GDPR and AI Meeting Notes: What the Tool Comparison Misses

An AI meeting tool records a call, transcribes it and writes a summary. Whether you may use it in Germany or Austria depends on four things: where the transcript is stored, where it is processed, whether the vendor trains on it, and whether your works council has agreed. Only the first three are vendor questions. The fourth is yours, and it is the one that stops rollouts.

GDPR compliant on a vendor page says almost nothing, because compliance is a property of how you deploy a tool, not of the tool. Two obstacles sit in front of the GDPR entirely: in Germany, recording a non-public conversation without consent is a criminal offence under § 201 StGB, and a tool that can transcribe and identify speakers triggers works council co-determination before anyone presses record.

This article compares six tools on what their vendors actually publish, then walks the legal path for Germany and Austria.

Ask these four, in this order, and most vendor pages answer only the first. The second is where the surprises live.

1. Where is the data stored? The at-rest question. Almost every vendor answers it, and several offer an EU region.

2. Where is it processed? Storage and inference are different things, and a vendor can be honest about the first while the second happens elsewhere. This is the single most useful question in the list.

3. Does the vendor train on your content? And from which plan can you switch it off? Free and low tiers frequently differ from business tiers.

4. Do you get a data processing agreement, and how many sub-processors hang off it? A DPA you cannot obtain is not a DPA, and a chain of thirty sub-processors is a different risk profile than a chain of five. Fireflies, for instance, publishes its DPA as a PDF; our Art. 28 DPA checklist is the sheet we use to read one.

Most German-speaking companies that use an AI meeting assistant use Microsoft's, and most of them believe the EU Data Boundary means everything happens in Europe. That is no longer the whole picture. Microsoft introduced Flex Routing for EU and EFTA tenants: LLM inference for Microsoft 365 Copilot may run outside the EU Data Boundary when demand on European infrastructure is high. Data at rest stays inside. Organisations had until 17 April 2026 to review the setting before it became active by default.

The practical consequence is not that Copilot became unusable. It is that a sentence in your records of processing activities may now be wrong, and that the transfer basis for those inference calls needs to be the one you actually documented. If your data protection documentation says processing takes place in the EU, that sentence needs checking against the tenant setting rather than against the marketing page.

Google went the other way in the same period and made data regions available for Gemini features in Workspace, so the EU question there is a configuration rather than a routing lottery. We walked through that side in our Gemini for Workspace review, the wider vendor landscape in the EU ChatGPT alternatives guide, and the specific question of what else there is in Microsoft Copilot alternatives.

In Germany, § 201 StGB protects the confidentiality of the spoken word. Recording a non-public conversation without authorisation, and using or passing on such a recording, carries up to three years' imprisonment or a fine. That is criminal law, it applies to the person who presses record, and no data processing agreement cures it.

What follows is practical rather than dramatic. Every participant has to consent, and consent has to be real: announcing at the top of the call that a bot is recording only works if declining is genuinely possible and the meeting can continue without it. For internal meetings a works agreement can carry the lawful basis instead of individual consent. For external meetings, an active notice at the start plus the option to proceed without recording is the workable pattern. Law firms specialising in this, such as Datenschutzkanzlei on recording and transcribing meetings, land on the same three points.

The silent-participant problem is the one most teams discover late: a note-taking bot that joins uninvited, or an assistant that keeps transcribing after the official part ended, produces exactly the recording § 201 is about. Employment lawyers reach the same conclusion on recording and transcribing video conferences. And it is rarely a decision anyone made: bots arrive through individual accounts, which is the shadow AI problem wearing a different hat. An AI usage survey tells you which ones are already in your calls.

Everything above is the price of recording. It is worth paying when the purpose is minutes. It is a lot to pay when the question is not what was said but how do we decide as a group.

For that second question there is a shorter path: work from a transcript you already have. If your Teams call was transcribed anyway, or someone took proper minutes, the analysis step adds no new recording, no new consent, no new works council question. That is the deliberate design of the C&C meeting analysis built by Ingo Lanzdorf: you upload a transcript, and it reads the meeting against the KI©K framework for climate, decisions and feedback loops. It cannot replace a note-taker, because it never listens to anything.

This is also the honest limitation of that tool, and the reason it is at the bottom of the comparison table rather than the top: if what you need is automatic minutes from a live call, the six tools above are the category, not this one.