Zoom, AI Companion and meeting information

Research date: 4 October 2026
Edition: First baseline report
Method: Review of Zoom’s public documentation. No signed-in business account was inspected and no controls were tested in a live account.

Summary

Zoom’s AI can turn meetings into searchable information and retained records. Optional connected features extend this into other meeting platforms and business apps.

  • By default: Saved meeting transcripts are documented as off by default. The report does not establish a universal default for summaries, meeting questions or personal notes. Automatic start can be configured.
  • Beyond the default: Meeting summaries, catch-up questions, smart recording, personal notes, uploaded-file assistance and Custom AI Companion.
  • Outside Zoom: Custom AI Companion can use business knowledge sources, perform tasks through connected apps and join Microsoft Teams or Google Meet meetings to transcribe or record them. Summaries can be emailed to external invitees.
  • Business exposure and learning: Processing can include speech, meeting chat and text extracted from shared screens. Participants’ notes and exported summaries can remain after the host stops AI or deletes meeting assets. Zoom publishes a commitment excluding customer communications content from its own and third-party model training.

The main exposure: Spoken information becomes a durable, searchable and transferable record. Your settings also do not determine what an external meeting host enables.

Business finding

A business can restrict Zoom’s optional AI features, but it must check several settings. Meeting summaries, meeting questions, saved transcripts, personal notes and connected apps need separate attention. The practical question is whether the business controls the meeting, the people using these features and the information that remains afterwards.

This report treats “hidden AI” as AI whose presence, access or consequences may be easy to overlook. It does not mean Zoom secretly activates every feature. A visible summary button can still leave a business unaware of the transcript, recipients or connected services involved.

Where is AI operating?

Meeting summaries use speech converted into text; optional inputs include meeting chat and text extracted from shared screens. Smart recording processes cloud recordings and transcripts. Other AI features include ZoomMate, an AI chat panel and assistance across Workplace products. Inputs can include connected sources and uploaded files. [1]

Meeting questions let participants ask about discussions that occurred while the feature was active, including decisions and action items. This can help someone catch up, but it also makes meeting content available through a question-and-answer interface.[4]

My Notes is a separate route for personal notes and transcription. Custom AI Companion can reference business knowledge collections, act through connected apps and join Microsoft Teams or Google Meet meetings to transcribe or record.[6][7]

For the business, a useful starting inventory is therefore broader than “Do we use Zoom meetings?” It should include which Zoom products employees use, who hosts their meetings, whether they use personal accounts, and which other apps are connected.

Who controls it?

Account owners and administrators can manage meeting-summary availability. The host and co-host control starting and stopping the summary during a meeting. An ordinary attendee does not have those same controls.[2][3]

Meeting-question settings can be managed at account, group and user levels. Administrators can lock them so users cannot change them.[4]

My Notes also has account, group and user controls. Importantly, Zoom documents a setting that can prevent participants from creating My Notes transcripts in meetings hosted by the business’s account. This is different from disabling the business’s own employees’ note-taking features.[6]

The consequence is straightforward: disabling a feature for your employees does not establish how another business runs a meeting it hosts. Before discussing sensitive information in an externally hosted meeting, ask the host which AI, transcription and recording features are active. If the host cannot offer the conditions your business needs, arrange another meeting or communication method.

What can the business switch off?

Meeting summaries

Zoom’s current guidance gives this administrator route: web portal → Admin Center → Settings → Zoom AI → Meeting → Meeting summary with AI. Disable the feature where appropriate. If keeping it available, review automatic start, automatic recipients and external sharing. Automatic start can begin when someone starts the meeting, before the host arrives.[2]

Meeting questions

The meeting-question guide describes Account Management → Account Settings → AI Companion → Meeting → Allow users to ask AI Companion questions during meetings. Disable and lock the setting if employees should not re-enable it. Review its separate automatic-start option.[4]

The published guides currently use different navigation labels. Look for the named setting in the actual account rather than assuming every account presents the same menu.

Saved transcripts

Use Admin Center → Settings → Meeting → In Meeting (Advanced) → Meeting transcript. Administrators can disable and lock this setting, or control automatic generation, retention and permissions. Zoom says saved meeting transcripts are not enabled by default, although administrators can configure them to be always on.[5]

Personal notes and connected actions

Use Admin Center → Settings → Notes → My Notes. Review feature availability, employee transcription, AI enhancement and participant transcription separately. Lock the required choices.[6]

For Custom AI Companion, use Admin Center → Settings → Zoom AI → Custom AI Companion and review each feature toggle. Restrict knowledge-source access, third-party actions and joining other platforms as appropriate.[7]

These controls establish choices for the named functions. They are not evidence of a universal “no AI anywhere in Zoom” switch. Inventory recording tools and other installed meeting apps separately; this report does not establish their behaviour from Zoom AI settings.

What information and actions can the business restrict?

Separate three decisions: what AI can process, who receives its output, and how long that output remains available.

For summaries, Zoom provides recipient choices ranging from host only to all invitees, including those outside the business. Administrators can restrict external sharing, send an authenticated link instead of summary text in email, and configure automatic deletion.[2]

For transcripts, review whether participants can view them during a meeting and who can save a copy to a computer. Retained transcripts can support later AI questions and document creation. Host access to view, delete and download them is itself configurable.[5]

For connected features, distinguish finding information from taking action. Custom AI Companion has separate controls for knowledge sources, custom agents and tasks in third-party apps.[7]

The business should identify the actual connected app, account, permissions and authorised actions before enabling it. This review does not establish the precise permissions or revocation effects of every connector. Request that detail for the connections your business uses.

Stopping AI during a meeting is also different from removing material already created. Zoom’s host controls offer deletion of associated summary and transcript assets, but exclude transcripts already completed through participants’ My Notes. Recipients can save and forward summaries outside Zoom.[3]

A practical business response is to stop the relevant feature before a sensitive discussion begins, limit recipients in advance, and treat exported or emailed copies as separate records. Do not assume changing a setting recalls those copies.

Can the business refuse use of its information for AI training?

Zoom states that customer communications content, including audio, video, chat, screen sharing and attachments, is not used to train its own or third-party AI models. It also prohibits third-party model providers from using customer data to improve their models. Its provider retention arrangements have limited trust-and-safety exceptions.[1]

This is a published commitment, rather than a separate training opt-out that the business must activate. It does not mean content is never processed, shared with a model provider or stored as a business record.

Zoom also documents optional feedback containing prompts, responses, screenshots and diagnostic information. Employees should review what they submit. Its summary-email provider, Twilio SendGrid, retains sampled email content for seven days for anti-fraud checks and troubleshooting, with US processing.[1]

The business should assess service delivery, saved records, feedback and training separately. A favourable answer about model training does not settle the other questions.

How can the business check that its choices worked?

These are proposed checks, not tests performed for this report:

  1. Record the subscription, administrator, employee groups and settings covered by the decision. Include personal accounts and externally hosted meetings in the inventory.
  2. Save the settings, reopen them and confirm any locks. Check an ordinary employee account as well as the administrator account.
  3. Run a harmless meeting. Check whether summaries, questions, transcripts and My Notes can start, including automatic start before the host arrives.
  4. Join as an external participant and check the participant permissions chosen by the business.
  5. If retaining AI summaries, use a fictional discussion to check the recipients, email format and resulting records. Confirm that an external address does not receive information when external sharing is restricted.
  6. Check transcript viewing and downloading separately. Verify retention and deletion using disposable test content and the configured retention period.
  7. Inspect each connected source and action permission. Test only harmless retrieval or reversible actions. Confirm what remains after a connection is removed rather than assuming historical material disappears.
  8. Record the outcome, unresolved questions and person responsible for fixing them.

Absence of a button is evidence about the interface. It does not independently prove that all provider processing has stopped. Ask Zoom for clarification where a required setting is unavailable or its effect is unclear.

What does the business lose, retain or need to replace?

Disabling the optional features discussed here removes their associated summaries, catch-up answers, enhanced notes or connected actions. It does not itself amount to cancelling the Zoom service. Confirm the remaining functions in the business’s subscription before changing a process.

A business can replace automated summaries with a named minute-taker, agreed action list and human review. If transcripts remain necessary, decide who needs them, how they will be checked, where they will be stored and when they will be deleted. A replacement tool needs its own assessment of processing, access and retention.

Where AI remains enabled, review its output before treating it as evidence of an agreement, an instruction to staff or a promise to a customer. A mistaken summary can cause work to proceed on something nobody agreed. A misassigned action can leave a real commitment unattended. Human review has a concrete purpose: compare the output with what participants actually decided before using it to direct the business.

Control assessment

Business requirement What this review establishes Remaining limit
Disable summaries and meeting questions Documented feature controls exist.[2][4] Check locks, groups and automatic start in the actual account.
Restrict saved transcripts Separate transcript controls cover retention and access.[5] Do not treat this as disabling every transcription route.
Restrict personal notes My Notes has employee and hosted-meeting participant controls.[6] Check both sets of permissions.
Limit sharing Summary recipients and transcript download permissions can be restricted.[2][5] Previously distributed copies need separate handling.
Restrict connected actions Custom AI Companion provides feature controls.[7] Exact connector permissions need an account-specific review.
Exclude communications content from model training Zoom publishes a no-training commitment.[1] Processing, feedback and record retention are separate.
Control externally hosted meetings Host authority governs relevant in-meeting functions.[3] Your own account settings do not establish the external host’s choices.

Official sources

  1. How Zoom AI features handle your data.
  2. Enabling or disabling meeting summary with AI.
  3. Using Meeting Summary with AI.
  4. Enabling or disabling meeting questions with AI Companion.
  5. Enabling or disabling meeting transcripts.
  6. Enabling or disabling the My Notes feature.
  7. Getting started with Custom AI Companion features.

Scope and continuing research

This is a baseline of published controls, not certification of a particular business account. It focuses on Zoom Workplace meeting information, notes and connected AI. It does not comprehensively assess Zoom Contact Center, Revenue Accelerator, every Phone feature, ordinary service processing or third-party meeting apps.

The next update should check navigation changes, feature names, subscription and regional availability, participant controls, connector permissions and revised data commitments. Account testing is needed before a business records any of these controls as verified.