The Meeting Was Confidential. So Why Is There an AI Transcript?

Usually because someone's AI notetaker joined the call. Third-party transcription bots often join through a participant's calendar and enter the meeting like any other guest. They then store the audio and transcript on the bot vendor's systems. Microsoft Teams and Zoom both document admin controls that can detect, label or hold these bots in the lobby. They work only if someone has reviewed and set them.

This post explains how unapproved bots get in and which controls Microsoft and Zoom document. It also covers what to do when a transcript of a confidential meeting turns up. It sits alongside our earlier piece Your Company Data Is Feeding AI. Do You Even Know Where It Goes? and three companion posts: meeting room recording and consent, AI smart glasses in meetings and a policy template for AI recording devices. Admin settings are taken from Microsoft and Zoom documentation; legal points are from official PDPC and Singapore Statutes Online pages and are not legal advice.

How does an AI bot end up in a confidential meeting?

Most notetaker services connect to a user's calendar and join every meeting that user is invited to, unless told otherwise. If one invitee, an external guest included, has signed up, the bot can arrive even though the organiser never invited it. In a busy meeting it shows up as one more name in the participant list.

Microsoft's admin documentation sets out the risks plainly. It says external bots can record or transcribe meetings without participants knowing. It adds that they can store meeting data in third-party systems outside the organisation's compliance boundaries, creating compliance, privacy and data leakage risks.

What can Microsoft Teams admins do about external bots?

Teams has a meeting policy setting called "Manage external bots and their access to meetings", in the Meeting join and lobby section of the Teams admin centre. Microsoft describes two options:

• When detected, require approval before joining (PowerShell value RequireApprovalWhenDetected). Microsoft lists this as the default. Detected bots are marked and held in the lobby, even if the meeting's lobby settings would otherwise let them straight in. An organiser, or a presenter depending on meeting settings, must admit them explicitly.
• Do not detect bots (AllowBots). Bots are not marked and appear as any other external participant.

The PowerShell parameter is ExternalBotAccessMode on Set-CsTeamsMeetingPolicy. Microsoft is open about limits: some bots may not be detected, and humans can occasionally be flagged as bots. An organiser can admit a wrongly flagged person and mark them "This is not a bot". Microsoft's own best practice includes limiting lobby admission to organisers and co-organisers, so other presenters cannot wave a bot through.

What about recording and transcription inside Teams itself?

Teams' own recording is more visible. Microsoft's support page says all participants are notified when recording starts and that guests cannot start or stop a recording. Recordings go to the organiser's OneDrive, with expiry set by admins.

Admins can go further with the "Require participant agreement for recording and transcription" policy (parameter ExplicitRecordingConsent). Microsoft says that with it on, participants are muted with cameras off once recording or transcription starts until they agree. Each person's choice appears in the attendance report and Purview audit logs. The policy is off by default, and Teams Rooms devices are auto-consented. Our post on meeting room recording consent covers that room gap.

What controls does Zoom document?

Zoom's documentation on managing automated tools in meetings describes three in-meeting controls:

• Waiting Room. Hosts can enable it per meeting; admins can enforce it for an account or group. Hosts admit people individually and can remove and block uninvited participants. Bypass can be limited to users on your own account or named domains.
• Identifying guests. With "Identifying guests in the meeting/webinar" on, anyone not signed in, or signed in with an email outside the host's account, is labelled a guest. Zoom says uninvited automated tools appear as guests in the waiting room and participant list.
• Active Apps Notifier. Zoom says this shows an in-meeting notice when a tool accesses meeting content such as audio, video, screen share or chat. Hosts can see which tool it is and who operates it, then let it stay or remove and report it.

On the admin side, Zoom's documentation describes App Marketplace permissions for approving or restricting meeting tools on the account. It also describes an Active App Notifier report of tools that accessed meeting content in the past 30 days. Disabling an app this way stops its use on your account only, so external guests' bots still need the waiting room.

Why does an unapproved transcript matter under the PDPA?

A transcript records who said what, so it usually contains personal data. The PDPC's Advisory Guidelines (revised May 2024) say an audio recording may be personal data if a person can be identified from it. A bot transcript of a meeting your organisation hosted raises questions under several PDPA obligations, as published on Singapore Statutes Online:

• Section 24, protection. Organisations must make reasonable security arrangements to protect personal data in their possession or control.
• Section 26, transfers abroad. An organisation must not transfer personal data outside Singapore except under prescribed requirements. A bot vendor's servers may well be overseas.
• Sections 13, 14 and 20, consent and notice. Participants are generally told the purpose and asked for consent, subject to exceptions.

Whether a particular bot transcript creates a breach depends on who ran the bot, for what purpose and under whose control. That analysis belongs with your data protection officer or lawyer. The safer operational position is simple: stop unapproved tools at the door.

What should you do if a confidential transcript appears?

1. Identify the tool and its owner. Check the participant list, Teams audit logs or Zoom's Active App Notifier report.
2. Ask the owner to delete it from the vendor service and any shared summaries, and confirm in writing.
3. Disconnect the integration if it was linked to a company account or calendar.
4. Escalate to your data protection officer to decide whether further steps are needed.
5. Close the gap. Confirm bot detection or waiting rooms are on and that lobby admission is limited.

Bot controls are mostly already in your Teams or Zoom licence. The work is deciding to use them and telling organisers why.

Does meeting room hardware change the picture?

Not much, and that is worth knowing. A room device joins as the room, under your own tenant, so it is not the uninvited guest. A Teams Rooms system such as the Logitech Rally Bar or Yealink MeetingBar A40 (both Price on request) follows your Teams meeting policies. A USB bar like the Yealink UVC40 E2 (S$645.00 as listed on 25 Oct 2026) follows whatever app runs on the connected laptop. The controls above live in the platform, not the camera. For a wider view of AI assistants and data, see Your AI Assistant Might Be Your Biggest Security Risk.

Checklist: close the bot gap this week

• Confirm Teams external bot detection is on "require approval" for all organisers.
• Limit Teams lobby admission to organisers and co-organisers for sensitive meetings.
• Enforce Zoom Waiting Room and guest identification at account level.
• Review approved apps in Zoom App Marketplace and your Microsoft tenant.
• Publish a short list of approved transcription tools, and say all others are not allowed.
• Brief organisers: check the participant list before sensitive items, and remove unknown attendees.
• Write the rules into policy using our AI recording device policy template.

Frequently asked questions

Can Microsoft Teams block AI notetaker bots? Teams can detect external bots and hold them in the lobby until an organiser admits them. Microsoft lists "When detected, require approval before joining" as the default, but notes some bots may not be detected.

How do I stop third-party bots joining Zoom meetings? Zoom documents the Waiting Room, guest identification and the Active Apps Notifier for this. Admins can also restrict apps on their own account, though external guests' bots still need the waiting room.

Does Teams tell people when a meeting is recorded? Microsoft says all participants are notified in the Teams app when recording starts, and that guests cannot start or stop recordings.

Can Teams require each participant to consent to recording? Yes, with the "Require participant agreement for recording and transcription" policy. Microsoft says it is off by default and that Teams Rooms devices are auto-consented.

Is an AI meeting transcript personal data under the PDPA? It can be. The PDPC's guidelines say an audio recording may be personal data if a person can be identified from it, and a transcript links words to named speakers. This is not legal advice.