AI notetakers in broker meetings: consent, privacy and what to check first

What the tool is actually doing in the room

An AI notetaker captures the audio of a meeting, transcribes it, and produces a summary. Some join a video call as a visible participant. Others run on your device and pick up whatever the microphone hears, which means they also work in a face to face meeting in your office. That second category is the one that raises the harder questions, because a client sitting across the desk from you has no on screen indicator telling them anything is running.

The appeal for a broker is obvious. A fact find that half writes itself. A file note you did not have to type at eight in the evening. A record of what the client actually said about the investment property they are thinking about, rather than what you remember three weeks later.

The input is the part that carries the obligation. A broker meeting is a conversation in which someone tells you their income, their debts, their marital position, and often more than that. Serviceability conversations regularly touch on health, on a separation, on a business that is not going well. The tool is collecting all of it and sending it somewhere.

Consent is a state question, and the published summaries disagree

There is no single Australian law on recording a conversation. New South Wales has the Surveillance Devices Act 2007. Victoria has the Surveillance Devices Act 1999. Queensland still runs on the Invasion of Privacy Act 1971. Western Australia has the Surveillance Devices Act 1998, South Australia the Surveillance Devices Act 2016, Tasmania the Listening Devices Act 1991, the Australian Capital Territory the Listening Devices Act 1992, and the Northern Territory the Surveillance Devices Act 2007.

The drafting differs in a way that changes the outcome. Section 6 of the Victorian Act prohibits knowingly using a listening device to record a private conversation to which the person is not a party, without the express or implied consent of each party to the conversation. Queensland's section 43 works the same way, with the offence not applying where the person using the device is a party to the conversation. Section 7 of the New South Wales Act is built the other way round. It reaches a principal party as well, and the relevant carve out in section 7(3)(b) applies where a principal party consents and the recording is either reasonably necessary for the protection of that party's lawful interests, or is not made for the purpose of communicating it to people who were not parties.

You will find plenty of state by state tables published online. They do not agree with each other. A June 2025 SmartCompany piece groups Queensland and Victoria as one party jurisdictions and puts the Northern Territory in the all party group. Other summaries put the Northern Territory alongside Queensland. That disagreement is worth noticing rather than resolving in a blog post.

Finance OS is a publication, not a law firm, and this is not legal advice. If your business intends to record client meetings, the position you act on should come from your licensee's compliance team or your own lawyer, and it should be built on the Act that applies where the client is, not where your office is.

Recording it and sharing it are two different permissions

Even where a participant may lawfully record, the same Acts generally restrict what happens next. Victoria's section 11 restricts communicating or publishing a record of a private conversation. Queensland's sections 44 and 45 do similar work, with exceptions including the express or implied consent of the other parties.

So the question splits in two. May you make the recording, and may you then pass it to someone else. For an AI notetaker the second question is live from the first second, because passing the audio to a third party for processing is the whole mechanism. The recording leaves the room before the meeting ends.

Then the workflow keeps disclosing. The transcript lands in your CRM. A summary goes to the client by email. A copy goes to your processor, or a referral partner, or an aggregator platform. Each of those is a further step, and each one is easier to justify if you told the client at the start what was going to happen.

The Privacy Act layer sits on top of all of it

The clearest regulator statement available is the OAIC's guidance on privacy and the use of commercially available AI products, published on 21 October 2024 and updated on 17 January 2025. Four points in it matter for a broker.

First, where an AI system generates or infers personal information, that is a collection and it has to satisfy Australian Privacy Principle 3. Second, consent cannot be implied merely because an individual was notified. Third, organisations need to consider where the servers are and whether personal information could be disclosed outside Australia, which brings APP 8 into play for almost every cloud based notetaker. Fourth, the OAIC states as a matter of best practice that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools.

That last point has teeth in a broking context, because sensitive information as the Privacy Act defines it turns up in ordinary meetings. Health information comes up when a client explains a gap in income. Sensitive information carries a higher consent bar than ordinary personal information does.

There is also now a private route to a remedy. A statutory tort for serious invasions of privacy commenced on 10 June 2025 under the Privacy and Other Legislation Amendment Act 2024. It covers intrusion upon seclusion, which the OAIC describes as including watching or eavesdropping on private activities, as well as misuse of personal information, where the person had a reasonable expectation of privacy. Consent is relevant to the available defences. That is another reason to have the client's yes recorded rather than assumed.

What ASIC actually expects in the file

Recording a meeting is not inherently a compliance problem. ASIC's Regulatory Guide 273, which sets out what it looks for on the best interests duty in Part 3-5A of the National Consumer Credit Protection Act 2009, lists the forms your records may take at RG 273.167. Audio recordings are on that list, next to file notes, records of conversations, correspondence, and the outputs of comparison tools.

The paragraph to read before you buy anything is RG 273.169. ASIC says taking notes and keeping records throughout the process, contemporaneously, may help you accurately capture your thinking and reasoning at each relevant point in time, and that just drafting notes and creating records at the end of the process may not be as effective. An AI summary is by definition an end of process artefact. It is not disqualified by that, but it is not the same thing as your reasoning as it formed.

RG 273.165 lists what ASIC generally expects the records to include, and item (g) is the options and ultimate recommendation you gave and the reasons why, including a detailed description of your decision making process. A transcript captures what was said. It does not capture why you ruled out three lenders. That part is still yours to write.

Retention is the other thing the tool now decides for you. RG 273.168 says how long records should be kept may vary depending on factors such as the loan term, the interest only period, and whether the consumer refinances, and warns that keeping records for a short period puts you at risk of being unable to demonstrate compliance. If your notetaker purges deleted items after thirty days by default, that default is now a compliance setting.

What the industry bodies have said so far

The MFAA published a discussion paper in July 2024 titled Embracing the future: Towards the safe and ethical use of AI for the mortgage and finance broking industry. The association describes it as informed by roundtables held nationally with its members, and as dealing with privacy, bias, accountability and the ethical implications of AI use, with practical guidance for adopting AI safely.

The FBAA has taken a firmer line on data specifically. Reporting in March 2026 described the association advising members not to upload client or company personal data into public AI systems, echoing the OAIC's warning that once personal information has been input into AI systems it will be very difficult to track or control how it is used. FBAA interim chief executive Peter White was quoted saying he would not be rushing to use AI for legal or compliance issues.

The same reporting, drawn from an FBAA member poll, put 39 per cent of brokers at the point of calling AI a core part of their business or actively integrating it across multiple areas, with a clear age split. Fifty four per cent of brokers under 50 reported using AI tools at work against 27 per cent of those over 50. Twelve per cent reported a cyber security incident in the past year. Adoption is well ahead of policy in most broking businesses.

The vendor questions worth asking before you buy

Where is the audio and the transcript stored, and in which country. This is the APP 8 question and most vendors answer it vaguely. Get it in writing. Otter, as one example, publishes that it uses AWS storage with server side encryption and AES-256, without specifying a geographic region on its security page.

Is customer data used to train models, and can you switch that off. Read the current terms rather than a comparison article. Otter publishes that it de-identifies user data before training its own models, and separately that no customer data will be used to train or improve its AI service providers' models. Those are two different statements and both are worth reading in full.

Who carries the consent obligation. In Otter's terms of service, the customer is solely responsible for providing any notices to, and obtaining consent from, individuals in connection with any recordings, as required under applicable law. That allocation is common across the category. It means the legal exposure sits with you, not the tool.

Does the tool announce itself to other participants, and on which plan. Some products put in room notification behind higher tiers. If your consent process depends on a feature you are not paying for, it is not a consent process.

What are the retention and deletion defaults, and can an administrator export and delete on request. You will need that capability for Privacy Act access and correction requests, and for the retention judgement RG 273.168 asks you to make.

Finally, ask your aggregator or licensee whether there is an approved list. That is often the fastest answer available and it is the one that will matter in an audit.

A practice that survives a file review

Say it before you start, not after. Name the tool out loud. Say what it records, where the recording goes, how long you will keep it, and that a summary will end up on the file. Ask for a yes, and note the yes. If the client says no, turn it off and take notes the old way, and note that too.

Put the same disclosure in writing before the meeting, in your credit guide and your privacy collection notice, so nothing about it is a surprise in the room. A client who has already read it is far more likely to agree, and a written notice is easier to produce later than a memory of what you said.

Then read every summary before it becomes a file note. Transcription is good and getting better, and it still mishears a figure. A summary of a serviceability conversation that transposes an income is a worse record than no record at all, because it is a confident wrong one with your name on it.