AI transcription notice
Tool · Data protection at work
You want an AI tool to transcribe or record a meeting, a video conference or a phone call? Five questions establish what you need to say beforehand and whose consent you need. At the end you get a notice to read out, in a short and a full version, in English and in German.
Free, no sign-up. Your answers do not leave your device; only the result level is counted.
This check is an editorial summary and not legal advice. It does not replace a lawyer’s review of your particular case.
What do I need to say before an AI transcribes?
What this is about
An AI tool that takes the minutes saves time. Before it runs, four things need settling, and in Germany they sit in four different laws.
- The audio recording. Section 201 of the German Criminal Code (StGB) makes it an offence to record the privately spoken words of another person onto a sound carrier without authorisation. If you want to record, ask everyone who speaks first.
- The information. A recording or transcript contains personal data. Article 13 GDPR requires you to tell participants, at the time the data are obtained, who the controller is, what the transcript is for, on what legal basis, who receives it and how long it is kept. The full notice contains the most important of these details; your privacy notice, which the text refers to, supplies the rest.
- The workplace. Where there is a works council, Section 87(1) no. 6 of the German Works Constitution Act (BetrVG) gives it a right of co-determination over the introduction and use of technical equipment designed to monitor the behaviour or performance of employees. You settle that once for the tool, not in every meeting.
- The form. For your own employees, Section 26(2) of the German Federal Data Protection Act (BDSG) requires consent in writing or electronically, unless special circumstances make another form appropriate. Instead of consent, a works agreement can be the basis for your employees’ data (Section 26(4) BDSG).
Two further questions are easily missed: does the tool run on a company account with a data processing agreement (Article 28 GDPR)? And will health come up (Article 9 GDPR)?
How it works
- You say what the tool should do: record the audio, or only transcribe without storing the audio.
- You say who takes part: only employees, external participants as well, or whether it is a job interview.
- You answer three questions about the setting: works council, the account the tool runs on, and specially protected topics.
- You get the notice to read out. The first text is the short version for the start of the conversation, the second the full version with the most important details under Article 13 GDPR. They appear under “Notice wording to copy (German)” and “(English)”, each with a “Copy” button. You fill in the details in square brackets yourself.
- Where something needs settling first, it appears under “In addition” with a title beginning “Clarify first”, together with the legal reference and the next steps. Do not use the tool until these points are settled.
What the check cannot do
It does not test the tool itself: whether the audio really is not stored, where the provider processes data and what the contract says is for you or your IT team to know. It does not choose the legal basis for your company; the notice is built around consent, because the check recommends everyone’s agreement anyway. If a works agreement applies, enter it in the brackets. It does not cover special professional duties, for example in medical practices or law firms, and it does not cover the law of other countries when participants are abroad. It is written for organisations under German law. And it is not legal advice: it places your case against the wording of the provisions named and says where a question remains open.
Frequently Asked Questions
Frequently Asked Questions
Is it enough if nobody objects?
The check recommends an explicit yes from each person. Under Article 4(11) GDPR, consent is an indication of wishes given by a statement or by a clear affirmative action. An explicit yes can also be noted down, and anyone relying on consent must be able to demonstrate it under Article 7(1) GDPR. For your own employees, under Section 26(2) BDSG, consent must be given in writing or electronically, for example as a reply to the invitation, unless special circumstances make another form appropriate. A spoken yes in the meeting is not in writing. The safe course is therefore consent obtained in advance, in writing or electronically; the yes in the meeting then confirms it. On a caveat regarding Section 26 BDSG, see the question on job interviews.
Do I need to ask if the tool only transcribes and does not store the audio?
Section 201 StGB refers to recording onto a sound carrier; the wording does not say expressly whether a transcript without stored audio is covered. The duty to inform under Article 13 GDPR applies either way, because a transcript also records who said what. The check therefore recommends the same notice and the same consent.
Does the works council have to agree?
Section 87(1) no. 6 BetrVG gives the works council a right of co-determination over the introduction and use of technical equipment designed to monitor the behaviour or performance of employees, unless a statutory or collective agreement provision applies. Whether your tool falls under this is something to settle with the works council before it is used, ideally in a works agreement.
May I use the tool through my private account?
For your company’s conversations, the check advises against it. Where a provider processes data on behalf of your company, Article 28(3) GDPR requires a contract that binds the provider to your company. A privately created account rests on a contract between you personally and the provider.
What applies to job interviews?
Under Section 26(8) sentence 2 of the German Federal Data Protection Act (BDSG), job applicants are treated as employees, and for their consent Section 26(2) BDSG requires account to be taken of the person’s dependency; consent must be given in writing or electronically unless special circumstances make another form appropriate. The Court of Justice of the European Union has ruled that national rules on employee data protection must be disapplied if they do not comply with the requirements of Article 88 GDPR, unless they constitute a legal basis under Article 6(3) GDPR that satisfies the requirements of the Regulation. Whether Section 26 BDSG is affected, the Court did not decide: the judgment of 30 March 2023 (C-34/21) concerned provisions of the German state of Hesse (Section 23 HDSIG, Section 86 HBG) in a dispute about teaching by video conference. The check recommends holding job interviews without recording and without an AI transcript as a rule. If you do record or transcribe, the check provides a separate short notice for a one-to-one conversation.
Do my answers leave my device?
No. The check runs entirely in your browser; your answers are neither transmitted nor stored. Our own analytics counts only which result level was reached, not the path that led there.
Legal status
Legal status: 16 October 2026. These notes are an editorial summary and not legal advice; they do not replace a lawyer’s review of your particular case.
Checked against the wording of Section 201 StGB, Section 87 BetrVG and Section 26 BDSG at gesetze-im-internet.de, the General Data Protection Regulation (EU) 2016/679 as published in the Official Journal, and the judgment of the Court of Justice of the European Union of 30 March 2023 in Case C-34/21.
For the whole team.
The staff training on the EU AI Act shows how your team can use AI tools competently.
Which AI tools may your company use, and on what terms?
Talk to us about an AI policy, approved tools and an approval process.
Related tools: AI labelling check.
