Blog · Policy

Why organisations are blocking AI notetakers, and what they allow instead

Harvard restricted AI meeting assistants in 2025. Microsoft Teams now holds detected bots in the lobby by default. Law firms warn about privilege. The pattern: tools that send meetings to an unapproved cloud are being shut out.

10 October 2026 · 2 min read · Soham Mitra

Universities went first

In February 2025 Harvard's IT department banned AI meeting assistants that record and transcribe in Harvard meetings, with exceptions for tools under a University enterprise agreement and for accessibility needs. The guidance said such tools “have the potential to stifle conversation and open inquiry.” The Chan School's IT team named Otter.ai and Fireflies.ai and told hosts to use Zoom authentication and waiting rooms to keep bots out.

Then the meeting platforms

Microsoft Teams now detects external bots and holds them in the lobby for the organiser to admit, whatever the meeting's lobby settings. Microsoft's reason is that bots may “record or transcribe meetings without participant awareness.” A further option to block detected bots outright is rolling out, per Message Center notice MC1459141 as reported by BleepingComputer. It is off by default.

And the lawyers

Mayer Brown warns that employees using personal notetaker accounts create privilege and data-leak risk, and that a vendor's access to recordings may waive privilege. The New York City Bar has told lawyers to get client consent before AI-recording a call, and in August 2026 advised against recording non-client conversations without a good reason.

This is shadow AI, and it is not small

A Forbes Technology Council piece cites Verizon's 2026 Data Breach Investigations Report: employee AI use rose from 15% to 45%, and shadow AI was the third most common non-malicious insider action. People adopt notetakers because they save time. Bans push the habit underground unless there is an approved alternative.

What gets approved

Read the policies above and the same conditions repeat. A notetaker gets through when:

1. The organisation controls where recordings go. An enterprise contract, a tenant it administers, or its own machines.
2. Nothing joins the meeting uninvited. No bot asking to be let in.
3. The vendor does not train on the content. Or the organisation can switch it off and prove it is off.
4. IT can check the claims. Settings it can audit and traffic it can watch.

Vlocalhost was built for that list. It runs on the user's computer, joins no meeting and sends no audio to us. Our security audit of the installed build sampled the app's network connections 509 times and found all of them on the machine itself. Recording consent is still required (consent guide).