Using AI Call Transcription Tools: Privacy, Security And Contract Checklist

AI tools are becoming a common part of everyday business calls.

You might use a meeting assistant on a Zoom or Teams call that turns the conversation into a written transcript and sends you a summary or list of action items afterwards. Similar features are also appearing in sales platforms, customer service software and other business tools.

They can save plenty of time. But they can also mean customer details, employee information and confidential business conversations are being recorded, processed and stored by another company.

Before switching one of these tools across your business, it is worth checking a few things. Can you record the call? Do people need to know? What can the provider do with the information? And what have you actually agreed to in its terms?

If your business uses AI transcription tools, there are a few privacy, security and contract issues worth checking before they become part of your everyday workflow.

Can You Legally Record And Transcribe Business Calls With AI?

Before thinking about the AI summarising the conversation, there is a more basic question: can you record it in the first place?

Recording private conversations is regulated by state and territory laws in Australia, and the rules are not identical across the country.

For example, the NSW Surveillance Devices Act 2007 generally restricts the use of listening devices to record private conversations, although several exceptions can apply, including where all principal parties consent.

That means businesses should be careful about automatically setting an AI assistant to join and record every meeting, particularly where people could be calling from different states or territories.

There is also an important distinction between whether you can record a conversation and what you can do with the personal information captured through that recording.

If your business is covered by the Privacy Act 1988 (Cth), using an AI transcription tool may engage the Australian Privacy Principles (APPs). The OAIC's guidance on commercially available AI products specifically includes productivity tools used for note-taking and transcription and recommends that organisations carry out appropriate due diligence before adopting them.

Other obligations may also apply depending on your industry and the type of information involved, so businesses operating in regulated sectors should check whether additional requirements apply before recording or transcribing calls.

What Information Does The Tool Capture?

An AI transcription tool can handle much more than a few lines of meeting notes.

Depending on the platform, it might keep the original audio or video, create a written transcript and generate summaries or action items. Along the way, it may also capture customer details, employee information, complaints, commercially sensitive discussions or other personal information mentioned during the call.

That matters because privacy obligations can apply to personal information put into an AI system as well as personal information generated by it. A seemingly routine call can also unexpectedly move into more sensitive territory, so it is worth thinking about what your team actually discusses before making transcription automatic across every meeting. The OAIC's AI privacy guidance also recommends particular care where AI systems handle personal and sensitive information.

For businesses regularly handling customer information, it may also be worth reviewing whether your broader data and privacy processes still reflect the tools your team actually uses.

Do You Need To Tell People The Call Is Being Transcribed?

A meeting assistant quietly appearing in the participant list is not necessarily the clearest way to tell someone their conversation is being recorded or processed by AI.

Depending on the circumstances, a business might give notice in the meeting invitation, use an automated notification when recording starts or explain it briefly at the beginning of the call.

It is also worth separating recording consent from privacy notification obligations. Telling someone a call is being recorded may be relevant to the recording laws that apply, but businesses covered by the Privacy Act may also have separate obligations around how they explain the collection and handling of personal information.

For example, APP 5 deals with notifying people about the collection of their personal information, including matters such as why it is being collected and how it may be disclosed. The OAIC also recommends businesses clearly explain relevant AI uses in their privacy notices and privacy policies.

If your business's use of AI has changed the way it collects or handles customer information, it may be worth checking whether your Privacy Policy still accurately describes what is happening.

So, a simple “this meeting is being recorded” message may only be one part of the picture.

What Should You Check Before Choosing An AI Transcription Tool?

The tool itself might be easy to set up. The more important question is what happens to the information once you start using it.

Before rolling a platform out across your business, check the provider's terms, privacy information and available settings.

Can The Provider Use Your Calls To Train AI?

Start by finding out whether recordings, transcripts or other customer content can be used to train or improve the provider's AI.

Some providers may restrict this use for business customers, while others may have different settings, plans or opt-out arrangements. It is worth reading the terms for wording around model training, product improvement, analytics, research and the use of aggregated or de-identified data.

The OAIC recommends checking whether the provider can access information entered into or generated by the system and whether that information can be used for further AI training or development.

The practical question is fairly simple:

Is the provider using your information only to give you the service, or can it also use that information for its own purposes?

Who Can Access Your Information And Where Does It Go?

The company providing the meeting assistant may not be the only organisation handling your information.

The platform might rely on cloud hosting providers, AI model providers, contractors or other subprocessors. Some of those organisations may also be based overseas.

For businesses covered by the Privacy Act, APP 8 may become relevant where personal information is disclosed to an overseas recipient. The OAIC's guidance on cross-border disclosure explains that APP entities generally need to take reasonable steps to ensure an overseas recipient does not breach the APPs, subject to exceptions. Whether an arrangement amounts to an overseas disclosure can depend on how it works and the level of control the Australian business retains over the information.

You do not necessarily need to understand every detail of the provider's technical infrastructure. But you should be able to work out who else may handle your information, whether it is processed overseas and what control you have over it.

Where a third-party provider is processing significant amounts of information for your business, a Data Processing Agreement may also be relevant to how those responsibilities are documented.

How Does The Provider Protect And Keep Your Information?

Once a call has been transcribed, ask what happens next.

Does the platform keep the original recording as well as the transcript? Can you choose how long the information is retained? Can it be deleted when you no longer need it, and what happens when the account is closed?

Security matters too. If the platform is holding customer conversations or confidential information, look at the protections the provider offers and what it promises to do if there is a security incident.

That might mean looking at access controls, multi-factor authentication, encryption and recognised security standards. You do not need to conduct a technical audit of every tool, but the amount of checking should make sense for the information you plan to put into it.

It is also worth understanding what happens if something goes wrong. For example, how quickly does the provider have to notify your business about a security incident, what information must it provide and will it assist with investigating what happened?

Read The Provider's Terms Before You Sign Up

It is easy to click through the sign-up process and focus on what the software can do. But the provider's actual terms can be just as important as its feature list or privacy page.

Those terms may determine what the provider can do with recordings and transcripts, what confidentiality and security commitments it makes, whether it can involve other providers, what happens to information when the service ends and how responsibility is divided if something goes wrong.

A small business may not be able to negotiate the standard terms of a major software company. That does not make reviewing them pointless.

Instead, the practical question is whether the existing terms and settings are suitable for the type of information your business plans to put into the tool.

If your business is entering into a more substantial arrangement with a technology provider, getting legal help with software and technology agreements can also help clarify issues such as data handling, confidentiality, liability and each party's responsibilities.

A tool that is perfectly suitable for routine internal catch-ups may not necessarily be appropriate for conversations involving sensitive customer information or confidential commercial discussions.

When Might You Avoid Using AI Transcription?

Not every call needs a transcript simply because the feature is available.

You may want to be more cautious with HR or disciplinary discussions, conversations involving health or other sensitive information, confidential customer matters, legal advice or commercially sensitive negotiations.

The OAIC recommends considering whether using personal information in an AI system is actually necessary for the proposed purpose before putting it into the system.

It can also help to set some simple internal rules around which tools staff are allowed to use, when transcription should be switched off and who can access the resulting records.

An AI Acceptable Use Policy can help set rules around internal AI use, data handling, approvals and restricted uses so employees do not have to make those decisions from scratch every time they start a meeting.

For more detail on this, Sprintlaw's guide to employee AI use policies looks at how businesses can set practical boundaries around workplace AI tools.

AI-generated transcripts and summaries can also make mistakes, so important records should still be checked by a person rather than automatically treated as a perfect account of what was said.

Key Takeaways

AI transcription tools can make meetings easier to manage, but there is a little more happening behind the scenes than simply generating notes.

Your business may be recording conversations, collecting personal information and sending customer or confidential information to another provider.

Before making AI transcription part of your everyday workflow, check the recording rules that apply, understand what happens to the information and make sure the provider's terms and security arrangements are suitable for the way your business plans to use the tool.

If you need help reviewing a provider's terms or making sure your Privacy Policy or AI Acceptable Use Policy reflects the way your business uses AI tools, you can reach us at 1800 730 617 or team@sprintlaw.com.au for a free, no-obligations chat.