The same questions work for both kinds of vendor. Ask for the answers in writing, and check they match the contract.
- Data location. Where are recordings, transcripts, notes and client records stored and processed? In which country, and by which third-party services?
- Training on your data. Is your data used to train or improve AI models, by the vendor or anyone else? Can that be switched off, and is it in the contract?
- Human review. Can a draft stay separate from the approved record? Is the reviewer and the time of review recorded?
- Recording and consent. How are clients told about recording, and what happens when a client says no?
- Access. Who at the vendor can see your client data, and when?
- Retention and deletion. Who sets retention periods? Can a recording be deleted on request?
- Exit. What do you get back if you leave, in what format and how quickly? What happens to copies the vendor holds?
- Total cost. What drives ongoing cost: users, minutes, AI usage, storage, licensing or third-party charges?
The Office of the Australian Information Commissioner’s guidance on privacy and commercially available AI products covers transcription and note-taking tools. It flags product terms that let a vendor use customer inputs for further training, and it recommends against entering personal information, especially sensitive information, into publicly available generative AI tools. Check the recording laws that apply in your state or territory too.
ASIC’s REP 798, Beware the gap (October 2024) found that some licensees were adopting AI faster than they were updating their governance. Whichever tool you choose, agree the review and approval steps before rollout.
A note on fee consent
Fee consent is a common reason firms look past a notetaker. Under the Delivering Better Financial Outcomes changes, the annual fee disclosure statement (FDS) has gone. For ongoing fee arrangements entered into from 10 January 2025, or for existing ones from their first anniversary after that date, the client gives signed, dated written consent to renew each year, within a window around the anniversary or an agreed reference day. Records must be kept for at least five years. See ASIC’s INFO 286. Older guidance, INFO 256, still describes the FDS and generally applies only to arrangements before the new rules took effect.
This guide is general information, not legal or compliance advice. Confirm how these rules apply to your firm with your licensee or compliance adviser.