaries, strategy. They sit in a vendor your team never vetted, on a tier whose training and retention terms nobody read.

And in your OAuth inventory, notetakers cluster in the broad-scope group: standing access to calendars and contacts, granted personally, reviewed by no one.