Illustrative scenario. On a Tuesday, a transcription bot joins a video call with a client. Forty minutes later, a flawless summary lands in fourteen inboxes. Nobody does anything with it. Three months on, that same client asks where the recording of that call is stored and who could have listened to it, and nobody can answer with certainty.
The thesis in one line: automate the minutes only if you automate the follow-up. Transcribing is the easy, cheap part; what's hard is having a legal basis to record, knowing where the data lives, and making sure someone turns every sentence into a task with an owner and a date.
What does GDPR require of AI meeting minutes?
That you treat them as what they are: personal data. A person's voice, their name in a transcript and what they said in a meeting are personal data, and in the European Union they fall under the General Data Protection Regulation. Three concrete decisions before you switch anything on:
| Decision | The question | Reasonable minimum |
|---|---|---|
| Legal basis | What do you record and transcribe on (Art. 6)? | It isn't always “consent.” Among employees it tends to be a fragile basis, because someone who depends on their employer can't always say no freely. Settle the basis with your DPO or advisor, and settle it before recording, not after. |
| Information | Do attendees know it's being recorded, and why (Arts. 13 and 14)? | Notice in the invite and repeated out loud at the start, especially with clients and outside guests. With a real alternative for anyone who doesn't want to be recorded. |
| Minimization and retention | Are you keeping more than you need, or for longer than you need (Art. 5)? | Define what is kept (audio, transcript, summary, tasks) and for how long. The usual pattern: audio is deleted early; decisions and tasks stay. |
This isn't legal advice, and the framework changes by country: what's described here is GDPR. In other jurisdictions the rules for recording conversations differ (in several US states, for example, everyone on the call must consent). If you operate in several countries, the recording policy is set per country, not copied.
Where do the recording and the transcript live?
In more places than you think, and almost never the one you're looking at. An AI-assisted meeting produces four different things, and each deserves its own retention period and its own access list:
- The audio or video. The most sensitive item, and the one that adds least once the transcript exists. It should be the first to expire.
- The verbatim transcript. It holds everything that was said, including what nobody wanted in writing. Access limited to attendees.
- The summary. This is what actually circulates. Review it before it goes to anyone who wasn't there.
- The tasks and decisions. The only artifact that should live a long time, and it lives in your task manager, not in the transcription service.
With the vendor, the questions are the usual ones and worth asking in writing: which region it stores data in, who acts as processor, whether the contract (Art. 28) covers it, how long it retains content and whether it uses it to train models. We go deeper in generative AI and GDPR: what your vendor doesn't tell you. And if the assistant joins calls with its own account, treat it like any other agent: with scoped permissions limited to the meetings it should attend, not your whole calendar.
Who actually reads an AI-generated set of minutes?
Almost nobody, and the cause isn't the AI. Minutes that reach everyone and ask nothing of anyone get read like a company email: they get filed. Writing the minutes was never the bottleneck; the bottleneck was, and still is, someone taking charge of what was agreed.
That's why useful minutes aren't a recap of the conversation. They're three short lists: what was decided, what someone commits to doing (with a name and a date) and what stayed open. And they go to whoever has something on them, not to everyone who attended. A summary with fourteen recipients and zero owners is well-written noise.
How do you automate the follow-up, not just the minutes?
With a short process and a person at the exact point where a mistake is expensive:
- Fix the output format. Decisions, tasks (who, what, by when) and open questions. If a sentence fits none of the three, it doesn't go in the minutes.
- Let the system propose, and have whoever ran the meeting confirm. Two minutes of review keeps a wrongly assigned task from reaching someone who never accepted it. That's the human in the loop applied where it matters.
- Create the task where people already work. In your project manager or CRM, with an owner and a date. A task that lives only in the minutes doesn't exist.
- Close the loop. A nudge to the owner as the date approaches, and at the start of the next meeting, last time's open items on the first screen.
- Measure the follow-up, not the transcription. What share of tasks is born with an owner and a date, and how many close on time. It's one more metric in measuring the performance of your automations.
And like any automation that touches people's data, it needs an owner, a log of who accesses what and a way to delete on request: that's what governance and control of AI automation covers. If you also need to leave a trail of what was decided and on what information, traceability of AI decisions is the next step.
When shouldn't you record a meeting?
Some meetings shouldn't have a bot listening, however convenient it is:
- HR conversations: reviews, disciplinary processes, dismissals. Free consent is hard to sustain here and the risk is high.
- Matters under professional secrecy: consultations with lawyers, doctors or other professionals bound by confidentiality.
- Especially sensitive data: health, union membership, political views or other special-category data.
- Negotiations and board meetings: where what's said aloud isn't what ends up on paper, and a verbatim transcript only adds risk.
- Meetings with no consumer for the output: if nobody will act on the minutes, don't generate them. It's one more file to protect.
In those cases there are alternatives: a person's notes, a summary without recording, or a transcript without audio that is deleted when the call ends. More modest, and more defensible.
The line to take away: the minutes are the cheap part. Invest in the legal basis before you record, in the deletion window afterward, and in the follow-up the whole time.
Sources (accessed October 30, 2026): Regulation (EU) 2016/679 (GDPR), EUR-Lex, Arts. 5, 6, 13, 14 and 28, used qualitatively. The opening scenario is illustrative and this content is not legal advice.