AI Meeting Notes in Germany: What to Review With the Works Council
A practical German works-council review for AI meeting notes: monitoring capability, recording permission, GDPR legal basis, data flows and pilot boundaries.
An employer proposes an AI notetaker to save time after project meetings. The demonstration shows a helpful summary and a list of actions. The works council asks a different question: could the same system reveal who spoke, what they promised, how they responded to criticism, or whether they completed an assignment?
Both descriptions can be true. The practical review has to cover the information the deployment makes available, including its possible use in assessing employees, as well as the productivity purpose that prompted the purchase.
In Germany, that review involves several separate issues: participation rights under the Works Constitution Act, the lawful basis for processing personal data, and authority to record non-public speech. Choosing an on-device tool can change the data flow, but it does not answer all three.
This guide concerns private-sector workplaces with a German works council, or Betriebsrat. Public-sector staff representation follows a different framework. It reflects sources checked on October 25, 2026 and provides general information for discussion with advisers, not legal advice or a ready-to-sign works agreement.
Assess monitoring capability, not just the stated purpose
§87(1)(6) of the Works Constitution Act, or BetrVG, addresses co-determination in the introduction and use of technical systems for monitoring employee behaviour or performance, subject to the provision’s qualification concerning existing statutory or collective-agreement rules.
The Federal Labour Court’s December 13, 2016 decision, 1 ABR 7/15, explains the importance of objective suitability for monitoring. An employer’s subjective intention to monitor is not required. That case concerned Facebook functionality, not an AI meeting assistant, so its principle needs to be applied to the actual deployment rather than presented as a product-specific ruling.
A transcript with named speakers, searchable across meetings and accessible to managers, raises different questions from a narrowly controlled draft used for a single task. Neither description should be accepted without testing the details. Even where a product has no dashboard labelled “performance,” collected information may make employee behaviour visible.
Ask who can retrieve a person’s statements, connect them across meetings, export them, or compare them with assigned work. Include administrators and downstream recipients. A promise that management does not currently intend to evaluate staff is not a complete description of the technical capability.
Bring the council in while the workflow can still change
§90 BetrVG separately requires timely information, with necessary documents, about relevant planning, including work procedures and processes involving AI. It also provides for consultation about the planned measures and their effects on employees early enough for suggestions and concerns to be considered.
In practical terms, a useful first meeting with the council happens while the team can still change the scope, configuration, or choice of tool. A completed procurement followed by a presentation of the rollout date leaves little room for that discussion.
Prepare a short deployment description using an invented meeting rather than real employee data. Show the capture controls, the resulting audio and text, speaker labels, search results, export options, and what another user can access. Explain which functions are disabled, how that is enforced, and who can change the settings.
Where co-determination applies, do not treat a live pilot as an automatic exception. Resolve the applicable participation process before introducing the covered use. Whether §87 applies, which representative body is competent, and how an existing agreement affects the proposal require a review of the organisation and deployment. A workplace without a council still has recording and data-protection questions to answer.
Keep the legal basis, works agreement, and recording permission distinct
A works agreement can define important boundaries, but agreement with the council is not a general exemption from the GDPR. In K GmbH, C-65/23, decided December 19, 2024, the Court of Justice held that employment-data provisions adopted under Article 88 must also satisfy relevant GDPR requirements, including Articles 5, 6(1), and 9. Necessity remains subject to judicial review.
Nor should the assessment stop at citing §26(1) BDSG. In its May 8, 2025 judgment, 8 AZR 209/21, the Federal Labour Court held that §26(1) could not justify the Workday processing at issue and had to be left unapplied; it examined the GDPR directly. This is not a statement that all of §26 has been repealed. It is a reason to have the actual legal basis and necessity of a proposed employee-data use assessed under current case law.
If relying on employee consent, consider whether it is genuinely voluntary in the employment relationship. §26(2) BDSG expressly addresses dependency, the circumstances of consent, its form, and information about purpose and withdrawal. A practical review should examine what happens to someone who declines: can the meeting proceed with manual notes, and is there any disadvantage? A works-council signature does not establish each person’s consent.
Recording speech raises another issue. §201 of the Criminal Code addresses unauthorised recording of another person’s non-public speech and certain uses of such recordings. Confirm the authority for recording before capture starts, including for customers, external advisers, and late participants. Do not assume that a workplace agreement, a general privacy notice, or local storage alone supplies it. For cross-border calls, the European meeting-recording guide provides broader context; the German analysis does not settle every participant’s jurisdiction.
Map what exists after the meeting ends
For the review, draw the path from microphone or system audio through transcription, speaker attribution, summarisation, storage, search, and export. Name each recipient and distinguish a person’s access from an organisation’s access. Include backups and any external AI client that can retrieve the content.
Then follow one specific statement. Suppose an engineer explains that a delivery date depends on another team. Can a later summary remove the qualification? Can a manager find the statement months later? Can an exported action item make the engineer appear to have accepted an unconditional deadline? These are hypothetical test questions, not claims about a particular product’s behaviour.
The exercise helps the parties distinguish the intended use from a new employee-evaluation use. It also reveals how corrections need to propagate. Correcting the source transcript will not necessarily correct a copied summary in another system.
Identify meetings that contain particularly sensitive information. Health, trade-union matters, disputes, or confidential legal discussions may need a different assessment or exclusion from the proposed pilot. A generic approval for “internal meetings” is too imprecise to explain what employees should do when the conversation changes direction.
Put operational boundaries into the proposed agreement
The following are proposed discussion topics, not mandatory wording or a complete legal template. Their value lies in giving employees and administrators instructions they can follow.
| Topic | A concrete question for the parties |
|---|---|
| Permitted purpose and meetings | Which meeting types may use AI notes, and which require a separate decision or must stay outside the pilot? |
| Employee evaluation | Which uses, such as individual scoring or cross-meeting behavioural analysis, are prohibited, and how will those restrictions be implemented? |
| Capture and refusal | Who starts and stops capture, how are participants informed, and what alternative exists when recording cannot proceed? |
| Access and onward use | Who can read, search, administer, export, or receive each record type? |
| Accuracy and disagreement | How can a participant flag an incorrect attribution or summary, and how is a disputed record handled pending review? |
| Retention and preservation | What happens to audio, transcripts, drafts, exports, and backups, including when a preservation obligation applies? |
| Changes and oversight | Which new features, recipients, or uses require renewed assessment, and who checks that the agreed configuration remains in place? |
Be precise about enforcement. A policy prohibition and a technical restriction are different controls. If staff can enable a cloud provider or export a transcript despite the agreed policy, the review should say so and explain the organisational response. Do not describe a setting as centrally locked unless the deployed product and management tools actually provide that control.
Avoid assuming that one retention period suits every artifact. Equally, do not promise automatic deletion or universal exclusion of records from legal proceedings without assessing the applicable obligations and practical copies. The agreement needs a workable process for exceptional preservation and lawful access, not an assurance the employer cannot deliver.
Evaluate local processing as a specific configuration
On-device processing can narrow disclosure by keeping meeting content out of hosted AI services. Summit’s local-model documentation explains that local text processing can run offline after the necessary models are downloaded. For a works-council review, that provides a concrete configuration to examine.
It does not make employee information cease to be personal data. Named transcripts and searchable notes still exist on the endpoint, and someone with access may still use them in ways that concern employees.
Summit’s security architecture also describes optional hosted AI, iCloud sync, exports, and MCP access as separate data paths. Selecting Local does not disable all of them. The review should record which paths are permitted, which are disabled, and what onward disclosure an authorised client or export could cause.
The documented local database and recordings are not separately encrypted by the app on disk. Device access, FileVault where enabled, backups, and offboarding therefore belong in the security discussion. These are deployment questions for the employer, not evidence that Summit supplies a complete works-council compliance system.
Use a bounded pilot to test the agreement in practice
Begin technical evaluation with invented content. Test a late arrival, an objection to recording, an incorrectly attributed statement, a disputed action item, and an attempted export. Check the actual controls rather than relying on a slide describing the intended workflow.
Before processing real meetings, complete the applicable participation, recording, data-protection, and security reviews. Assess whether a data protection impact assessment is required for the planned use; Article 35 GDPR makes this a risk-based question, not an automatic consequence of using any AI feature. Include the applicable supervisory authority’s list of processing that requires an assessment and involve the data protection officer where designated.
The pilot should then have a defined scope, responsible owner, feedback route, and stopping conditions. Review whether employees understood the process, whether corrections reached downstream records, and whether access stayed within the agreed boundaries. A change from personal drafting to shared search, or from local inference to a hosted model, should return to assessment before it quietly becomes the new normal.
The result should be a description both employees and administrators can recognise in the software they use: what is captured, what it may support, who can access it, and how people can challenge mistakes.