The recording posture, the consent script, and the retention schedule that survive NYC Bar 2025-6.

Conditionally — and only after compliance with NYC Bar Formal Op. 2025-6 (Dec. 22, 2025), which requires client notice and consent before recording, an independent review of the transcript or summary for accuracy, and an evaluation of where the data is stored, for how long, how it might surface in discovery, whether the tool trains on it, and whether deletion is available. [S01] Otter trains its proprietary AI on de-identified audio and on transcripts that may contain personal information [S10], so the consumer tier is unsafe for client confidences; only the Business / Enterprise tier under a separate enterprise agreement places the firm as data controller. Fireflies publishes a Zero Data Retention policy on meeting content for paid tiers, which gets closer to the NYC Bar 2025-6 standard. [S12]

NYC Bar 2025-6 holds that clients must be notified and their consent obtained whenever calls are being recorded by an AI system, that attorneys must safeguard records of client communications under Rule 1.6, that attorneys should independently review any AI-generated recording / transcript / summary, and that attorneys should evaluate the vendor's storage, retention, training, discovery, and deletion postures before using the tool. [S01] Where a client is the one running the AI recorder, the lawyer should advise the client of the loss-of-privilege risks and disclaim responsibility for unreviewed AI summaries. [S01]

Yes, when client confidences will be discussed. NYC Bar 2025-6 requires consent whenever an AI system records the call. [S01] Microsoft 365 Copilot's published documentation states that Copilot prompts and responses may be retained in the Microsoft 365 compliance substrate and are subject to the organization's Microsoft Purview retention policies, and may be discoverable through eDiscovery. [S11] The combination of Rule 1.6 [S02], Rule 1.4 [S03], and the eDiscovery exposure means the recording-and-summary decision is a client-communication and informed-consent matter, not an IT-default question.

Yes — and NYC Bar 2025-6 explicitly directs attorneys to consider how data might be retrievable through discovery before deploying an AI tool. [S01] Microsoft 365 Copilot prompts and responses are eDiscovery-retrievable through Microsoft Purview where retention is configured. [S11] A transcript stored on a vendor server is subpoenaable from the vendor as a third party where the underlying communication is not privileged or where privilege has been waived. The retention-and-litigation-hold pack on this page (Artifact 03) gives the matter-team the framework to limit this exposure.

There is no single answer. NYC Bar 2025-6 requires the attorney to consider where data will be stored and for how long, and whether there is a right to data deletion. [S01] Microsoft Copilot follows the firm's Purview retention policy [S11]; Fireflies publishes Zero Data Retention on meeting content [S12]; Granola deletes the recording after the transcription is created [S13]; Otter's retention is admin-configurable under the Business / Enterprise tier. [S10] The defensible firm posture is a matter-type retention schedule with a default purge horizon and a litigation-hold trigger — Artifact 03 on this page sets the schedule.

Yes, in the twelve states with all-party-consent statutes — California (Penal § 632, up to one year and $2,500 per violation [S05]), Florida (§ 934.03, third-degree felony [S06]), Washington (RCW 9.73.030 [S07]), Maryland (Cts. & Jud. Proc. § 10-402 [S08]), Illinois (720 ILCS 5/14-2 [S24]), Massachusetts (M.G.L. c. 272 § 99 [S25]), Pennsylvania (18 Pa.C.S. § 5703 [S26]), New Hampshire (RSA 570-A:2 [S27]), Delaware (11 Del. C. § 1335 [S28]), Connecticut (Conn. Gen. Stat. § 53a-189 / § 52-570d [S29]), Montana (Mont. Code § 45-8-213 [S30]), and Michigan (MCL § 750.539a–c [S31]). The federal Wiretap Act, 18 U.S.C. § 2511, permits one-party consent for non-color-of-law actors but does not preempt stricter state law. [S09] Artifact 05 on this page tracks the operative authority by state.

Not without consent in two-party-consent states, and not without notice in any state where you have a reasonable expectation that the call is private. NYC Bar 2025-6 affirms that attorneys must obtain consent before AI recording [S01], and the all-party-consent state criminal statutes apply equally to opposing counsel. [S05] [S06] [S07] The firm's posture on settlement and opposing-counsel calls is to ask, on the record at the start of the call, whether any AI recorder is in use, and to terminate the call or reset the meeting type if consent is not obtained. The decision matrix in Artifact 01 codifies that posture.

It depends on whether the summary was created in anticipation of litigation, whether the lawyer adopted and reviewed it, and whether it has been disclosed to the client or to the vendor in a way that waives the work-product protection. NYC Bar 2025-6 directs attorneys to independently review AI summaries [S01]; an unreviewed AI summary is exposed because the lawyer did not exercise the judgment work product protects. Where the AI vendor's privacy policy permits the vendor to retain, train on, or process the transcript, the firm may have created a discoverability vector that defeats the work-product privilege under the third-party disclosure rule. Artifact 03 on this page gives the privilege-log entry template for AI-summary work product.

Yes, where the inaccuracy is not detected and the inaccurate transcript is later relied on by the firm or by the client. NYC Bar 2025-6 directly requires attorneys to independently review any recording, transcript, or summary for accuracy. [S01] The verification duty under N.J. Sup. Ct. Preliminary Guidelines requires the lawyer to verify all AI-generated information used in pleadings, arguments, or evidence [S23], and the same verification logic applies to client-conversation transcripts that later become matter-file evidence. The firm's malpractice-defense posture is to keep both the AI artifact and the lawyer's verification record.

Yes. NYC Bar 2025-6 specifically recommends retainer provisions that address whether AI recordings will be deemed dispositive against the attorneys unless promptly provided to the firm. [S01] The five-clause language pack in Artifact 02 on this page provides the engagement-letter recording-consent provision, the in-meeting disclosure script, the post-meeting summary disclaimer, the transcript-retention disclosure, and the discovery-exposure acknowledgement. ABA Formal Op. 512 separately rejects boilerplate consent for AI use on confidences [S14], so the language must be specific to recording rather than absorbed into a generic AI clause.

Yes, in many configurations. A vendor that retains transcripts under its data-retention policy holds them as a third party not in privity with the attorney-client relationship; absent a contractual data-deletion regime, the transcript is subpoenable from the vendor. Microsoft Copilot's documentation states that Copilot prompts and responses are eDiscovery-retrievable through Purview [S11]; Otter's published retention is admin-configurable. [S10] The firm-side mitigation is to deploy only vendors with published Zero Data Retention policies (Fireflies [S12]) or admin-configured short-retention defaults, and to capture the vendor's contractual retention floor in the matter file.

NYC Bar 2025-6 places this squarely under Rule 1.6 — the attorneys must safeguard records of client communications [S01], and Rule 5.3 places supervisory responsibility on partners and managers for the conduct of nonlawyer assistants and third-party tools. [S04] A personal-tier tool that trains on inputs (Otter consumer tier trains on de-identified audio and transcripts [S10]) creates a confidentiality breach on first use. The firm's authorized-tools register, in Artifact 04, names the only tools associates may use and the specific tier configuration; off-register use is a written-policy violation that creates Rule 5.3(c) ratification exposure if the firm knows and fails to act.