The AI Transcript That Caught Something: Spoliation Holds, Auto-Delete Rules, and Triage

Minute Zero: The Bot Stayed On After the Call Ended

Most AI transcript crises start in the ninety seconds after half the attendees hang up. What feels like an IT embarrassment becomes a spoliation trap the moment someone clicks Delete.

Trace a composite Thursday afternoon incident. Four interviewers wrap up a 30-minute promotion panel on Microsoft Teams—or on Zoom with an invited third-party transcription assistant. At 2:30 p.m., two panelists leave the bridge. The hiring director and one senior manager stay on the audio channel for 85 seconds while closing browser tabs. Neither notices the transcription bot tile still active in the roster. The director says: "Honestly, between her IVF schedule and another maternity leave next year, we cannot put her in the regional lead seat right now."

At 2:34 p.m., the platform's automated workflow compiles a structured recap, action items, and a full searchable `.vtt` transcript link, then emails the package to all seven calendar invitees—including the recruiting coordinator. At 2:38 p.m., the panicked hiring director messages HR and IT: "That comment was private after the meeting ended. Delete the recording from the server right now and recall the emails."

Stop IT's cursor immediately. In the next 60 minutes, your people operations and IT security leads must separate two completely different technical actions: access containment (stopping seven people from forwarding a live link) and evidence destruction (deleting electronically stored information after a statutory violation just surfaced in writing).

FRCP Rule 37(e) vs. Routine 30-Day Auto-Deletion

Standard 30-day rolling deletion policies protect companies only before a dispute becomes reasonably foreseeable. Once a transcript captures an unlawful remark, routine purge timers must be suspended immediately.

Many IT teams point to their 30-day or 60-day Zoom and Teams auto-expiry rule and assume letting—or accelerating—deletion is routine hygiene. Read Federal Rule of Civil Procedure 37(e) carefully. The common-law duty to preserve electronically stored information (ESI) attaches the moment litigation or an administrative charge is reasonably foreseeable—not months later when an EEOC charge arrives in the mail.

When HR and a department head read a verbatim transcript linking a promotion rejection to pregnancy or IVF treatment, a Title VII, PWFA, or ADA dispute is foreseeable on the spot. Rule 37(e) establishes a two-tier sanction structure if that `.vtt` transcript, raw audio file, or AI recap disappears:

• Rule 37(e)(1) — Curative Sanctions Upon Prejudice: If ESI that should have been preserved is lost because a party failed to take reasonable steps (such as failing to pause a 30-day Teams auto-purge timer), and the loss prejudices the employee, the court may order curative measures, fee-shifting, or evidentiary rulings barring the employer from disputing what was said.
• Rule 37(e)(2) — Intent-to-Deprive Penalties: If a manager, HR partner, or IT administrator affirmatively deletes the transcript to keep it out of a dispute—the exact action your panicked director just requested at 2:38 p.m.—the court may instruct the jury that it must or may presume the deleted information was unfavorable to the employer, or even enter default judgment. An adverse-inference instruction over a deleted recording is often more devastating at trial than the remark itself.

Containment Without Spoliation: The Forensic Vault Workflow

You can lawfully revoke broad workspace sharing links in under ten minutes without altering a single byte of evidence. Export immutable hashes to a legal-hold container before tightening permissions.

Execute a strict four-step technical sequence with your collaboration-platform administrator within Hour 1:

1. Step 1 — Place an In-Place Hold (Minutes 0–15): In Microsoft Purview, Google Vault, or Zoom Compliance Manager, apply an immediate preservation hold to the meeting ID, host mailbox, and cloud recording bucket so neither the meeting host nor a 30-day rolling retention policy can purge the file.
2. Step 2 — Export Forensic Originals + SHA-256 Hash (Minutes 15–30): Download the unedited audio/video (`.mp4`/`.m4a`), raw time-coded transcript (`.vtt` or `.json`), AI-generated summary text, and participant join/leave telemetry log (showing exact second-by-second attendance). Compute a `SHA-256` checksum on each artifact and log it in your restricted ER/Legal vault.
3. Step 3 — Restrict Downstream ACLs (Minutes 30–45): Now—and only after immutable preservation—change the cloud sharing permission on the live link from "Anyone in organization / Meeting invitees" to "Restricted: Legal & ER Hold Only." If copies landed in non-essential employee inboxes via auto-email, consult counsel before running a mailbox search-and-remediation purge, and preserve a forensic copy of every transmitted email header and recipient list first.
4. Step 4 — Audit Word-Error Artifacts Without Editing Originals (Minutes 45–60): Speech-to-text models routinely mishear homophones, negation words ("not" vs. "now"), and speaker diarization labels when two voices overlap. Never edit the `.vtt` file to "fix" a transcription error. Prepare a separate investigator comparison table pairing the raw `.vtt` line against the underlying `.m4a` audio waveform.

Actual Notice Under Title VII and Lingering-Bot Wiretap Risk

Locking the file in a vault solves only half the legal problem. Reading the transcript puts the company on actual legal notice to investigate and remediate the underlying conduct.

Once an HR partner or supervisor receives an AI recap flagging potential discrimination or harassment, the company can never claim ignorance. Under Title VII of the Civil Rights Act (42 U.S.C. § 2000e-2) and the Supreme Court's Faragher/Ellerth framework, an employer on actual or constructive notice of harassment or biased decision-making must take prompt, effective remedial action. In our Thursday promotion vignette, HR must immediately pause the promotion announcement, wall the tainted hiring director off from the selection decision, have an independent decision-maker re-evaluate the candidates on objective criteria, and open a formal employee-relations inquiry into the director's conduct.

Audit the recording tool itself at the same time. Third-party consumer bots that auto-join calls via calendar scraping—and linger after employees think the meeting ended—carry acute privacy litigation risk. In In re Otter.AI Privacy Litigation, No. 5:25-cv-06911-EKL (N.D. Cal. Aug. 13, 2026), the federal court denied dismissal of California Invasion of Privacy Act Section 631 interception claims and federal Wiretap Act claims where plaintiffs plausibly alleged an AI note-taker harvested conversation data to train its own commercial models. Pair your post-incident response with our AI note-taker interview and consent runbook so rogue calendar bots cannot join future panels uninvited.

Copy-Ready 60-Minute Preservation & Containment Notice

Send this joint HR-Legal directive to IT and the meeting host within 30 minutes of discovering a sensitive AI transcript. It halts self-help deletion while locking down workspace visibility.

URGENT — DO NOT DELETE: ESI Preservation & Access Containment Directive
Incident Ref: [ER-YYYY-NNN]              Meeting Platform & ID: [Zoom / Teams ID #]
Meeting Date & Time (UTC): [YYYY-MM-DD HH:MM]

TO: [IT Collaboration Admin] & [Meeting Host Name]
CC: [Employment Counsel / Head of People]

1. MANDATORY PRESERVATION HOLD (ZERO DELETION)
   Effective immediately, do NOT delete, edit, overwrite, or accelerate expiration of any audio, video, `.vtt`/`.json` transcript, AI summary, chat log, or participant join/leave metadata associated with the meeting above. Suspend any automated 30/60/90-day retention purge on this Meeting ID immediately.

2. FORENSIC EXPORT & HASHING (COMPLETE WITHIN 30 MINUTES)
   IT Admin: Export the unedited recording, raw transcript, AI recap, access-view audit log (who opened the link and when), and email delivery headers to Legal Hold Bucket [Vault Path], and record SHA-256 checksums on the ticket.

3. ACCESS CONTAINMENT (RESTRICT PERMISSIONS — DO NOT PURGE ORIGINALS)
   Once Step 2 is verified complete, change workspace sharing permissions on the live recording and transcript link to "Restricted — Legal & ER Hold Only" and disable forwarding/downloading for general meeting invitees.

4. NON-INTERFERENCE & CONFIDENTIALITY
   [Meeting Host]: Do not contact meeting participants or candidates regarding this recording, do not delete local emails or Slack/Teams messages referencing the call, and await scheduling from Employee Relations.

Issued By: [HR / Legal Lead Name & Title]     Timestamp: [YYYY-MM-DD HH:MM]

Preventing Repeat Incidents Across Your Collaboration Stack

Fix tenant defaults once so post-call remarks and unapproved bots stop generating accidental broadcasts. Enforce explicit host-drop termination and opt-in distribution rules across AI and changing work.