Recording Workplace Meetings in Australia and New Zealand: An AI-Notes Checklist

There is no single “one-party consent” rule that answers whether you can record a workplace meeting in Australia or New Zealand.

In Australia, a recording can engage federal privacy law, a state or territory surveillance-device law, workplace-surveillance rules, employment duties, and sector-specific obligations. The answer can change depending on where the people are, whether the recorder is a participant, why the recording is made, and what happens to it afterward.

New Zealand has one national Privacy Act, but that still does not make covert recording a safe default. The Office of the Privacy Commissioner says it is generally best to record a meeting with consent and that covert recording is harder to justify because of the strong presumption that it is unfair.

AI adds another layer. A tool may capture audio, create a transcript, infer speakers and action items, send content to several providers, and retain the resulting summary long after the audio is deleted. Each step needs its own assessment.

This guide is a practical starting point, not legal advice.

Start with the complete data flow

“Taking notes” is not one processing operation. An AI meeting assistant may create or disclose:

microphone and system audio;
video, screen content, or meeting chat;
a live or stored transcript;
speaker labels or voice representations;
names, attendance, timestamps, and calendar details;
summaries, tasks, decisions, and inferred sentiment;
search indexes or embeddings;
copies in an AI provider, integration, email, CRM, or shared drive; and
diagnostic logs, backups, and exported files.

A product that deletes raw audio can still retain a detailed transcript. A product that adds no visible meeting bot can still send the conversation to a cloud transcription provider. A local product can still create a sensitive record on an inadequately protected laptop.

Map the stages before deciding which rules apply.

Australia: privacy law treats AI transcripts as personal information

The Office of the Australian Information Commissioner (OAIC) directly addresses AI meeting tools in its guidance on commercially available AI products. It notes that common meeting platforms can record meetings and generate transcripts or written minutes, and that participant awareness and consent are relevant to whether collection is lawful and fair.

The OAIC’s current APP 3 guidance also expressly includes online-meeting recordings and transcripts, including AI-generated transcripts, as personal information provided at a business meeting when related to its subject matter.

For an organisation covered by the Privacy Act 1988, the practical questions include:

Is collection reasonably necessary? APP 3 limits collection to information reasonably necessary for the organisation’s functions or activities. Recording every word may be difficult to justify if ordinary minutes would achieve the purpose.
Is collection lawful and fair? A hidden recorder, unclear interface, or misleading explanation can undermine fairness even where another law does not make recording a criminal offence.
Were people notified? APP 5 generally requires reasonable steps to notify people about matters including purpose, usual disclosures, access and correction, and likely overseas recipients.
Will the notes be repurposed? APP 6 restricts secondary use or disclosure unless an exception applies. Turning project minutes into employee-performance evidence is not the same purpose as documenting decisions.
Are the records secure and still needed? APP 11 requires reasonable protection and steps to destroy or de-identify personal information when it is no longer needed, subject to applicable exceptions.
Can people access and correct the record? APPs 12 and 13 create access and correction mechanisms. That matters when AI assigns a statement to the wrong speaker or converts a tentative comment into a decision.

AI-generated inaccuracies do not fall outside privacy law merely because a model invented them. The OAIC says inferred, incorrect, or artificially generated information about an identified or reasonably identifiable person can itself be personal information.

The employee-records exemption is not a blanket AI exemption

Australia’s federal Privacy Act contains an employee-records exemption for certain acts or practices of a private-sector employer that are directly related to a current or former employment relationship and an employee record it holds. The OAIC’s employee-records exemption guidance explains the two-part boundary.

The boundary is important. The exemption does not mean that every recording involving an employee is automatically outside the Privacy Act. Questions can remain about job applicants, contractors, customers and other meeting participants; collection before information becomes an employee record; unrelated or insufficiently connected uses; service providers processing on the employer’s behalf; and state or territory law.

Public-sector employers and state-regulated organisations may operate under different privacy regimes. Workplace duties, discrimination law, industrial instruments, confidentiality obligations, and the implied duty of good faith can also matter even where the federal exemption applies.

Treat the exemption as a scoped legal question, not a product setting.

Australia: recording law changes by state and territory

Australia’s surveillance-device rules are not uniform. The location of every participant can matter in a remote meeting, and recording and later sharing may be regulated differently.

Two examples show why “Australia is one-party consent” is unreliable:

New South Wales: Section 7 of the Surveillance Devices Act 2007 generally prohibits using a listening device to record a private conversation, including by a participant, unless an exception applies. Exceptions include express or implied consent of all principal parties and narrower circumstances involving protection of a participant’s lawful interests or a recording not intended for communication to non-parties. Sending content to a service provider or sharing an AI summary can complicate that analysis.
Queensland: Section 43 of the Invasion of Privacy Act 1971 includes an exception where the person using the listening device is a party to the private conversation. But section 45 separately restricts a participant’s subsequent communication or publication of the recording or a statement prepared from it, subject to listed exceptions.

Other states and territories use different statutory language, exceptions, and disclosure rules. Some also have workplace-surveillance requirements covering cameras, computer activity, or tracking. For example, the NSW Workplace Surveillance Act 2005 regulates specified forms of employee surveillance, while noting that listening devices are dealt with separately.

The safe operational approach is to identify the relevant jurisdictions before the meeting and avoid assuming that participation alone authorises recording, cloud processing, or redistribution.

New Zealand: fairness matters even when the recorder is in the room

New Zealand’s Privacy Act 2020 uses information privacy principles covering purpose, source, notice, collection methods, security, access, correction, use, disclosure, and retention.

The Privacy Commissioner gives particularly clear workplace guidance. In “Can I record a meeting with my boss or employee?”, the regulator says:

there should be clear reasons for voice recording;
a recording contains much more detail than ordinary notes;
it is generally best to record with consent;
covert recording is more difficult to justify because it is strongly presumed unfair unless a compelling reason exists; and
where an agency makes the recording, participants may be entitled to request a copy.

That is privacy guidance, not a declaration that every disclosed recording is lawful. An employer still needs a legitimate purpose, proportionate collection, adequate notice, security, retention limits, and a process for access and correction. Employment duties and the circumstances of the meeting can add further constraints.

A privacy policy buried on a website is not the same as telling the people in a particular meeting what will happen.

A defensible notice should answer, in plain language:

Is audio, video, or only text being captured?
Who is responsible for the recording?
Why is it being made?
Which AI or transcription providers receive content?
Will the output be used for evaluation, training, sales intelligence, or automated decisions?
Who will be able to read it?
How long will each artifact be retained?
Can someone participate without being recorded?
How can a person obtain or correct the record?

Ask before capture begins. If someone objects, pause the tool and use an agreed alternative. A visible bot or recording indicator can support notice, but it does not explain the purposes, recipients, retention, or downstream uses on its own.

Special caution for employee one-to-ones and HR meetings

AI notes can change the nature of a conversation. A coaching discussion, grievance, return-to-work meeting, disciplinary interview, or redundancy consultation may contain health information, allegations, union activity, legal advice, or evaluations of identifiable people.

Before recording these meetings, employers should ask:

Is a verbatim record genuinely necessary?
Would human notes or an agreed written outcome be less intrusive?
Does the meeting involve sensitive information or protected activity?
Could the AI output influence a consequential employment decision?
Who can approve access, correction, export, and deletion?
Does a workplace policy, award, enterprise agreement, professional duty, or sector rule impose an additional requirement?

Do not silently reuse routine meeting transcripts to rank employees, infer attitude, or build performance profiles. That is a new purpose with a different risk profile.

A practical AI-notes checklist

Before the meeting

Identify where participants are located and which laws and workplace rules may apply.
Define the specific purpose and decide whether full recording is necessary.
Choose the minimum data path: audio, transcript, summary, or human notes.
Review every provider, subprocessor, hosting region, and model-training term.
Decide retention periods separately for audio, transcript, summary, and exports.
Prepare a clear notice and a realistic alternative for people who object.

At the start

Tell participants that AI assistance is active before capture begins.
Explain what is captured, why, where it is processed, and who receives the output.
Record the response where consent or documented acknowledgement is required.
Stop the tool for excluded agenda items or if the agreed conditions change.

After the meeting

Review speaker labels, quotations, decisions, and action items before relying on them.
Let affected people challenge significant errors.
Restrict access to the intended audience instead of sharing a public link.
Delete raw audio and intermediate artifacts when their purpose ends.
Apply a fresh assessment before reusing notes for monitoring, evaluation, model training, or analytics.

What local processing changes

With Summit and Local Models selected, meeting capture, transcription, speaker separation, summarisation, storage, and search can run on the Mac. No meeting bot joins the call, and Summit does not need to operate a cloud meeting archive.

That can reduce disclosure to service providers, cross-border data transfers, and the number of organisations holding a copy. It can also make the actual processing path easier to explain to participants.

There are explicit limits. Summit supports optional hosted and self-hosted language-model providers; choosing a hosted provider sends relevant transcript excerpts to that endpoint. Optional iCloud sync creates another disclosed data path. Local audio and database files rely on the macOS sandbox, permissions, and FileVault when enabled rather than separate application-level encryption. The published architecture describes these boundaries.

Local processing does not override surveillance law, workplace policy, consent, fairness, access, correction, retention, or discovery obligations. It changes who receives the data—not whether the meeting deserves careful governance.

The defensible default

For most ordinary workplace meetings, the defensible default is simple:

announce AI capture before it starts;
state a narrow purpose;
offer a workable unrecorded alternative;
process and retain the minimum necessary data;
review the output before consequential use; and
check the applicable Australian state or territory, or New Zealand, rules.

That avoids the most common error: treating an AI notetaker as a harmless personal productivity tool when it is actually creating a searchable record about colleagues, clients, and other people.

Primary sources

This article provides general privacy and workplace information, not legal advice. Recording rules are fact-specific and can change. Obtain advice for sensitive meetings, covert recording, multi-jurisdiction calls, or consequential employment use.

Try Summit on macOS for bot-free meeting notes with a fully local processing path.