Decide when AI transcription and summarisation are appropriate for sensitive meetings
The AO sets a policy for sensitive meetings that distinguishes between permitted, restricted and prohibited uses of Teams transcription, Copilot summaries and meeting agents, based on the data involved, the purpose and the controls available.
Where the action happens
Teams admin centre / Purview / governance process
Product or feature needed
Teams recording and transcription policy, Copilot meeting summaries, sensitivity labels, retention, Purview audit/search
AI required
Optional - governance decision about AI-assisted meeting processing
Extra credits
No for the governance review itself
Technical skill
High
Risk level
High - these meetings can involve high-impact personal or case information
UK availability
available
What it can do
- Lets the organisation define different rules for different sensitive meeting types rather than applying one blanket ban.
- Supports a risk-based decision about recording, transcription, Copilot summaries and meeting agents based on purpose, necessity, participants, data categories, retention and access controls.
- Allows Microsoft 365 controls such as meeting policies, sensitivity labels, retention and Purview to support the organisation's chosen policy.
Limitations
- There is no universal rule that sensitive case information must never be processed by Microsoft 365 Copilot or Teams transcription. The organisation's policy, lawful basis, risk assessment and configuration determine what is appropriate.
- A transcript or Copilot summary creates additional organisational records, which can affect retention, access and disclosure obligations.
- High-risk data can still be inappropriate for AI processing where the benefit is weak, the processing is unnecessary, access is too broad or suitable controls are unavailable.
Prerequisites
- Start with the AO's AI, information-security, records-management and data-protection policies.
- Identify the categories of information likely to be discussed and whether additional legal or policy controls apply.
- Confirm the approved Microsoft 365 environment, retention settings, access controls, sensitivity labels and audit implications.
- Decide whether recording or transcription is actually necessary for the stated purpose and whether a less intrusive approach would achieve the same outcome.
- Where the processing is likely to create high risk to individuals, involve the relevant information-governance or data-protection function.
Workarounds
Where full transcription is not justified, use a human-authored outcome note or agreed action record in the organisation's designated case-management system, containing only the information needed for the case.
No premium licensing needed. External dependency: Organisation's records process.
Where AI use is permitted but broad exposure would be inappropriate, minimise or pseudonymise the information, restrict participants and access, and apply appropriate retention and sensitivity controls.
No premium licensing needed. External dependency: Microsoft 365 and organisational governance controls.
Notes
Use risk-based wording rather than categorical bans. The organisation's designated case-management system can remain the authoritative system of record without implying that all approved AI processing is prohibited. If agent grounding over sensitive case content is proposed, treat it as a separate high-risk design decision requiring a defined purpose, tightly scoped sources and audience, appropriate permissions and retention, and the organisation's required approval.
Watch-outs for Advanced: govern & scale
- Keep detailed governance here rather than repeating it on every beginner capability.
- Track ownership, access, cost, lifecycle and exceptions once services are shared or business-critical.
- AI Redlines remain separate from normal governance and should be treated as hard boundaries.
Sources
- https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/how-should-we-assess-security-and-data-minimisation-in-ai
- Microsoft – Enterprise data protection in Microsoft Copilot and Copilot Chat checked 2026-10-09
- ICO – How should we assess security and data minimisation in AI? checked 2026-10-09
Last checked: 2026-10-09
Community feedback
Has your organisation tried this? Confirm whether it's possible, whether it's useful, and share any tips.
0
Confirmed possible
0
Reported not possible
0
Found it useful
0
Not useful
Loading feedback…