AI meeting note-takers in Luxembourg: what the law allows

Learn more about AI implementation in Luxembourg, and about the practices the AI Act bans outright in our guide to Article 5 prohibited practices.

Meeting assistants arrived in most Luxembourg companies without a project. Someone turned on transcription in Teams, a sales manager connected an app to their calendar, a board secretary started recording to write minutes faster. The tools are useful: a good summary with action items saves real time. They also sit on top of one of the most regulated activities in Luxembourg labour law, which is recording what employees say.

I help Luxembourg companies put AI into daily work at 20 More, and this is the question I now get in almost every rollout: can we let people use it, and on what terms? Below is the legal frame, a feature-by-feature table, and the configuration I recommend. It is practical guidance, not legal advice; for a sensitive case, involve your DPO or counsel.

Which rules apply to an AI note-taker?

Four sets of rules overlap, and they apply to different features of the same tool:

The mistake is to treat the tool as one thing. A transcript used to write minutes and the same transcript used to score a salesperson's calls are different processing under all four regimes.

When does article L.261-1 apply?

Article L.261-1 governs processing of personal data "for the purposes of monitoring" employees at work. It does not ban monitoring; it attaches a procedure to it. According to Guichet.lu and the CNPD:

• Legal basis. The processing needs one of the GDPR Article 6(1) bases, (a) to (f).
• Collective prior information. Before the system starts, the employer informs the staff delegation, or the ITM if there is none, with a detailed description of the purpose, how the system is set up, how long data is kept, and a commitment not to use the data for any other purpose. Guichet.lu suggests registered mail so the date is provable.
• Individual information. Each employee receives the information required by Article 13 GDPR.
• 15-day window. Within 15 days of that information, the staff delegation or the employees concerned can ask the CNPD for a prior opinion on whether the processing is compliant. The request suspends the project, and the CNPD must answer within one month.
• Co-decision. Where monitoring serves health and safety, controls production or performance when that is the only way to determine exact pay, or runs a flexible working-hours system, the staff delegation co-decides (Articles L.211-8 and L.414-9).
• No authorisation. Since 25 May 2018 the CNPD no longer authorises monitoring in advance. The employer carries the burden of compliance alone (Guichet.lu).

A staff delegation is compulsory in companies with at least 15 employees (Guichet.lu); below that, the information goes to the ITM. Breaching Article L.261-1 is a criminal offence, punishable by eight days to one year of imprisonment and/or a fine of €251 to €125,000 (CNPD), and an employee's complaint to the CNPD cannot be grounds for dismissal.

Is a note-taker "monitoring"? The law does not name meeting assistants, and there is no Luxembourg decision on them that I know of. The practical test I use: could the recordings, transcripts or analytics be used to observe or assess what individual employees do or say? If yes, which is the case for most tools with speaker attribution, talk-time statistics or searchable archives, follow the L.261-1 procedure. It costs a letter and fifteen days. Skipping it turns every future use of the data into a dispute.

What does the CNPD say about recording meetings?

The CNPD has a page specifically on sound recording of meetings. Three points matter for AI note-takers:

1. Consent is fragile. Consent is possible in theory but hard to obtain validly between employer and employee, because it must be free: a participant must be able to refuse without consequence. The CNPD's examples of what that means in practice are pausing the recording when that person speaks, or not recording at all.
2. Information comes first. Participants must be told, before recording starts, who records, why, for how long, and what their rights are (Article 13 GDPR). A banner that appears after the meeting has started does not do this on its own.
3. Retention follows the purpose. If the purpose is writing minutes, the audio should be kept only as long as it takes to write and approve them.

The joint CNPD and Chambre des salariés brochure on workplace monitoring makes the same point for telephone calls: every party to a recorded call must be informed (CNPD / CSL brochure).

For most companies the better basis is legitimate interest (Article 6(1)(f)) for a clearly limited purpose such as minutes, with a documented balancing test, rather than consent collected at the start of each call.

The 1982 privacy law is a separate risk

The Law of 11 August 1982 on the protection of privacy makes it an offence to record the words of a person spoken in private without their consent, and to keep, disclose or use such a recording (Legilux). How far it reaches into business meetings is not settled, but it is the reason a bot that joins external calls silently, from a colleague's calendar, is the configuration I would switch off first.

Where does the EU AI Act come in?

Two provisions matter for meeting tools:

• Emotion recognition is banned at work. Since 2 February 2025, Article 5(1)(f) of the AI Act prohibits AI systems that infer the emotions of people in the workplace, except for medical or safety reasons (AI Act Service Desk). The Commission's guidelines explain that the ban covers emotion recognition based on biometric data, such as voice tone or facial expressions (Commission guidelines). An "engagement", "sentiment" or "mood" score computed from participants' voices or video therefore has no place in an internal meeting tool. Sentiment analysis of written text alone is outside that specific ban, but it still needs a GDPR basis and, used on staff, the L.261-1 procedure.
• Evaluating staff is high-risk. AI used to monitor and evaluate the performance and behaviour of workers is an Annex III high-risk use, with the deployer obligations applying from 2 December 2027 after the Digital Omnibus (Commission). A note-taker used for minutes is not that. The same tool feeding a call-scoring dashboard used in appraisals may become it.

Article 50's transparency duties do not turn an internal meeting summary into labelled public content: the text-labelling duty in Article 50(4) concerns AI-generated text published to inform the public (Commission FAQ). Staff still need to be told the summary is AI-generated under the GDPR information duty, and every employee who uses the tool falls under your Article 4 AI literacy duty.

Which features are fine, and which need care?

This is the table I use with clients. It assumes internal meetings and a tool contracted by the company, not an employee's personal app.

The CNPD's list of processing that requires a DPIA includes the systematic monitoring of employees' activities. Any configuration from "speaker attribution" down the table should have one.

A default-safe rollout in six steps

1. Pick one tool and block the rest. Personal note-taker apps connected to work calendars are the largest uncontrolled risk. Allow the one you have a contract and a data processing agreement for (Article 28 GDPR), and block calendar access for others.
2. Configure before announcing. Captions on, recording and transcription off by default, started manually by the organiser; no auto-join for external meetings; talk-time analytics and any sentiment features off; retention of recordings set to the shortest option that still lets minutes be written.
3. Write the purpose down. One paragraph: minutes and action items, nothing else, no use in appraisals or discipline. This is the commitment L.261-1 expects, and it is what makes legitimate interest defensible.
4. Inform the staff delegation or the ITM, in writing, with purpose, set-up, retention and that commitment. Then wait out the 15 days before going live.
5. Inform individuals. A short notice in the intranet and in meeting invitations: who records, why, how long, how to object, and that participants can ask for the recording to be paused.
6. Train and review. Ten minutes on what the tool does and does not do, then a review after three months of what is actually being recorded and kept.

For companies that also record working time, the same letter to the staff delegation can cover both; see our guide to the working-time register under Article L.211-29.

Frequently asked questions

Can a Luxembourg employer record meetings with an AI note-taker?

Yes, with conditions. The recording needs a GDPR legal basis and prior information to participants. Where the recordings or transcripts can be used to observe or assess employees, Article L.261-1 of the Code du travail also requires prior information to the staff delegation or the ITM, which opens a 15-day window for staff to request a CNPD opinion.

Is employee consent enough to record meetings?

Rarely. The CNPD notes that consent between employer and employee is hard to obtain validly because it must be freely given and refusable without consequence, for example by pausing the recording when a participant objects. For recurring internal use, a limited purpose under legitimate interest, with a documented balancing test, is usually the sounder basis.

Are sentiment or engagement scores in meetings allowed?

Not when they are inferred from voice or facial expressions. Since 2 February 2025, Article 5(1)(f) of the EU AI Act prohibits emotion recognition in the workplace, except for medical or safety reasons. Text-only sentiment analysis falls outside that ban but, applied to employees, still needs a GDPR basis and the L.261-1 procedure.

Do we need a DPIA for an AI meeting assistant?

For captions or minutes with short retention, often not. As soon as the tool attributes speech to named people across meetings, keeps a searchable archive or produces participation statistics, it resembles the systematic monitoring of employees that appears on the CNPD's DPIA list, and you should carry one out.

What about employees using their own note-taker apps?

Treat them as the first thing to fix. A personal app connected to a work calendar records colleagues and clients under terms the company never accepted and cannot audit. Provide one approved tool, block the others, and say so in the internal AI policy.

If you would like a second pair of eyes on your current set-up, describe the tool and how it is configured and we will tell you what to change first. The work often qualifies for Luxembourg co-funding; the funding check takes two minutes.