This article is educational and is not legal advice. Rules apply differently to specific cases, and several points below are genuinely unsettled. Consult qualified counsel before deploying recording or transcription in your organisation.
In Germany you generally cannot just switch on an AI notetaker and start recording a meeting. Three separate rules stack on top of each other: §201 StGB makes recording the non-public spoken word without consent a criminal offence, the GDPR requires a lawful basis for the transcript you create, and where employees are recorded the works council has a genuine co-determination right. Here is what each one requires, and where the law is still uncertain.
§201 StGB: recording without consent is a crime
Section 201 of the Strafgesetzbuch protects the confidentiality of the spoken word. Its first paragraph reads:
Mit Freiheitsstrafe bis zu drei Jahren oder mit Geldstrafe wird bestraft, wer unbefugt 1. das nichtöffentlich gesprochene Wort eines anderen auf einen Tonträger aufnimmt oder 2. eine so hergestellte Aufnahme gebraucht oder einem Dritten zugänglich macht.
In plain terms, it is a criminal offence, punishable by up to three years imprisonment or a fine, both to record another person's non-public spoken word without authorisation and to use or share such a recording. For public officials the maximum rises to five years, attempts are punishable, and recording equipment can be confiscated.
An internal meeting, a personnel conversation, a confidential negotiation, and an ordinary video call are all "non-public" speech, because they are directed at a defined circle of participants rather than the general public. So recording or transcribing them without authorisation falls squarely inside §201.
The hinge word is "unbefugt," meaning without authorisation. Liability is excluded when the recording is authorised, which in practice means the affected people have consented. An AI notetaker that stores audio or produces a transcript without valid consent exposes the operator, and potentially the responsible manager, to criminal liability.
One nuance, flagged honestly: some legal commentators argue that pure real-time transcription that never stores audio beyond working memory might fall outside §201, since the wording requires recording onto a medium. This is a lawyer's argument, not settled case law, and any buffering or retention of audio brings you back inside the statute. Do not treat it as a safe harbour.
Germany requires all-party consent
Because §201 protects each speaker individually, every participant in a non-public conversation must consent before it is recorded. One participant cannot record the others on their own authority. This is the key difference from the one-party consent rule common in many US settings, where the recorder's own consent can be enough. In Germany, everyone's consent is needed.
What counts as valid consent matters too. Clear advance notice that meets the standard of GDPR Article 13, stating what is recorded, how, and for what purpose, followed by the person's continued participation, can constitute consent for §201 purposes. A vague disclaimer such as "this call may be recorded for quality purposes" is not enough. The notice has to be specific, and people need a real opportunity to object.
A transcript is personal data, so §201 is only half the job
A recording or transcript that identifies voices is personal data, so on top of clearing §201 you need a lawful basis under Article 6 of the GDPR: consent, contract, or legitimate interests, each with its own conditions.
In the workplace this is harder than it looks. Section 26 of the Bundesdatenschutzgesetz (BDSG) has historically governed employee-data processing, but the European Court of Justice held in its judgment of 30 March 2023 (C-34/21) that a national employee-data provision which merely restates the GDPR does not satisfy Article 88(2), casting doubt on §26(1). In practice, controllers increasingly ground employee-data processing directly on Article 6 of the GDPR. Cite §26 BDSG if you like, but do not lean on it as an unquestioned standalone basis.
Consent from employees is also legally fragile. The power imbalance between employer and employee makes "freely given" consent hard to establish, because staff must be able to decline without disadvantage. If recordings can capture special-category data such as health or union membership, Article 9 raises the bar to explicit consent, and voice profiling can raise biometric concerns. And under Article 28, a data-processing agreement (AVV) with your transcription vendor is mandatory, and it should prohibit the vendor from using your data to train AI.
Your Betriebsrat has a veto, not just an opinion
Where a works council exists, it holds a co-determination right, not merely a right to be consulted. Section 87(1) no. 6 BetrVG covers:
Einführung und Anwendung von technischen Einrichtungen, die dazu bestimmt sind, das Verhalten oder die Leistung der Arbeitnehmer zu überwachen.
German case law reads this broadly: what matters is whether a technical system is objectively suitable for monitoring conduct or performance, not whether the employer intends to monitor. An AI notetaker that records meetings, transcribes them, and can attribute statements to named individuals is exactly such a system. So introducing one triggers mandatory co-determination.
The standard vehicle is a works agreement (Betriebsvereinbarung), either a new one or an amendment to an existing IT works agreement, concluded before rollout. A well-drafted agreement can blanket-authorise defined meeting types for transcription and can serve as a lawful basis under Article 88(1). What it cannot do is override the GDPR. A works agreement must respect Articles 5, 6, 9, and 88(2), so a blanket "record everything" clause may itself be unlawful even if both the employer and the works council want it.
If there is no works council, the co-determination step does not apply, but §201 consent and the GDPR lawful-basis requirements still apply in full. Not having a Betriebsrat does not remove the criminal and data-protection hurdles.
A practical checklist before you deploy
- Capture all-participant consent, or another valid §201 authorisation, before recording starts. Use invitation-stage notice plus a confirmation prompt before recording begins.
- Give GDPR Article 13 notice at the invitation stage: what is recorded, how, why, how long it is kept, and how to object or withdraw.
- Keep auto-recording off by default. Only authorised people activate it, and let anyone participate without being transcribed.
- Where a works council exists, conclude or amend a Betriebsvereinbarung under §87(1) no. 6 before rollout.
- Sign an Article 28 data-processing agreement with the vendor that prohibits using your data for AI training, and choose an EU data-residency processor.
- Set retention limits, automated deletion, and clear responsibility for reviewing transcript accuracy.
German data-protection authorities point the same way. The DSK guidance on video-conferencing systems says recording functions must be off by default and only consciously enabled, and participants must be informed before joining.
The processor you choose is part of compliance
Two of the requirements above, the mandatory data-processing agreement and the no-training obligation, are decided by which vendor you pick. A US notetaker that transfers data across the Atlantic and reserves the right to improve its own models makes each of these harder to satisfy. We walk through exactly that in where Otter.ai sends your meeting data and whether Fireflies.ai is GDPR-compliant.
A sovereign EU meeting assistant is built around these constraints from the start. Numi keeps recording, transcription, storage, and analysis inside EU jurisdiction, with a data-processing agreement, no training on your data, and consent-first controls. The bot joins Microsoft Teams and Google Meet through an EU-only pipeline, and the integrations fit how your team already works.
Again: this is educational information, not legal advice. §201 StGB, the BDSG, and BetrVG apply differently to specific situations, and some questions here remain unsettled. Get advice from qualified counsel before you deploy.