Your client’s security policy bans notetaker bots. Here’s what to do.

If your client’s IT policy blocks notetaker bots, removing the bot is not enough.

Check what the policy actually restricts: a third-party participant, an unapproved processor, a recording outside the client’s systems, or all three. Keeping processing on your own machine can avoid a cloud transcription provider. It does not automatically authorize a local copy of the client’s conversation.

The part you still have to handle is consent. Going bot-free removes a visible cue that recording might be happening, so you have to make the disclosure yourself.

01 / Read the boundary

It is not personal. It may be policy.

A host admitting a notetaker into the lobby is no longer the whole decision. Microsoft documents external-bot controls in Teams meeting policies, including detected-bot approval and policies scoped to users or groups. The relevant setting is ExternalBotAccessMode in the Meeting Join and Lobby section. See Microsoft’s administrator documentation.

In June 2026, UC Today reported a planned August rollout of automatic blocking for detected external bots. Availability can vary. Ask the client’s admin which controls are available and in force in their tenant.

External-bot restrictions also do not mean the client has banned its own approved Microsoft 365 tools. First-party services and tenant-registered applications have different permissions and governance. That distinction helps explain the concern: who receives the conversation, and under whose rules?

The clauses to look for are about approved vendors, signed data-processing terms, recordings and transcripts leaving approved systems, secondary uses such as model training, and confidentiality or professional obligations. Some clients prohibit recording altogether. Others permit it only on a managed device or inside their tenant.

When someone declines your bot, do not treat a less visible recorder as a way around the decision. Find out which boundary they are protecting.

02 / Own your part

The obligation is yours, too.

Your client’s admin setting can stop a bot from joining. It does not settle your responsibilities for a recording you create.

If you record a call and keep the file on your laptop or in a notetaker’s cloud account, you need authority to create and retain that copy. The client’s vendor review does not automatically approve your tools. Equally, do not assume its contract or data processing agreement says nothing about you: it may govern your handling of client information directly.

Your legal role depends on the work, the contract, and the applicable law. The practical questions are simpler. Whatever tool you pick, be able to answer these in a sentence each:

01Where does the audio go?

02Who else can read it?

If the first answer names a company the client has not approved, the underlying concern may be unchanged. If the answer is “my laptop,” the next question is whether that laptop is an approved place to keep client data.

03 / Choose deliberately

Five options, and what each one actually fixes.

There is no row here that grants permission by itself. Use the client’s written policy and your engagement terms to decide which options are available.

Recording choices for client work
Option	What it addresses	What still needs agreement
01Stop recording and write by hand.	Avoids creating an audio recording or sending it to a transcription provider.	Your notes still contain client information. They need appropriate storage and retention, and you lose an audio record to check later.
02Use the client’s own approved recording.	Keeps recording and processing within a workflow the client controls, such as its approved Teams or Meet setup.	Recording permission, access, exports, and retention. You may lose access when the engagement ends; agree how approved notes will be shared.
03Get your bot approved as a vendor.	Allows the actual service and data flow to be reviewed, with a written approval trail.	Procurement time, security questions, any required DPA, and participant consent. Approval at one client does not carry over to the next.
04Use a bot-free cloud notetaker.	Removes the separate bot participant and its lobby-admission step.	Audio or derived content still reaches a cloud provider. Vendor approval, transfer restrictions, retention, and consent still apply.
05Record and process locally.	Can keep meeting content away from a cloud transcription or summarization service.	Permission to record on that device, consent, access controls, backups, and deletion. A local copy can still be outside the client’s approved boundary.

The fourth row is worth examining carefully. Going bot-free solves the visible admission problem. If the policy restricts unapproved processors or data leaving approved systems, changing the participant list does not resolve it.

The fifth row changes the data flow more substantially. But “local” describes where processing happens. It is not a certificate of compliance.

04 / Make recording visible

The part a bot used to announce.

A participant called “Fireflies Notetaker” was a visible cue. It was never, on its own, proof that everyone consented. Remove the bot and even that cue disappears. A bot-free recorder needs an explicit conversation before it starts capturing audio.

The issue has reached the courts. Chamberlain v. Granola, filed on July 30, 2026 in the Northern District of California, alleges recording without participants’ consent and default use of meeting data for model improvement. Those are allegations, not findings of liability.

In the separate consolidated Otter.AI Privacy Litigation, an August 13, 2026 order allowed some privacy and biometric claims to proceed while dismissing others, some with leave to amend. A ruling at that stage does not establish that the allegations are true.

The stakes are more than a rejected meeting invitation. California’s Penal Code § 637.2 provides a civil remedy for qualifying violations of the privacy chapter: the greater of $5,000 per violation or three times actual damages. Applicability depends on the claim and facts; it is not an automatic fine for using a notetaker.

Voice identification can raise separate questions. Illinois’ Biometric Information Privacy Act includes voiceprints. When it applies, its collection rules can require written notice and a written release. Anonymous speaker grouping and identifying a person from a stored voice profile are different operations; check what your tool actually does. Keeping a voice profile locally does not, by itself, remove the issue.

A useful signal, with limits

A July 2026 Kolmogorov Law / Pollfish survey asked 500 employed U.S. adults about their experiences. Of those, 33.4% reported an AI notetaker in their meetings. Within that subgroup of 167 people, 65.3% described permission as inconsistent or absent. Separately, 18.8% of the full sample reported discovering a recording or transcription after the fact.

This was a commissioned, self-reported online survey. It is a reason to take notice seriously, not a measurement of unlawful recording across all workplaces.

Recording laws differ by jurisdiction, the type of communication, and the circumstances. Interstate and international calls add complications that a simple list of “one-party” and “all-party” states cannot settle. Our operational default is to ask every participant before recording, while also following any written-consent or other requirements that apply.

This article is general information, not legal advice. Get advice from counsel qualified in the relevant jurisdictions for your engagement.

05 / Put it into practice

What to actually do.

Before the engagement starts

Ask who owns the meeting record, whether recording is allowed, and whether you may retain your own copy.
Ask whether the policy restricts bots, third-party processing, unmanaged devices, or any recording outside the client’s systems.
Ask what approval would require, including tool review, storage, access, and retention.
Keep the answer in writing, in the statement of work or an email you can find later.

Before each recording

Say it out loud before you start. If local processing is your approved setup, a simple request is:

Wait for clear agreement before pressing Record. Complete any required written consent separately.
Put the disclosure and agreement in the meeting chat or another approved record. A timestamped message records what was said; it does not turn silence into consent.
If someone objects or the answer is unclear, leave recording off and take notes by hand.
Pause and explain the recording to late joiners before continuing. Pause again if permission is withdrawn.

After the call

Put a line in the recap saying the call was recorded with the agreed disclosure and permission.
Follow the agreed retention schedule for audio, transcripts, exports, and backups, subject to any preservation obligations. Remember that moving a file to Trash is not permanent deletion.
Keep client material out of unapproved sync folders and cloud backups. Check the services already running on your laptop.
Review consequential names, dates, amounts, and commitments before sending the recap.

The checklist is short on purpose. The conversation at the start of the call should be routine, and the answer should change what you do.

06 / Our part in this

Where MeetingStow fits.

We build the fifth option, so read this paragraph with that in mind.

MeetingStow records meeting audio on your Mac and processes it there: transcription, speaker grouping, recaps, decisions, and action items. No bot joins the call. Under normal app operation, we do not receive your meeting content. It is a one-time purchase rather than a subscription, with license-key activation rather than an app account.

It currently supports Google Meet, Microsoft Teams, the Zoom desktop app, Slack Huddles, and microphone-only in-room recording. It requires an Apple Silicon Mac and macOS 15 or newer. Optional Apple Speech transcription and Apple-powered recaps require macOS 26 or newer; Apple-powered recaps also require Apple Intelligence. Local model choices provide the macOS 15 processing path.

There are online services for purchase, downloads, activation, periodic license checks, and updates. “Meeting content stays local” does not mean the app never uses the internet. You can also move content off the Mac through exports, sharing, sync, or backups. Our privacy policy describes that boundary.

MeetingStow has a disclosure prompt and local disclosure records, but those record your own attestation. They do not establish that participants consented or that the client approved your workflow. Optional saved voice profiles also need their own assessment. See the recording responsibilities in our terms.

For a procurement review, explain the actual data flow: MeetingStow does not receive the meeting content for processing. Do not assume that makes a software review or contractual terms unnecessary, or that it removes any DPA obligations you have to the client.

Choose a workflow the client approves. Explain it to the people in the call. Start recording only after the answer is clear.

Reading notes

Sources & scope.

Sources checked October 19, 2026. Technical controls, product behavior, and court proceedings can change. The legal examples focus on the United States; they are not a worldwide consent guide.

Microsoft: managing external bots in Teams — documented policy controls and detection limitations.
UC Today: planned external-bot blocking rollout — June 30 reporting on an August 2026 rollout plan, distinct from the administrator documentation.
Chamberlain v. Granola, complaint — filed July 30, 2026; allegations are not findings.
In re Otter.AI Privacy Litigation, August 13 order — the court’s motion-to-dismiss decision, reproduced by FindLaw.
California Penal Code § 637.2 and Illinois BIPA definitions — civil remedies and voiceprint terminology.
Kolmogorov Law’s July 2026 survey — commissioned survey of 500 employed U.S. adults; the notetaker-consent subgroup was 167 people.