AI Notetakers in BC: Who You Must Ask Before Recording

A bot called "Notetaker" slides into your Teams call. Someone starts the recording. Ten seconds later a transcript is being written, a summary is queued up, and nobody in the meeting has actually been asked anything.

That is a normal Tuesday for a lot of small teams in Burnaby and New Westminster right now. It is also the moment two separate legal questions open up, and most people only think about the first one.

Question one: is recording the call a crime?

Section 184(1) of the Criminal Code says that "every person who, by means of any electro-magnetic, acoustic, mechanical or other device, knowingly intercepts a private communication" is guilty of an indictable offence carrying up to five years, or of a summary offence (Criminal Code, s. 184). The next subsection is the one everyone quotes. Section 184(2)(a) says the offence "does not apply to a person who has the consent to intercept, express or implied, of the originator of the private communication or of the person intended by the originator thereof to receive it."

That is Canada's one party consent rule. If you are in the meeting and you agree to the recording, you are outside the offence.

It is also the lowest bar in this entire conversation. Not being a crime is not the same as being allowed. And if you send an AI notetaker into a meeting you do not personally attend, you are relying on somebody else's consent rather than your own. That is a good moment to get legal advice instead of a good moment to improvise.

Question two: BC PIPA, which is the one that actually bites

Private sector organizations in BC, including sole practitioners and tiny clinics, fall under the Personal Information Protection Act. Three sections matter the day you turn on an AI notetaker.

Section 10(1) says that on or before collecting personal information from an individual, an organization must disclose "the purposes for the collection of the information," verbally or in writing. Section 7(2) says you "must not, as a condition of supplying a product or service, require an individual to consent to the collection, use or disclosure of personal information beyond what is necessary to provide the product or service." Section 9(1) lets a person withdraw consent at any time on reasonable notice (PIPA, SBC 2003, c. 63).

Read together, that means the recording banner is not a consent process. Telling people afterward is not notice. And "consent or you cannot have the meeting" is not a free choice.

What BC's privacy commissioner actually said

On January 28, 2026 the Office of the Information and Privacy Commissioner for BC published PIPA and AI scribes: best practices for healthcare organizations in BC, the clearest Canadian guidance yet on tools that listen to a conversation and write it up.

Be honest about the scope: it is written for healthcare organizations under PIPA, it does not cover public bodies (they run under FIPPA, and the OIPC says separate guidance is coming), and guidance is not law. But the sections of PIPA it interprets apply to every organization in the province, and the reasoning travels.

The headline finding is that implied consent does not cut it. The OIPC says organizations "must get express consent from patients, rather than implicit consent," because the technology is novel and complex, because capabilities vary wildly from tool to tool, and because of the sensitivity of what gets captured. It will not be obvious to a reasonable person what the tool collects or where it goes. If someone else is in the room whose voice will be picked up, express consent should be obtained from them too. And if a person says no, you need to be ready to take notes another way.

Two more lines from that guidance are worth taping to your monitor. First: "An organization cannot avoid its obligations under PIPA by contracting with another organization to store or use personal information on its behalf." Second: "there is no accreditation program in Canada that assesses or approves companies' claims of legal compliance." A vendor badge that says PIPEDA or HIPAA is not a PIPA answer.

The OIPC is also blunt about the phrase "de-identified." PIPA has no such category. Information is either personal information or it is not, and voice carries accent, pitch, cadence and other biometric detail that is very hard to strip out.

None of this is unique to BC. The federal, provincial and territorial privacy regulators' joint Principles for responsible, trustworthy and privacy-protective generative AI technologies, published December 7, 2023, ask organizations to make sure consent is "valid and meaningful" and to tell people what, how, when and why their personal information is collected.

Ask the vendor this before the first meeting

The OIPC guidance includes a list of questions for vendors. These are the ones that change the answer for a small business:

• Will any personal information, or "de-identified" information derived from it, be used for secondary purposes such as training the AI model?
• Will anything be disclosed or sold to third parties?
• Is data processed or stored outside Canada, and if so, where?
• Are voice recordings kept, or deleted as soon as the transcript exists? Is retention adjustable?
• Is the vendor contractually required to tell you about software updates that change how personal information is handled, and to report breaches on their end?
• What happens to your data if the contract ends, or the company is sold or goes bankrupt?

Make the platform do the asking

Consent is easier to run when the software enforces it. In Microsoft Teams, admins can turn on a policy that requires participant agreement for recording and transcription. Once recording or transcription starts, other participants are muted with cameras off, and anyone who tries to unmute, turn on video or share is asked to answer Yes or No to being included. Answer No and you get a view only experience. Each person's choice lands in the attendance report and in the Purview audit logs. Note the default: Microsoft's documentation, last updated May 2026, states that Off is the default value, meaning participants are not asked for consent unless an admin turns the policy on (Microsoft Learn).

Check your own stack rather than assuming. Settings and feature names change quickly.

Your own staff are on that recording

Under PIPA, employee personal information can be collected without consent when it is reasonable for establishing, managing or terminating the employment relationship and the employee has been given notice beforehand. But the OIPC points out that an AI notetaker also picks up things that are not employee personal information at all, such as an offhand comment about somebody's family or vacation, plus the biometric detail in their voice. Its conclusion: "the best practice is to obtain employee consent prior to the use of an AI scribe."

Where this does not apply

Sometimes the right answer is no recording at all.

Accuracy is the first reason. The OIPC lists hallucinations, omissions, misinterpretations and misspellings, and biases as known failure modes, and notes that background noise, complex conversations and variation in accents push error rates up. Its warning is direct: even at 99% accuracy, "a 1% error rate may still be catastrophic." Human review is not optional, and the guidance flags automation bias, the tendency to stop checking outputs once a tool feels reliable, plus model drift over time.

Volume is the second reason. A 20 minute internal huddle does not need a transcript, a summary and a retention policy. Pen and paper collects less, and the OIPC explicitly contrasts AI capture with traditional notetaking on exactly that point.

And plenty of firms are fine without it. Statistics Canada reported on June 11, 2026 that 19.2% of businesses used AI to produce goods or deliver services in the prior 12 months, while 41.0% of businesses with 5 to 19 employees said AI is simply not relevant to their business (Statistics Canada). Waiting is a legitimate position.

This post is general information for Metro Vancouver businesses, not legal advice. If your meetings involve health, legal or financial details, talk to a lawyer and to your regulator before you deploy anything.

Sources

• Government of Canada, Justice Laws Website. *Criminal Code (RSC, 1985, c. C-46), section 184.* https://laws-lois.justice.gc.ca/eng/acts/c-46/section-184.html
• Province of British Columbia. *Personal Information Protection Act, SBC 2003, c. 63.* https://www.bclaws.gov.bc.ca/civix/document/id/complete/statreg/03063_01
• Office of the Information and Privacy Commissioner for British Columbia. *PIPA and AI scribes: best practices for healthcare organizations in BC*, January 2026. https://www.oipc.bc.ca/documents/guidance-documents/3082
• Canadian federal, provincial and territorial privacy regulators. *Principles for responsible, trustworthy and privacy-protective generative AI technologies*, December 7, 2023. https://www.priv.gc.ca/en/privacy-topics/technology/artificial-intelligence/gd_principles_ai/
• Microsoft. *Manage participant agreement for recording and transcription, Microsoft Teams*, updated May 2026. https://learn.microsoft.com/en-us/microsoftteams/participant-agreement-recording-transcription
• Statistics Canada. *Analysis on artificial intelligence use by businesses in Canada, second quarter of 2026*, June 11, 2026. https://www150.statcan.gc.ca/n1/pub/11-621-m/11-621-m2026010-eng.htm

Autana Solutions builds AI employees and automations for small and mid-sized businesses around Burnaby, New Westminster and Vancouver, and consent design is part of the build, not an afterthought. If you want a second pair of eyes on the notetaker already sitting in your calendar, book a free call with us and we will walk your setup end to end.