Your AI Note Taker Starts Three Minutes Late, and That's Where Consent Lives

The short version: a meeting bot starts recording when it is admitted to the call, not when the meeting starts. On a real 57-minute call we measured that gap at 2 minutes 54 seconds. The exchange where someone asks "is it okay if we record this?" and everyone agrees happened at 42 seconds. So the consent was given. It just wasn't in the recording. If your policy treats the transcript as evidence of consent, that's a hole worth knowing about.

(Disclosure: Teneks is our product, and it captures locally from the start of the recording. This is general information, not legal advice. For a specific setup, ask a lawyer in your jurisdiction.)

What we measured

We recorded one meeting with three tools simultaneously and aligned their transcripts on a common anchor.

The bot wasn't malfunctioning. The host was still granting it permission to join while the participants were greeting each other and agreeing to be recorded. An entirely normal sequence. The app started late because a human tapped record late, which is just as normal.

The pattern is structural, not accidental. Recording begins after admission or after a tap. Consent is asked at the top of the meeting. So the tool most likely to be missing the consent is the very tool being relied on to prove it.

Why the opening minutes carry legal weight

Under GDPR, recording a conversation processes personal data, and you need a lawful basis. Where that basis is consent, three things matter: it must be freely given, informed, and demonstrable, meaning you have to be able to show it was obtained.

That last word is where the gap bites. If your evidence of consent is "we always ask at the start" and your transcripts begin after the start, you have a policy but not a record. Add a third party to the room, say someone from another office or a vendor, and the disclosure obligation grows exactly when nothing is being captured.

Rules also differ by country and by setting. Recording a phone call with everyone's agreement is generally straightforward across the Baltics and Nordics. Recording an in-person conversation on business premises is a different question with different answers per jurisdiction. We keep country-by-country detail in our call recording laws guide.

What a compliant setup looks like

1. Record from before the consent question, not after it. This rules out any capture model that starts on admission or on a manual tap after the conversation has begun. Local capture that you start before joining is the straightforward answer.

2. Make the disclaimer part of the recording. Not just in a policy document. Say it out loud, so it ends up in the transcript.

3. Have a defined path for "no". Someone will decline. Decide in advance whether that means stop, or record and delete. Both are defensible; improvising in the moment is not.

4. Retain deliberately. Pick a retention period, apply it automatically, and know whether the memo outlives the transcript. Many teams keep the summary and erase the verbatim record, and that is usually the right shape.

5. Log who reads what, and why. For an internal transcript archive, access logging with a stated reason is the difference between a folder of recordings and something you can show an auditor.

6. Know where the audio is processed. Which sub-processors, which region. Your DPO will ask, so better to have it written down before they do.

The stronger version: make the tool enforce it

Everything above is policy. It depends on people doing the right thing.

The stronger design is a consent gate: the system checks the opening of every recording for the consent question and the agreement, and if it can't find them, the recording is erased automatically rather than filed. Consent stops being a rule that people follow and becomes a control that runs whether or not anyone remembers.

That only works if the recording contains the opening of the meeting, which brings the whole argument back to when your tool starts. A gate can't check a moment nobody captured.

The quick audit

Take a recent recorded meeting and open the transcript.

1. What is the first line? Is it the greeting, or is it someone mid-sentence?
2. Is the consent question in it?
3. If someone asked to be excluded, is there a record of what happened next?
4. When does that transcript get deleted, and who decided?
5. Who has read it, and can you tell?

If question 2 is a no, the fix isn't a policy update. It's the capture model.

FAQ

Do I need consent to record a meeting under GDPR?

You need a lawful basis. Where that basis is consent, it must be freely given, informed and demonstrable, meaning you can show it was obtained. Requirements vary by country and by whether the conversation is online or in person.

Does an AI note taker record the consent question?

Often not. Bots only record from the moment they are admitted to the call. We measured a real meeting where recording began 2 minutes 54 seconds in, while consent was given at 42 seconds.

What happens if someone refuses to be recorded?

Decide in advance: either stop recording, or delete afterwards. The important part is that the path exists and is followed consistently, and that whichever you choose is reflected in what the tool actually does.

How long should meeting transcripts be kept?

Common practice is three to six months for the verbatim transcript, with the summary kept longer. Set the period deliberately, apply it automatically, and be able to show it was applied.