A Client NDA Covers the Recording, Not Just the Report

Agency teams tend to think of confidentiality in terms of what they deliver, such as the report and the highlight reel. The NDA or master services agreement behind a typical project reaches much further back. Most cover the client's identity and brand names, any concept boards or stimulus shown in sessions, unreleased product and pricing details, and the personal data of everyone who took part.

A session recording contains nearly all of that in one file. The moderator reads the concept aloud, participants react to the product by name, and the client's observers can sometimes be heard asking questions through the moderator. Uploading that file to a third-party tool is a disclosure of confidential information, and many agency contracts restrict that unless the client has approved the third party in advance.

Every AI Tool in Your Workflow Counts as a Subcontractor

The Insights Association Code of Standards, updated in September 2026, now gives artificial intelligence its own section, and several of its provisions apply directly to transcription. Section 4 says personal data should not be used in AI training data sets without informed consent, that researchers who choose AI tools should disclose their use along with the technique, model, and version, and that no AI system used in research should run without human judgment built into its lifecycle. Section 8 asks researchers to identify subcontractors when a client requests it, and to use data collected for a client only for that client and its intended purpose.

In practice, an agency should be able to tell a client which AI tool processed its recordings and confirm that the tool used them for nothing beyond the transcript, which no agency can confirm if the tool trains on uploads.

Under GDPR, an agency handling EU participants' recordings usually acts as a processor for its client, and any transcription vendor it uses becomes a sub-processor, which brings contractual obligations and, in many client agreements, a requirement for prior approval. The same logic applies to Canadian participants under PIPEDA, Japanese participants under APPI, and patient or healthcare research in the US under HIPAA.

Client Data Usually Leaks Through Defaults Nobody Checked

The risk with AI transcription rarely comes from a dramatic security failure, and far more often from settings and terms that nobody reviewed.

Model training is the obvious one. Some widely used transcription tools reserve the right in their terms to use uploaded recordings to improve their models, either by default or unless a customer opts out in writing, so a client's concept discussion could end up in a training data set the client never agreed to.

Retention causes quieter problems. A tool that keeps recordings indefinitely, or never says how long it keeps them, leaves the agency unable to honor the deletion timeline in its own client contract. Processing location is related, since recordings may pass through providers the vendor never names, in regions the client never approved, which matters most for EU participant data.

Then there are personal accounts. When moderators and freelance analysts use their own free accounts, the agency loses track of where recordings went and whether they were ever deleted, and this gap is easy to overlook because it sits outside any vendor review the agency carried out.

Questions to Ask Before Uploading a Single Client Recording

ESOMAR's 20 Questions to Help Buyers of AI-Based Services gives buyers a full framework covering explainability, human oversight, and data governance. For transcription specifically, the data governance questions do most of the work, and the table below turns them into a vendor checklist.

A vendor that hesitates on any of these is worth avoiding for client work, however good its accuracy looks in a demo.

Write AI Use Into the Client Contract Before Fieldwork Starts

The easiest time to settle AI use is before the first session is recorded. Agencies that build it into the proposal and statement of work avoid an awkward conversation later, and they give clients the transparency the Insights Association Code now expects.

A short clause is usually enough. The wording below is an example only and not legal advice, so agencies should have their own counsel adapt it.

Example: "Agency may use [vendor name] AI transcription to produce working transcripts of research sessions. The vendor does not use client recordings or transcripts to train AI models, processes data in [region], and deletes recordings within [timeframe] of project completion. Agency will use human transcription only for any sessions Client designates as restricted."

Participant consent forms deserve the same attention. If AI tools will process recordings, the consent language should say so in plain terms, along with how long recordings are kept. The market research transcription guide covers the rest of the transcription workflow, and the post on why market research dies in the room explains why recording every session is worth the extra paperwork.

Unreleased Products Call for a Stricter Workflow

Concept tests for products that have not launched, pricing research, and interviews about a client's competitive strategy can justify keeping recordings away from automated processing altogether.

For those sessions, human transcription is the safer path. With Qualtranscribe's human transcription, recordings are handled by transcriptionists working under NDA and are never accessed by automated systems. For projects where AI speed is still needed but participant identities must be protected, Instant Draft includes built-in PII redaction across 99+ languages, and de-identification is available on human transcription orders. The de-identification explainer covers which approach a client agreement may require.

How Instant Draft Handles Client Data

Instant Draft gives an agency a clear answer to every question in the checklist above. Recordings and transcripts are never used to train AI models on any plan, including Free, the AI processing partners behind the service do not use submitted content for training either, and recordings are deleted from the AI processing system once the transcript is complete.

Data is encrypted with AES-256 at rest and TLS 1.2 or higher in transit. EU clients' recordings are processed and stored within the EEA, and protected health information for HIPAA accounts stays in the United States for storage, with Business Associate Agreements in place. HIPAA and GDPR compliance applies from the Pro plan upward. Qualtranscribe also signs agency NDAs and data processing agreements on request, so the paperwork a client asks for can be in place before fieldwork begins. The full details sit on the GDPR and HIPAA compliance pages.

Beyond the transcript, Smart Insights surfaces themes, key quotes, and sentiment with every finding linked by timestamp to the moment in the recording, which is what most agencies need for a next-morning topline. Its outputs are covered by the same no-training commitment as the transcripts.

Choosing a Plan, and Why Agency Teams Use Researcher+

Instant Draft has four monthly plans, and yearly billing saves 30 percent on the paid tiers.

Free suits a moderator testing the tool on a non-client recording. Pro adds HIPAA and GDPR compliance, advanced speaker identification, the interactive editor, and Word, SRT, and NVivo export, which makes it the minimum for any client work. Pro+ suits a single researcher with a heavier monthly load.

Researcher+ is the plan built for agency teams. It includes five seats under one subscription, so moderators and analysts work inside the agency's account rather than personal ones, which closes the personal-account gap described earlier. With 3,000 minutes a month, unlimited Smart Insights runs, and uploads of up to 1 GB per file, it covers a busy fieldwork schedule across several projects. Its 10 percent discount on human transcription also matters for agencies, because most projects end with at least some sessions transcribed by people for the final client deliverable.

Client Deliverables Still Need Human Transcription

AI transcription is the right tool for internal debriefs and the topline that goes out the morning after fieldwork, but the final deliverable has a higher bar. Verbatim quotes in a client report, transcripts that a client will audit, healthcare professional and pharmaceutical research, and focus groups with heavy crosstalk all need the accuracy and speaker attribution that human transcription provides.

Qualtranscribe's human transcription covers focus groups, in-depth interviews, and pharmaceutical market research, with transcripts formatted for NVivo, ATLAS.ti, and MAXQDA. Agencies can run both, using Instant Draft for speed during fieldwork and human transcripts as the record that goes to the client. The comparison of AI transcription tools for focus groups and market research covers how other tools handle this split, and the post on the EU AI Act covers what changes for agencies with European clients.

Agencies that want to set up a team account, or need an NDA and DPA signed before a project starts, can create an account here or contact support@qualtranscribe.com.

Frequently Asked Questions

Can a market research agency use AI transcription under a client NDA? Usually yes, provided the tool does not train on recordings, the agency can name it if the client asks, and the client contract allows third-party processing. Naming the AI transcription tool in the proposal lets the client approve it before fieldwork.

Do AI transcription tools train on uploaded recordings? Some do, either by default or unless the customer opts out in writing, so it is worth reading the terms before uploading client material. Qualtranscribe's Instant Draft never uses recordings or transcripts for training on any plan, including Free.

What should a data processing agreement with a transcription vendor cover? At minimum, it should cover the purpose of processing, data location, sub-processors, security measures, retention and deletion, and breach notification. Qualtranscribe signs DPAs on request before any files are uploaded.

Does the Insights Association Code cover AI transcription? Yes. The September 2026 Code includes a section on artificial intelligence that covers disclosure of AI use, human oversight, and keeping personal data out of AI training without consent, along with provisions on identifying subcontractors and using client data only for that client.

Is the free plan safe for client work? The free plan never uses recordings for training, but HIPAA and GDPR compliance applies from Pro upward, so agencies handling client recordings should use Pro or above, and Researcher+ for teams.

When should an agency avoid AI transcription entirely? For unreleased product concepts, pricing research, and other sessions a client classifies as restricted, human-only transcription keeps the recording away from automated processing altogether.