AI Notetakers in Board Meetings: The Discovery and Privilege Risk Directors Are Missing

The question on every general counsel's desk this summer is not whether AI meeting notetakers should be allowed in the boardroom, but what happens to the transcript once litigation arrives. Two federal courts have already had to decide whether AI-assisted materials are privileged, and multiple major law firms have published memos in the last ninety days warning boards to think twice before letting Otter, Fireflies, Zoom AI Companion, or Copilot join a directors' meeting. The short answer to "are AI notetaker transcripts discoverable in board meetings": yes, generally — and cloud-hosted tools compound the risk by storing a second verbatim record on a vendor's server that is one subpoena, one civil investigative demand, or one breach away from disclosure.

Why the boardroom is different from any other meeting

A commercial-terms call, a customer sync, and a board meeting all look identical to a cloud AI notetaker: audio in, transcript out. Legally, they are not the same artifact. Human-drafted board minutes are deliberately designed to document the meeting without reproducing it — capturing decisions, process, and the fact that a discussion occurred, while omitting speculative comments, devil's advocacy, and half-formed dissent that directors advance to stress-test a proposal. An AI notetaker is designed to do the opposite: reproduce everything.

The Cahill Gordon & Reindel firm put the same concern more precisely in its June 2026 client alert, warning that verbatim AI transcripts may preserve speculative, critical, preliminary, or offhand remarks that curated minutes would ordinarily omit, potentially complicating fiduciary-duty or securities litigation if such statements are later taken out of context. That is the boardroom-specific harm: not that the recording exists, but that a second, more detailed record exists alongside the official minutes.

What Skadden and Cooley actually said

The June 2026 edition of Skadden's Informed Board series on AI-drafted board minutes is blunt: using AI tools to record or transcribe board meetings, or generate minutes, can create detailed records of confidential discussions that could create problems if they have to be turned over in litigation. The memo also flags that communications between directors and AI tools are generally not protected by attorney-client privilege, and that AI-assisted materials may not qualify for work product protection — meaning candid director exchanges with a chatbot can be discoverable.

Cooley reportedly went further, comparing an AI notetaker in a board meeting to putting a court reporter with no filter in the boardroom. Mayer Brown's June 2026 AI Notetakers: Productivity Tool or Emerging Legal Risk? memo warns that for meetings involving privileged communications, organizations should evaluate whether third-party AI notetakers create an unacceptable risk of privilege waiver, particularly because AI captures privileged content indiscriminately alongside routine business communications.

Two 2026 federal rulings every GC should read

On the same day — February 10, 2026 — two federal courts issued rulings that together frame how privilege and work-product doctrine apply to AI-assisted litigation materials.

Warner v. Gilbarco (E.D. Mich., Feb. 10, 2026)

In Warner v. Gilbarco, No. 2:24-cv-12333, Magistrate Judge Anthony P. Patti held that a pro se plaintiff's ChatGPT-assisted litigation materials were protected work product. The court characterized generative AI as "a tool, not a person," and rejected the argument that inputting information into a consumer AI tool automatically waives protection. As Paul Weiss noted in its client memo, Judge Patti warned that a contrary rule "would nullify work-product protection in nearly every modern drafting environment."

United States v. Heppner (S.D.N.Y., Feb. 17, 2026)

Judge Rakoff's ruling in United States v. Heppner reached the opposite result on similar facts, declining to extend attorney-client privilege to materials the defendant prepared using a consumer generative AI platform. As Cleary Gottlieb summarized, the Heppner court emphasized that the defendant used the AI tool of his own volition, without counsel's direction, and that the output did not reflect counsel's mental impressions at the time. A subsequent District of Colorado ruling in Morgan v. V2X, Inc. aligned with Warner, holding that AI interactions do not automatically compromise work-product protection.

The through-line for boards

Both rulings turn on the same variable: third-party disclosure. When a director's remarks flow through a cloud AI notetaker, they are being disclosed to a vendor whose data practices — retention defaults, training-data policies, sub-processors, breach history — the board did not draft and does not control. Every one of those variables is now inside the privilege analysis.

Discovery has arrived faster than boards expected

PYMNTS reported in June 2026 that corporate lawyers have begun ejecting AI notetakers from meetings before they start, citing law-firm guidance that AI-generated electronically stored information from notetakers, meeting summaries, and chat assistants is becoming a core discovery battlefield in employment cases. A 2025 Fellow.ai survey referenced in the same reporting found three out of four professionals using an AI notetaker in their work meetings. That is the collision point: near-universal adoption running head-on into unsettled discovery law.

The board layer has its own accelerant. As Digital Journal noted in its July 2026 analysis, transcripts persist — once created, they can be stored, shared, analyzed, and retrieved — and are potentially discoverable in litigation, regulatory investigations, internal disciplinary processes, or contractual disputes. A February 2026 class action against Microsoft alleging that Teams live transcription captured voice biometric data without proper Illinois BIPA consent adds a second exposure vector on top of discovery: the tool itself becoming the defendant.

Cloud AI notetakers vs. on-device: the containment architecture

The security and legal analysis usually stops at "does the vendor have SOC 2?" That is the wrong question for a boardroom. The right question is where the audio and transcript physically exist after the meeting ends. Here is how the two architectures compare on the variables that actually drive discovery and privilege outcomes:

The point is not that on-device transcription is inherently "safer" in a legal sense. It is that the on-device architecture removes one entire actor — the vendor — from the discovery graph. There is no vendor server that a plaintiff's counsel can subpoena in a follow-on shareholder derivative suit, and no vendor breach that turns a fiduciary-duty deliberation into public exhibits.

The privilege waiver mechanic, explained

Attorney-client privilege protects confidential communications between a lawyer and client made for the purpose of obtaining legal advice. Work-product doctrine protects materials prepared in anticipation of litigation. Both can be waived by voluntary disclosure to a third party unless the third party is acting on behalf of the client under a confidentiality obligation.

Boards routinely discuss legal matters with counsel present. When a cloud AI notetaker joins that meeting, the transcript is being created by, and stored on, an outside vendor's systems. The Mayer Brown analysis of Warner v. Gilbarco makes the practical point: even where disclosure to a third party does not automatically waive work-product protection, the analysis turns on the vendor's data retention and third-party sharing practices — which makes vendor due diligence essential. In other words, whether your directors' privileged discussions stay privileged depends on a DPA and a subprocessor list that most boards have never read.

Shumaker Loop & Kendrick's earlier framing captured the operational reality: even where AI scribes are deployed with sufficient confidentiality controls, outputs not subject to privilege can still be discoverable — and adding more notetakers simply generates more data subject to retention policies and legal-hold notices.

A checklist for GCs and corporate secretaries

Use this as a starting point for an internal board-tools memo. It is not legal advice; it is a decision framework based on the 2026 guidance surveyed above.

1. Default to "no bots in the boardroom." If the board wants a searchable record, generate it deliberately after the meeting from the corporate secretary's notes.
2. If AI transcription is used, require it to be on-device. No vendor server, no vendor DPA to audit, no vendor breach path.
3. Separate the transcript from the minutes. Verbatim transcripts, if created at all, should be treated as short-retention working documents distinct from the official approved minutes.
4. Apply legal holds to AI outputs. Per Skadden's guidance, AI-generated materials should be treated like any other records and preserved when litigation becomes likely.
5. Get counsel involved before, not after. Warner and Heppner both turned on who directed the AI use and why. Counsel-directed workflows create a cleaner work-product record.
6. Document consent. Even setting aside privilege, the Microsoft Teams BIPA class action is a reminder that voice-biometric consent obligations attach to transcription itself, independently of what happens to the transcript.

Regulatory backdrop: GDPR and the EU AI Act's August 2 activation

For any board with EU exposure — a subsidiary, a listed instrument, or European directors — the calculus tightened this month. Article 5 of the GDPR requires data minimization, and a verbatim board transcript stored indefinitely on a vendor server is difficult to reconcile with that principle. On top of that, as the European Commission announced, on 2 August 2026 the AI Office and national authorities began enforcing the AI Act, with Article 50 transparency obligations now live — chatbots and interactive AI systems must disclose themselves, and machine-generated content must carry machine-readable marks. Boards that let a cloud AI notetaker silently join a meeting now have an additional layer of transparency risk to think about, quite apart from privilege.

The Digital Omnibus package pushed high-risk AI rules to December 2027, but as the AI Act Service Desk timeline confirms, Article 50 transparency duties activated on schedule this month and carry fines up to €15 million or 3% of global turnover.

Vendor-policy reality check

Boards evaluating specific tools should read the primary source. Otter.ai's privacy policy and Fireflies' privacy policy describe the data flows that GCs need to reason about — what is stored, how long, for what purposes, and with which sub-processors. Zoom's privacy statement similarly governs Zoom AI Companion output. These are the documents that will show up in a document request if a shareholder or regulator asks how the board's confidential deliberations ended up on someone else's server.

How Basil AI solves this — on-device by architecture

Basil AI is designed for exactly the class of meeting where a cloud transcript is the wrong artifact. It runs on Apple Silicon Macs and iPhones, using Apple's on-device Speech Recognition APIs to transcribe audio locally, in real time, without uploading the recording to a vendor server. The engineering premise aligns with Apple's privacy documentation: process personal data on the device wherever possible, and treat cloud round-trips as a last resort, not a default.

What that means concretely for a board meeting: the corporate secretary opens Basil AI on their Mac, records the session (up to eight continuous hours), and the transcript stays on that Mac. There is no vendor server holding the recording. There is no third-party DPA that has to survive a subpoena. There is no vendor training pipeline that a verbatim record of a fiduciary-duty deliberation could feed into. The firm still owns retention, still applies legal holds, and still makes its own privilege calls — but it makes them without a second copy of the meeting sitting outside its walls.

To be clear, and consistent with the guidance in this article: on-device processing is an architectural fact, not a compliance guarantee. Whether Basil AI fits a given board's governance, retention, and privilege posture is a determination for that board's general counsel and corporate secretary, made against the analysis in Skadden's Informed Board memo and equivalent guidance. What on-device architecture does is remove the vendor from the discovery graph. Everything after that is process.

What to do this week

If you are a GC, corporate secretary, or committee chair reading this in mid-August 2026:

• Circulate the Skadden Informed Board memo and the Mayer Brown analysis to the audit and governance committees before the next board meeting.
• Ask IT what AI notetakers are currently allowed to join Zoom, Teams, and Google Meet sessions for board and committee members, and disable them for those meeting types.
• Confirm your document retention schedule addresses AI-generated meeting artifacts specifically, not just "emails and files."
• If you allow any AI transcription of board or committee meetings, restrict it to on-device tools where audio never leaves the device — and document the reason on the record.

For related reading on adjacent risks, see our analyses of bot vs. botless AI notetakers in client-facing meetings, what "compliant" AI meeting notes actually means, and the Microsoft Teams BIPA voiceprints case.

Keep board deliberations on the device.

Basil AI runs 100% on your Mac or iPhone — no vendor server, no cloud copy, no third-party subpoena target. Eight hours of continuous recording, on-device transcription, and exports to Apple Notes.