# What Engineering Firms Should Do After the Granola AI Notetaker Lawsuit

**By Dan Cumberland** · Published November 1, 2026 · Categories: AI Strategy

![Featured image for What Engineering Firms Should Do After the Granola AI Notetaker Lawsuit](https://cms.dancumberlandlabs.com/uploads/featured_image_95421ed29d.webp)

Illustration: Dan Cumberland Labs with Gemini.

> Your 2:00 OAC call is running.  There are eleven names in the participants panel, plus one you don't recognize.  The project owner types it into the chat:...

Your 2:00 OAC call is running\.  There are eleven names in the participants panel, plus one you don't recognize\.  The project owner types it into the chat: "What is Otter?"

That is the moment your AI notetaker policy either exists or it doesn't\.

An AI notetaker policy is a written framework that governs which meetings can use AI recording tools, which tools are approved, how consent is obtained from participants, how the resulting transcripts are stored and deleted, and what happens when a client objects\.  Engineering firms without a written policy leave consent law, NDA compliance, and legal discoverability entirely unmanaged\.

The legal risk has crystallized\.  Active class action litigation was filed in July 2026 against Granola, joining pending suits against Otter\.ai and Fireflies\.ai[1](#ref-1)\.  As Mayer Brown noted in June 2026, risk arises "not from exceptional misuse but from ordinary deployment in environments where governance has failed to keep pace with technological capability\."[2](#ref-2)

This article gives you four things: a tiered meeting classification framework built for engineering firm realities, a vendor comparison by data practice, a seven\-component policy checklist, and a protocol for when a client says no\.

AI notetakers are useful for engineering firms— they cut note\-taking overhead, create searchable meeting records, and let principals stay in the conversation\.  A clear policy is what makes the tool safe to deploy consistently\.  Before building that framework, it helps to understand the three risks the policy is designed to manage\.

## Three Risks a Policy Actually Solves

An AI notetaker policy solves three specific problems: it keeps your firm compliant with recording consent laws, it prevents inadvertent breach of client non\-disclosure agreements, and it gives you control over what becomes a discoverable record in litigation\.

**Consent law compliance\.**  Federal law requires at least one party to a conversation to consent to recording[3](#ref-3)\.  But eleven states require all\-party consent— meaning every participant must agree before you record: California, Connecticut, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, New Hampshire, Pennsylvania, and Washington[3](#ref-3)\.  For cross\-border meetings, the approach most corporate legal teams recommend is to apply the most restrictive participating state's standard— a call between Texas and California is all\-party consent territory[3](#ref-3)\.

**NDA breach risk\.**  Most AI notetakers route meeting audio to vendor cloud servers for processing[4](#ref-4)\.  Under many engagement non\-disclosure agreements \(NDAs\), routing audio to a third\-party vendor's servers may constitute third\-party data sharing restricted by the confidentiality provisions\.  As Bennett Jones LLP put it in July 2025: "If the AI notetaking tool is deemed a third party under the terms of a non\-disclosure agreement, its attendance and use at a virtual meeting may be a breach of the confidentiality obligations imposed by the NDA\."[5](#ref-5)  This is not a theoretical edge case— it's the legal basis for active litigation across the industry[1](#ref-1)\.  For firms thinking about [building an AI governance strategy](/blog/ai-governance-strategy), the NDA question has to be answered before the tool gets deployed\.

**Legal discoverability\.**  AI\-generated transcripts become discoverable records in litigation\.  Lockton identifies transcript accuracy errors— misidentifications, hallucinations, missing context— as a primary risk because participants often fail to review and correct notes, making errors permanent[6](#ref-6)\.  An unreviewed AI summary of an OAC meeting isn't just inaccurate— it becomes discoverable in litigation, with no corrected version to point to[6](#ref-6)\.

Knowing the risks is step one\.  Knowing which meetings carry which risks is the decision that makes a policy functional— and this is where most generic policy guides fall short for engineering firms\.

## A Meeting Classification Framework for Engineering Firms

Not all meetings carry equal legal weight, and an effective AI notetaker policy reflects that\.  Engineering firms should classify meetings into four categories— internal team meetings, client discovery and scoping calls, OAC and contract administration meetings, and regulated or public\-sector project meetings— each with different consent requirements, documentation protocols, and AI tool restrictions\.

```html-table
<table><thead><tr><th>Meeting Type</th><th>Risk Level</th><th>Consent Requirement</th><th>Policy Action</th></tr></thead><tbody><tr><td>Internal team meetings</td><td>Low</td><td>Internal consent only</td><td>Approved enterprise tools with vendor vetting</td></tr><tr><td>Client discovery/scoping calls</td><td>Medium-High</td><td>Client consent before deployment</td><td>Written + verbal acknowledgment</td></tr><tr><td>OAC/contract administration meetings</td><td>Highest</td><td>Client consent + human review required</td><td>AI summary reviewed and adopted before it becomes record</td></tr><tr><td>Regulated/public-sector project meetings</td><td>Variable</td><td>Check client policy first</td><td>May prohibit AI tools entirely</td></tr></tbody></table>
```

**Internal team meetings** carry the lowest stakes\.  Consent is internal, and the primary concern is vendor data training practices and accurate speaker attribution\.  Approved enterprise\-tier tools are appropriate here— but personal or free\-tier accounts should not join any meeting where client information is discussed\.

**Client discovery and scoping calls** typically operate under active NDAs\.  The AI notetaker is a potential third party under those agreements\.  Best practice: obtain verbal and written acknowledgment from the client before any recording tool joins\.

**OAC and contract administration meetings** are a distinct category\.

> OAC meeting minutes are essential, administratively and legally— reviewed by arbitrators and mediators\.[7](#ref-7)

This is not informal documentation\.  An AI\-generated summary that no one reviewed and adopted becomes discoverable in litigation, with no corrected version to point to\.  Your policy must specify who reviews the AI\-generated summary, who corrects errors, and who formally adopts it before it enters the construction administration record\.  The AI summary is a starting point— not the record\.

**Regulated and public\-sector project meetings** may prohibit AI recording tools outright\.  Some project owners have already implemented policies barring AI notetakers from project calls[8](#ref-8)\.  Check client policy proactively for every new engagement— especially municipal, state, and federal projects\.

For firms thinking about [how to build an AI culture across your firm](/blog/building-ai-culture), the lesson here is the same one that applies everywhere: tools that work inside your firm have to be calibrated for the outside\-facing work\.

Meeting classification tells you where the risk lives\.  But the specific tool you use changes the exposure within each category— because not all AI notetakers handle your data the same way\.

## What Your AI Notetaker Does With Your Meeting Data

For engineering firms, the more important vendor question isn't which AI notetaker produces the best summaries\.  It's what the vendor does with your meeting audio after the call ends\.  Training data policies differ materially across the major tools, and that difference determines your firm's NDA exposure\.

Most AI notetakers route conversations to vendor cloud servers, where they may be retained, analyzed, used to train AI models, or shared with affiliates[4](#ref-4)\.  That cloud routing is what triggers the NDA third\-party data sharing analysis\.

```html-table
<table><thead><tr><th>Tool</th><th>Data Training Practice</th><th>Enterprise Controls</th><th>Risk Rating for NDA-Governed Meetings</th></tr></thead><tbody><tr><td>Fireflies.ai</td><td>States no training on customer data; bars subprocessors by contract<sup><a href="#ref-9" class="footnote-ref">9</a></sup></td><td>SOC 2 Type II available</td><td>Lower (verify current ToS)</td></tr><tr><td>Fathom</td><td>Vendor-stated no training on customer data</td><td>Enterprise tier available</td><td>Lower (verify current ToS)</td></tr><tr><td>Otter.ai</td><td>Uses de-identified recordings with opt-in consent<sup><a href="#ref-10" class="footnote-ref">10</a></sup></td><td>Enterprise tier available</td><td>Medium</td></tr><tr><td>Granola</td><td>Subject of active class action alleging default training on captured communications<sup><a href="#ref-1" class="footnote-ref">1</a></sup></td><td>Unclear</td><td>High</td></tr><tr><td>Zoom AI Companion (Zoom) / MS Copilot (Microsoft)</td><td>Depends on enterprise agreement</td><td>Check your enterprise contract</td><td>Varies by agreement</td></tr></tbody></table>
```

In July 2026, *Chamberlain v\.  Granola, Inc\.* \(No\. 3:26\-cv\-07926, N\.D\.  Cal\.\) was filed, alleging that Granola syncs invisibly with calendar applications and captures meeting communications for AI model training by default— without announcing itself as a bot to other participants[1](#ref-1)\.  The case joins pending litigation against Otter\.ai and Fireflies\.ai, marking an industry\-wide challenge[1](#ref-1)\.

And even when vendors promise enterprise\-grade privacy agreements, what actually happens to your meeting data inside their AI training pipeline remains a black box\.  For an engineering firm with active client NDAs, "probably fine" is not a defensible policy position\.

For vendor due diligence, seek: a full SOC 2 Type II audit report, a signed or standardized Data Processing Agreement, a named LLM subprocessor list, and a contractual prohibition on training models on customer data[11](#ref-11)\.

The vendor you choose is a policy decision, not just a procurement decision\.  The policy itself has seven specific areas to cover\.

## What a Complete AI Notetaker Policy Covers

A complete AI notetaker policy for an engineering firm covers seven areas: approved tools, consent and disclosure procedures, restricted meeting types, data retention rules, sensitive information handling, distribution and sharing controls, and enforcement and audit ownership\.[12](#ref-12)

1. **Approved tools list\.** Name one or two vetted vendors with confirmed enterprise controls\.  No personal or free\-tier accounts for client meetings— period\.
2. **Consent and disclosure procedures\.** A standard line in calendar invites stating the meeting may be recorded and summarized by an AI tool, verbal acknowledgment at the meeting start, and on\-screen notification where available[13](#ref-13)\.  Cross\-border meetings apply the most restrictive state standard\.
3. **Restricted meeting types\.** By category from your meeting classification: which meetings require prior client consent, which require advance written agreement, which are excluded entirely\.  As Fellow\.ai notes, "a verbatim record can chill candid deliberation, create discovery exposure, or risk privilege waiver\."[14](#ref-14)
4. **Data retention rules\.** Raw recordings get shorter retention— they're higher sensitivity\.  AI\-generated summaries get longer retention as institutional memory\.  OAC summary retention is tied to contract close\-out, not an arbitrary 90\-day default\.  In practice: a 30\-day raw recording limit and 7\-year summary retention for construction administration projects gives you institutional memory without leaving sensitive audio sitting on a vendor server for years\.
5. **Sensitive information handling\.** A protocol for pausing or redacting capture when privileged, confidential, or NDA\-governed topics emerge mid\-meeting\.  Name who is responsible for invoking it\.
6. **Distribution and sharing controls\.** Who can access transcripts\.  No external sharing without review\.  A named person owns the summary review process for each meeting type\.
7. **Enforcement and audit ownership\.** A named owner— operations, IT, or practice lead\.  Annual review scheduled in advance\.  A clear procedure for reporting policy violations\.

Easy deployment and sound governance are two different standards\.  Your team needs to know what's approved, when it applies, and who's accountable\.

## When a Client Refuses the Bot

When a client says no to an AI notetaker in a meeting, the right response is simple: respect it immediately, turn off the tool without pressure, and document the decision in the meeting record\.  No explanation, no negotiation, no "but we just use it for notes\."

The four\-step in\-meeting protocol:

1. Acknowledge the request without argument\.
2. Turn off the AI tool— visibly, in the meeting, so the client sees it happen\.
3. Assign a human note\-taker for the remainder of the meeting\.
4. Note the client's refusal in the meeting record and flag the engagement for future setup\.

After the meeting, update engagement records to reflect this client's AI tool restrictions\.  Build it into how your team sets up calls for that project going forward\.

The better approach is proactive\.  Update your standard engagement letter templates to include a single clause acknowledging that your firm may use AI\-assisted meeting tools for documentation unless the client requests otherwise in writing[5](#ref-5)\.  This shifts the conversation from reactive to proactive and eliminates most in\-meeting surprises\.

Some project owners have already formalized this on their side, with written policies prohibiting AI recording tools from project meetings entirely[8](#ref-8)\.  Check client policy for every new engagement— especially public\-sector and large owner clients— before any capture tool joins the first call\.

## Three Actions to Start

Most firms need to close the same three gaps\.

1. **Audit current tool use\.** Survey your team\.  What AI meeting tools are individuals using on personal accounts?  Are free\-tier accounts active on client calls?  Identify the tools currently creating exposure— before the governance decision is made, the exposure is already happening\.
2. **Update engagement letter templates\.** Add one clause: "Firm may use AI\-assisted meeting tools for documentation purposes unless client requests otherwise in writing\."  This creates the proactive consent framework Bennett Jones recommends[5](#ref-5) and moves the conversation out of a live client meeting\.
3. **Write the one\-page policy\.** Use the meeting classification framework above\.  Restrict the categories that need restriction\.  Name a policy owner\.  Schedule an annual review\.

Most firms don't need a 20\-page policy document\.  They need three clear decisions committed to writing: which tools are approved, which meetings require client consent, and who owns the review process\.  The notetaker tool isn't the problem— the missing decision is\.

If getting from discussion to written policy keeps getting deprioritized, an [AI governance for engineering firms](/services/ai-strategy/) partner can help your firm close this in a single working session\.  [Dan Cumberland Labs](https://dancumberlandlabs.com) works with engineering and professional services firms on exactly these governance decisions— part of a [fractional AI leadership](/blog/what-is-a-fractional-ai-officer) model that covers both the policy work and the [broader AI implementation framework](/services/ai-implementation/)\.

The policy your firm writes this week is the answer ready when the next client asks: "Who is that in the meeting?"

## FAQ

### What is an AI notetaker policy?

An AI notetaker policy is a written organizational policy governing which meetings may use AI recording tools, which tools are approved, how participant consent is obtained, how meeting data is stored and deleted, and which meeting types are restricted or excluded\.[12](#ref-12)  It protects engineering firms from consent law violations, inadvertent NDA breaches, and unreviewed discoverable records that can complicate construction administration and litigation\.

### Do I need consent to use an AI notetaker on a client call?

Yes\.  Federal law requires at least one party to the conversation to consent to recording[3](#ref-3); eleven states require all\-party consent: California, Connecticut, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, New Hampshire, Pennsylvania, and Washington[3](#ref-3)\.  For cross\-border meetings, apply the most restrictive participating state's standard[3](#ref-3)\.  The safest approach for any client call is to obtain explicit consent from all participants before the tool joins\.

### Can an AI notetaker breach a client NDA?

Potentially\.  If the tool routes audio to a vendor's cloud server— which most AI notetakers do by default[4](#ref-4)— it may constitute third\-party data sharing restricted by the NDA's confidentiality provisions\.  As Bennett Jones LLP confirmed, if the tool is deemed a third party under the NDA's terms, its use at a virtual meeting may breach those obligations[5](#ref-5)\.  Review active NDA language and obtain client consent before using any AI meeting tool on a client call\.

### What should I do if a client refuses an AI notetaker in a meeting?

Respect the refusal immediately, turn off the tool visibly, and continue with a human note\-taker\.  Don't pressure the client or explain further\.  After the meeting, note the refusal in the engagement record and update your engagement letter templates to address AI tools proactively going forward\.

### Which AI notetakers are safest for client calls?

Tools with explicit no\-training policies on customer data, signed Data Processing Agreements, named subprocessor lists, and SOC 2 Type II certification reduce risk[11](#ref-11)\.  Fireflies\.ai states it does not train on customer data and bars subprocessors by contract[9](#ref-9); Otter\.ai uses de\-identified recordings with opt\-in consent[10](#ref-10); Granola is the subject of active class action litigation alleging default training on captured meeting communications as of July 2026[1](#ref-1)\.  Verify current vendor terms before any deployment decision— these policies change\.

## References

1. Barnes & Thornburg LLP, "What the Granola Class Action Means for Companies Building and Deploying Conversation Capture Tools" \(2026\)— [https://btlaw\.com/en/insights/alerts/2026/what\-the\-granola\-class\-action\-means\-for\-companies\-building\-and\-deploying\-conversation\-capture\-tools](https://btlaw.com/en/insights/alerts/2026/what-the-granola-class-action-means-for-companies-building-and-deploying-conversation-capture-tools)
2. Mayer Brown LLP, "AI Notetakers: Productivity Tool or Emerging Legal Risk?" \(June 2026\)— [https://www\.mayerbrown\.com/en/insights/publications/2026/06/ai\-notetakers\-productivity\-tool\-or\-emerging\-legal\-risk](https://www.mayerbrown.com/en/insights/publications/2026/06/ai-notetakers-productivity-tool-or-emerging-legal-risk)
3. Circleback\.ai, "Recording Consent for AI Meeting Notes" \(2025\)— [https://circleback\.ai/blog/recording\-consent\-for\-ai\-meeting\-notes](https://circleback.ai/blog/recording-consent-for-ai-meeting-notes)
4. American Bar Association, "AI, You, and Confidentiality Risks: Meeting Transcription/Note\-Taking Software" \(September 2025\)— [https://www\.americanbar\.org/groups/gpsolo/resources/ereport/2025\-september/ai\-you\-confidentiality\-risks\-meeting\-transcription\-note\-taking\-software/](https://www.americanbar.org/groups/gpsolo/resources/ereport/2025-september/ai-you-confidentiality-risks-meeting-transcription-note-taking-software/)
5. Bennett Jones LLP, "AI Notetaking in the Legal and Business Context" \(July 2025\)— [https://www\.bennettjones\.com/Insights/Blogs/AI\-Notetaking\-in\-the\-Legal\-and\-Business\-Context](https://www.bennettjones.com/Insights/Blogs/AI-Notetaking-in-the-Legal-and-Business-Context)
6. Lockton, "AI Notetaking and Transcription: Risk Management Considerations and Best Practices" \(2025\)— [https://global\.lockton\.com/gb/en/news\-insights/ai\-notetaking\-and\-transcription\-risk\-management\-considerations\-and\-best](https://global.lockton.com/gb/en/news-insights/ai-notetaking-and-transcription-risk-management-considerations-and-best)
7. Cogram, "The OAC Meeting: A Complete Guide and Agenda Template" \(2025\)— [https://cogram\.com/blog/oac\-meeting](https://cogram.com/blog/oac-meeting)
8. Cogram, "Granola for Architects: AI Meeting Notes for Construction Projects" \(2025\)— [https://cogram\.com/guides/granola\-for\-architects](https://cogram.com/guides/granola-for-architects)
9. getvoibe\.com, "Is Fireflies Safe?" \(2025\)— [https://www\.getvoibe\.com/resources/is\-fireflies\-safe/](https://www.getvoibe.com/resources/is-fireflies-safe/)
10. buildbetter\.ai, "Do They Own Your Data? Otter\.ai Privacy Policy Reviewed" \(2025\)— [https://blog\.buildbetter\.ai/do\-they\-own\-your\-data\-otter\-ai\-privacy\-policy\-reviewed/](https://blog.buildbetter.ai/do-they-own-your-data-otter-ai-privacy-policy-reviewed/)
11. Spinach\.ai, "Enterprise AI Meeting Security: IT Buyer's Guide" \(2025\)— [https://www\.spinach\.ai/blog/enterprise\-ai\-meeting\-security\-it\-buyers\-guide](https://www.spinach.ai/blog/enterprise-ai-meeting-security-it-buyers-guide)
12. Fellow\.ai, "AI Meeting Assistant Usage Policy: A Framework for IT, Operations, and Compliance Leaders in Regulated Industries" \(2025\)— [https://fellow\.ai/blog/ai\-meeting\-assistant\-policy\-template\-for\-regulated\-industries/](https://fellow.ai/blog/ai-meeting-assistant-policy-template-for-regulated-industries/)
13. Polsinelli PC, "The Hidden Risks of AI Notetakers: What Organizations Need to Evaluate Before Deployment" \(2025\)— [https://www\.polsinelli\.com/publications/hidden\-risks\-ai\-notetakers\-organizations\-need\-to\-evaluate](https://www.polsinelli.com/publications/hidden-risks-ai-notetakers-organizations-need-to-evaluate)
14. Fellow\.ai, "AI Meeting Assistant Usage Policy: A Framework for IT, Operations, and Compliance Leaders in Regulated Industries" \(2025\)— [https://fellow\.ai/blog/ai\-meeting\-assistant\-policy\-template\-for\-regulated\-industries/](https://fellow.ai/blog/ai-meeting-assistant-policy-template-for-regulated-industries/)


---

**How we made this article:** We use AI in our research and writing so our small team can share more of what we learn. We verify the sources and take responsibility for every article we publish. [Read how we use AI.](https://dancumberlandlabs.com/how-we-use-ai/)

---

## About the author

**Dan Cumberland** — Founder, Dan Cumberland Labs

Dan Cumberland helps engineering and construction firms see where they stand with AI and decide what to build first.  He created Pacemark, the AI maturity model used in every Dan Cumberland Labs engagement, built from published research on more than 400 named firms and organizations.

- Take the assessment: https://pacemark.ai/signal/assessment/?track=aec&utm_source=dcl-site&utm_medium=link&utm_campaign=pacemark-assessment
- Book a call: https://book.dancumberland.com/ai-strategy

---

Source: https://dancumberlandlabs.com/blog/ai-notetaker-policy/