AI meeting transcription: consent, works councils and the GDPR

AI meeting transcription saves a lot of note-taking: the conversation is turned into text, an AI summarises it and suggests tasks. Legally, though, it is more than a convenience feature. The words of every participant – colleagues, customers, guests – are recorded and analysed. This article explains the rules that apply, with a focus on Germany, and how to introduce transcription in a structured way.

What happens technically during AI transcription

The term usually covers three processing steps that you should assess separately:

1. Audio recording: the speakers’ audio tracks are recorded – at least briefly, until recognition is complete.
2. Speech recognition: a speech model converts the recording into text, usually with timestamps and speaker names.
3. Analysis: optionally, an AI model produces a summary, decisions and suggested tasks from the text.

Each step is processing of personal data under the GDPR. For each one you should know who processes the data, where it happens and how long the data is kept.

Legal basis: consent, contract or legitimate interest

Article 6(1) GDPR lists the possible legal bases exhaustively. Three are particularly relevant for meeting transcripts:

• Consent (Art. 6(1)(a)): it must be freely given, informed and unambiguous, and it can be withdrawn at any time – withdrawing must be as easy as giving consent (Art. 7(3)).
• Performance of a contract (point b): conceivable when the minutes are part of an agreed service, for example a workshop you document for a client.
• Legitimate interest (point f): requires a documented balancing test against the interests of the people concerned, who have a right to object (Art. 21).

In its guidance on video conferencing systems, the German Data Protection Conference (DSK) states that the legal basis for recordings must be assessed separately; without a specific documentation requirement, consent is regularly needed. A recording function must be switched off by default, only privileged users such as moderators should be able to activate it, and participants must be clearly notified.

Employees are a special case. Because of the dependency inherent in employment, whether consent is freely given needs careful assessment (Section 26(2) of the German Federal Data Protection Act, BDSG). The general clause in Section 26(1) BDSG has been in question since the CJEU judgment of 30 March 2023 (C-34/21): national employee data rules that merely repeat the GDPR are not “more specific rules” under Article 88 GDPR and must be disapplied. The case concerned an almost identically worded rule from the state of Hesse; many commentators conclude that employers must rely directly on Article 6 GDPR (CMS).

Criminal law also applies in Germany: anyone who, without authorisation, records another person’s privately spoken words faces up to three years’ imprisonment or a fine under Section 201 of the German Criminal Code (StGB). Secret recordings are therefore out of the question; announcing the recording openly and obtaining participants’ agreement is the safe route.

Works councils: co-determination for AI transcription

Under Section 87(1) no. 6 of the Works Constitution Act (BetrVG), a German works council has a say in introducing and using technical equipment designed to monitor employees’ behaviour or performance. The Federal Labour Court interprets this broadly: it is enough that the equipment is objectively suitable for monitoring – the employer’s intention does not matter (BAG, decision of 13 December 2016, 1 ABR 7/15).

A transcript records who said what and when. It is therefore reasonable to expect a transcription feature to be subject to co-determination. If employer and works council cannot agree, a conciliation board decides (Section 87(2) BetrVG).

A works agreement can also serve as the legal basis under data protection law (Section 26(4) BDSG, Article 88 GDPR). It must then include suitable and specific safeguards as required by Article 88(2) GDPR. Useful points to cover include:

• which meetings may be transcribed and who may start transcription,
• that transcripts are not used to monitor performance or behaviour,
• who has access, how long transcripts are kept and when they are deleted,
• whether, and which kind of, AI analysis is permitted.

Retention, access and deletion

Article 5(1) GDPR requires data minimisation (point c) and storage limitation (point e). In practice this means:

• Keep audio as briefly as possible: raw recordings are no longer needed once recognition is done. The DSK regards storage beyond the conference itself as generally unnecessary.
• A fixed retention period for transcripts: decide how long transcripts are kept and have them deleted automatically.
• Remember copies: if a transcript is saved as a file or forwarded by email, the retention period does not automatically apply to that copy.
• Limit access: not everyone in the company needs every transcript.

You must inform participants about all of this in advance (Art. 13 GDPR). Where the risk is high – for instance when many meetings are transcribed systematically – check whether a data protection impact assessment under Article 35 GDPR is required.

Where processing takes place

It makes a difference whether speech recognition runs on your own servers, with a European provider or through a cloud API outside the EU. You need a data processing agreement (Art. 28 GDPR) with every provider that processes data on your behalf; transfers to third countries are additionally governed by Articles 44 et seq. GDPR. How local speech recognition works is explained in “Local speech recognition instead of a US cloud: how Whisper and co. work” (coming on January 13, 2027).

Pay particular attention to the AI analysis: summaries and task suggestions are often produced by a different service than the speech recognition. Clarify separately for both steps where the data goes.

Checklist for introducing transcription

1. Define the purpose: what do you need transcripts for, and what explicitly not?
2. Determine the legal basis for each group: employees, customers, guests.
3. Involve the works council early and conclude a works agreement.
4. Switch the feature off by default; only moderators may start it.
5. Make sure every person is notified and agrees before recording starts.
6. Document processing locations and providers, sign data processing agreements (“DPA checklist: reviewing data processing agreements for cloud tools” (coming on December 2, 2026)).
7. Define and technically enforce retention periods for audio and transcripts.
8. Provide information under Article 13 GDPR and update your record of processing activities.
9. Check whether a data protection impact assessment is necessary.

How nest54 handles transcription

In nest54, transcription of video meetings is a feature that organisations deliberately enable. Workspaces can additionally exclude it. The key points:

• Started by moderators: moderators and co-moderators start, pause and end transcription. If no moderator is left in the room, it pauses automatically.
• Notice and agreement per person: every participant, guests included, sees a notice and must confirm it. Only then is their audio track recorded; other tracks are not received at all. Declining within the running meeting is not an option – anyone who does not want to be transcribed leaves the call. Whether this confirmation counts as freely given consent in your situation is for you, as the controller, to assess.
• Other organisations’ rules: if an external participant’s organisation does not allow its accounts to be transcribed, that person’s audio is not recorded.
• Local recognition: speech recognition runs with faster-whisper on nest54’s own servers in Germany. The audio is deleted immediately after recognition.
• Access and deletion: only internal participants receive the transcript, and it can only be shared within the organisation. The organisation sets the retention period (90 days by default); afterwards it is deleted automatically – unless a legal hold applies.
• AI analysis only on request: each organisation decides whether to enable summaries and task suggestions, and they only run when explicitly requested. For this, the transcript text is sent to a connected external AI service – a step you should include in your assessment. Tasks are only created after approval, as described in “From meeting to task: capturing meeting outcomes reliably” (coming on November 18, 2026).

The feature does not replace your legal assessment, but it implements the DSK’s technical recommendations. An overview of all building blocks is available at Features, and details on operations at Security.