Using AI Call Transcription Tools: Privacy, Security And Contract Checklist

AI tools are becoming a common part of everyday business calls.

You might use a meeting assistant on a Zoom or Teams call that turns the conversation into a written transcript and sends you a summary or list of action items afterwards. Similar features are also appearing in sales platforms, customer service software and other business tools.

They can save plenty of time. But they can also mean customer details, employee information and confidential business conversations are being recorded, processed and stored by another company.

Before switching one of these tools across your business, it is worth checking a few things. Can you record the call? Do people need to consent? What happens to the information afterwards? And can the provider use your recordings or transcripts for anything beyond giving you the service?

For US businesses, those questions can be particularly important because recording and privacy rules can vary depending on the state, the people on the call and the type of information involved.

Can You Legally Record And Transcribe Business Calls With AI?

Before thinking about what the AI does with the conversation, there is a more basic question: can you record it?

At the federal level, the Wiretap Act generally permits interception where a person is a party to the communication or one party has given prior consent, subject to exceptions.

State laws can impose stricter requirements, though.

For example, Washington law generally requires the consent of all participants before recording a private telephone communication or conversation, subject to exceptions. It also recognises consent obtained through an announcement that the conversation is about to be recorded.

This matters because business calls often cross state lines. A company based in one state may be speaking with a customer, employee or supplier in another state with different recording rules.

For businesses using one process across multiple states, a clear and consistent notice and consent approach can help reduce the risk of applying the wrong recording rule.

There is also an important distinction between whether you can record the call and what you can do with the information captured through that recording. Recording law and privacy law are related, but they are not the same thing.

What Personal And Sensitive Information Could End Up In The Transcript?

An AI transcription tool can handle much more than a few lines of notes.

Depending on the platform, it may keep the original audio or video, create a written transcript and generate summaries, action items or other analysis.

Along the way, it may also capture names, contact details, customer complaints, employee information, financial details, health information or confidential business discussions.

That matters because there is no single federal consumer privacy law that applies to every US business in the same way. Instead, businesses may need to consider a combination of state privacy laws, sector-specific rules and other federal or state requirements depending on the information involved.

For example, California's CCPA applies only to businesses that meet the relevant statutory requirements, but where it does apply, it includes rules around how service providers and contractors can retain, use and disclose personal information.

Other state laws have their own coverage rules and exclusions, so it is important not to assume that every privacy law applies to every customer, employee or business-to-business call.

Businesses in regulated sectors may also have additional obligations. Health, financial or education-related calls, for example, may raise separate federal or state requirements depending on the information involved and the business using the tool.

The practical point is to understand what information is likely to end up in the recording or transcript before making transcription automatic across every call.

Do People Know The Call Is Being Recorded?

Even where a particular law might permit recording with the consent of only one party, that does not necessarily mean quietly recording every business call is the best approach.

A business might give notice in the meeting invitation, display an automated message when recording begins or explain it at the start of the call.

That can be particularly useful where people may be joining from different states and your business wants a consistent process.

Privacy notices can also matter separately from recording consent.

If a state privacy law applies to your business, it may impose requirements around how personal information is collected, used, disclosed or retained. Your Data & Privacy documents should therefore reflect the way AI transcription tools are actually being used.

The key distinction is that permission to record a conversation does not automatically resolve the separate privacy issues created by collecting and using the information in that recording.

What Should You Check Before Choosing An AI Transcription Tool?

Turning the feature on may be easy. Understanding what the provider can do with your calls takes a little more work.

Before rolling a platform out across your business, look at the provider's terms, privacy documentation and available settings.

Can The Provider Use Your Calls To Train AI?

Start by checking whether recordings, transcripts or other customer content can be reused for model training, product development, analytics or research.

Some providers may restrict these uses for business customers, while others may offer different settings or opt-outs depending on the account.

The FTC has specifically warned AI companies that they need to honour their privacy and confidentiality commitments, including promises about whether customer information will be used to train or update models.

So the practical question is straightforward:

Is the provider using your recordings only to provide the transcription service, or can it reuse that information for its own purposes?

Who Else Can Access The Information?

The transcription company may not be the only organisation handling your data.

It may rely on cloud hosting providers, model providers, contractors or other subprocessors to deliver the service.

Where an applicable state privacy law treats the provider as a processor, service provider or contractor, the agreement may also need to contain specific restrictions on how the information can be used.

For example, the Colorado Privacy Act distinguishes between controllers and processors and requires their responsibilities to be set out in a binding contract. However, its consumer privacy provisions generally focus on individuals acting in a personal or household context rather than employment or ordinary B2B data.

California similarly imposes contractual restrictions on service providers and contractors where the CCPA applies.

You do not need to become an expert in every state privacy law before buying software. But you should understand which other companies may handle the call data, what role they play and whether they can use the information independently.

How Long Does The Provider Keep The Information?

Once a call has been transcribed, ask what happens next.

Does the provider keep the original audio as well as the transcript? Can you set a retention period? Can the recording actually be deleted? What happens when you close the account?

There may be valid reasons to keep some customer or employee records. But that does not necessarily mean every recorded call needs to remain in a transcription platform indefinitely.

The longer sensitive recordings are retained, the more information could potentially be exposed if something goes wrong.

How Secure Is The Tool?

If customer conversations or confidential business information are going through the platform, security should form part of the decision.

The level of checking should match the sensitivity of the information involved. For some businesses, that may mean looking at account access controls, encryption, multi-factor authentication and any independent security assessments the provider makes available.

It is also worth understanding what happens after a security incident. How quickly will the provider tell you? What information will it provide? Will it help your business investigate and respond?

A tool used for routine team catch-ups presents a different risk from one regularly handling customer financial information or sensitive employee discussions.

Read The Provider's Terms Before You Sign Up

The provider's terms still matter, but this does not need to become a full AI vendor-contract review.

The agreement may determine whether the provider can reuse recordings, which other companies it can involve, what confidentiality and security commitments it makes, what happens when you delete your account and how responsibility is divided if something goes wrong.

Where applicable state privacy laws treat the vendor as a processor, service provider or contractor, the agreement may also need to include specific privacy protections.

A small business may not be able to negotiate a large software company's standard terms. The practical question is whether those terms are appropriate for the type of information your business plans to put into the platform.

For a broader review of those issues, Sprintlaw's guide to buying AI tools and reviewing vendor contracts looks at AI supplier agreements in more detail.

When Might You Avoid Using AI Transcription?

Not every call needs a complete recording and transcript.

A routine sales catch-up is very different from a disciplinary meeting, a discussion about someone's health, a confidential customer issue or a conversation involving commercially sensitive information.

The more sensitive the meeting, the more useful it is to ask whether transcription is actually necessary.

Sometimes ordinary notes will do the job without creating another complete copy of everything that was said.

It can also help to set internal rules around which tools employees may use, when recording should be switched off and what information should never be put into an AI system.

An AI Acceptable Use Policy can help set those boundaries for your business.

Finally, AI-generated transcripts and summaries are not always accurate. A tool can mishear a word, attribute a comment to the wrong person or remove important context. Where the record matters, it should still be checked by a person.

Key Takeaways

AI transcription tools can make business calls easier to manage, but using one can involve much more than simply generating meeting notes.

For US businesses, one of the first things to check is whether the call can be recorded under the laws that may apply to everyone involved. State rules can differ, particularly around consent.

It is also worth understanding what information the tool captures, whether the provider can reuse it for AI training, which other companies may have access to it and what the provider promises around retention, security and deletion.

For more sensitive conversations, the better option may simply be to leave transcription switched off.

If you need help reviewing an AI provider's terms or understanding how your data and privacy documents should address the tools your business uses, you can reach us at (888) 449-8437 or team@sprintlaw.com for a free, no-obligations chat.