Using AI Call Transcription Tools: Privacy, Security And Contract Checklist

AI tools are becoming a common part of everyday business calls.

You might use a meeting assistant on a Zoom or Teams call that turns the conversation into a written transcript and sends you a summary or list of action items afterwards. Similar features are also appearing in sales platforms, customer service software and other business tools.

They can save plenty of time. But they can also mean customer details, employee information and confidential business conversations are being recorded, processed and stored by another company.

Before switching one of these tools across your business, it is worth checking a few things. Do people know the call is being recorded or transcribed? What personal information is being collected? What can the provider do with it? And what have you actually agreed to in its terms?

If your business uses AI transcription tools, there are a few privacy, security and contract issues worth checking before they become part of your everyday workflow.

Can You Record And Transcribe Business Calls With AI?

Before thinking about what the AI does with a conversation, it is worth looking at the recording itself.

Under New Zealand’s Privacy Act 2020, businesses should generally be upfront when recording meetings with clients or employees. The Privacy Commissioner says that recording someone without telling them may be unfair, particularly in an employment context, unless there is a strong reason for doing so.

That means an AI meeting assistant should not simply be switched on in the background without considering whether the people on the call understand what is happening.

There can also be laws outside the Privacy Act to consider. New Zealand’s Crimes Act 1961 contains rules around intercepting private communications, so whether a particular recording is lawful can depend on the circumstances.

The practical point is that businesses need to think about both whether the recording itself is lawful and fair and what happens to the personal information captured afterwards.

What Information Does The Tool Capture?

An AI transcription tool can handle much more than a few lines of meeting notes.

Depending on the platform, it might keep the original audio or video, create a written transcript and generate summaries or action items. Along the way, it may also capture customer details, employee information, complaints, commercially sensitive discussions or other personal information mentioned during the call.

A routine conversation can also move unexpectedly into more sensitive territory. A customer might mention a health issue, for example, or an employee discussion might include personal information that you would not ordinarily expect to be stored in a meeting platform.

The Office of the Privacy Commissioner says the Information Privacy Principles apply across the use of AI tools, including the information entered into them and the outputs they generate.

It also recommends carrying out a Privacy Impact Assessment before using AI systems that involve personal information, and reviewing that assessment as the way the tool is used changes.

That makes a PIA particularly useful before transcription becomes the default across your business.

If your business keeps a recording or transcript containing personal information about someone, that person may also have a right to request access to it under the Privacy Act.

For businesses introducing AI more broadly, a Privacy Impact Assessment for AI can help map what information is being collected, where it goes and what privacy risks need to be addressed.

Do People Know The Call Is Being Transcribed?

A meeting assistant quietly appearing in the participant list is not necessarily enough to make clear what is happening to someone’s information.

Depending on the situation, you might tell participants in the meeting invitation, use an automated recording notice or explain the transcription briefly at the beginning of the call.

Under the Privacy Act, businesses also need to think about what people are told when personal information is collected.

IPP 3 deals with information collected directly from an individual. Since 1 May 2026, the new IPP 3A can also require organisations to notify people where personal information is collected indirectly, unless an exception applies.

That could become relevant where a transcript captures information about somebody who is being discussed on the call but is not actually participating in it.

The practical point is that transparency should go beyond a generic “this call is being recorded” message. Your Privacy Policy and other privacy notices should also reflect how personal information is actually being collected, used and disclosed.

What Should You Check Before Choosing An AI Transcription Tool?

The software itself might only take a few minutes to switch on. The more important question is what happens to the information afterwards.

Before rolling a tool out across your business, look at the provider’s terms, privacy documentation and available settings.

Can The Provider Use Your Calls To Train AI?

One of the first things to check is whether recordings, transcripts or other content can be reused to train or improve the provider’s AI.

Some providers may restrict this for business customers, while others may have different terms, settings or opt-outs depending on the account.

Look for wording around model training, product improvement, analytics, research and the use of aggregated or de-identified information.

The New Zealand Privacy Commissioner specifically recommends understanding how third-party AI providers use personal information and whether they are doing more with it than your business originally intended.

The practical question is simple:

Is the provider using the information only to provide the service to your business, or can it use that information for its own purposes too?

Who Else Can Access The Information And Where Does It Go?

The company providing the meeting assistant may not be the only organisation handling your information.

It might rely on cloud hosting companies, AI model providers or other third-party service providers to deliver the service.

The Privacy Act’s IPP 12 deals with certain disclosures of personal information outside New Zealand. However, where an overseas provider is only storing or processing information on your behalf, the rules may work differently from a disclosure to an independent overseas recipient.

The Privacy Commissioner explains that an offshore provider acting only as your agent may still be treated as holding information on your behalf. If that provider is allowed to use the information for its own purposes, however, the position may be different.

So it is worth understanding who can access your calls, where the information is processed and what the provider is actually allowed to do with it.

For more complex arrangements, a Data Processing Agreement or other contractual protections may help document how information can be handled.

How Does The Provider Protect And Keep Your Information?

Once a meeting has been transcribed, ask what happens to the information afterwards.

Does the provider keep the original audio as well as the transcript? Can your business choose how long the information is retained? Can you delete it once it is no longer needed? What happens when you close the account?

Leaving recordings sitting in a platform indefinitely simply because the software allows it may create unnecessary risk.

Security matters too, particularly where customer conversations, confidential commercial information or employee data are going through the tool.

You do not necessarily need to carry out a technical audit of every platform, but the level of checking should make sense for the information involved. That may include looking at account security, access controls, encryption and how the provider manages its own suppliers.

It is also worth knowing how the provider responds if something goes wrong. If a security incident affects transcripts or recordings, your business may need information quickly to understand what happened and what steps need to be taken.

Read The Provider’s Terms Before You Sign Up

It is easy to focus on the features of an AI meeting tool and give much less attention to the contract behind it.

But the provider’s terms may determine what it can do with your recordings, whether it can involve other providers, what confidentiality and security commitments it makes, how long information is kept and what happens when the service ends.

A small business may not have much room to negotiate a large technology provider’s standard terms. Reviewing them is still useful because it helps you decide whether those terms suit the type of information your business plans to put into the platform.

This is particularly important where the provider wants to use customer information for its own purposes.

If your business uses a range of external platforms to handle personal information, Sprintlaw’s Data & Privacy services can also help review how those arrangements fit into your broader privacy obligations.

When Might You Avoid Using AI Transcription?

Not every call needs a transcript simply because the feature is available.

An ordinary project catch-up is quite different from a disciplinary meeting, a conversation about someone’s health, a confidential customer matter or commercially sensitive negotiations.

The Privacy Commissioner recommends considering whether collecting the personal information is genuinely necessary and whether the privacy risks created by the AI tool are justified.

Sometimes the most sensible choice may simply be to leave transcription switched off and take ordinary notes instead.

It can also help to set clear internal rules about which AI tools staff can use, when transcription should not be used and what information should never be entered into an AI system.

Sprintlaw’s guide to Employee AI Use Policies for New Zealand Businesses looks at those broader workplace rules, while an Employee AI Use Policy can formalise the approach for your team.

Finally, an AI-generated transcript or summary is not necessarily a perfect record. Words can be misheard, comments can be attributed to the wrong person and important context can be lost. Where the record matters, it should still be checked by a person.

Key Takeaways

AI transcription tools can make business calls much easier to manage, but they can also mean personal information and confidential business conversations are being handled by another provider.

Before making transcription part of your everyday workflow, think about whether people know they are being recorded, what information the tool may capture and whether you actually need to record that type of conversation in the first place.

It is also worth checking how the provider uses the information, whether other or overseas providers are involved, how long recordings and transcripts are kept and whether the contract gives your business enough control over the data.

If you need help reviewing a provider’s terms, carrying out a Privacy Impact Assessment for AI or making sure your Privacy Policy and internal AI rules reflect how your business actually uses these tools, you can reach us at 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.