Does Zoom use your meetings to train AI? What Zoom's policies actually say in 2026

By Michael Obraitis, Managing Partner, and Michael Dale, CEO · Published August 6, 2026 · Last reviewed August 2026 · ADAM Pulse Knowledge Base · Zoom Mastery Series

What exactly does Zoom promise?

The operative language in Zoom's terms of service, Section 10.2, effective August 11, 2023:

Zoom does not use any of your audio, video, chat, screen sharing, attachments or other communications-like Customer Content (such as poll results, whiteboard and reactions) to train Zoom or third-party artificial intelligence models.

The same commitment appears on Zoom's AI security and privacy page and in support article KB0057861, which governs how AI features handle data. The support article is also where the operational caveat lives: data from users' interactions with AI features may be accessed, processed, and used by Zoom to provide and maintain the services, troubleshoot issues, and provide support. Optional user feedback, which can include prompts and responses, may be reviewed by Zoom employees to improve the product experience, though Zoom says it is not used for model training.

Didn't Zoom try to train on customer data in 2023?

Yes, briefly, and the episode explains why today's language is so specific. A terms-of-service update from March 2023 surfaced publicly in August 2023. Section 10.4 granted Zoom rights to use customer content to train its AI models, in connection with the assistant then called Zoom IQ. The backlash was immediate. Zoom responded on August 7, 2023 with a blog post and an interim edit promising not to train on audio, video, or chat content "without your consent." Critics noted that consent framing and the service-generated-data carve-out still fell short, particularly against GDPR's consent standard. On August 11, 2023, Zoom rewrote Section 10 entirely, removing the AI training license and inserting the flat prohibition quoted above. That text has remained in force since.

The practical lesson for IT leaders: vendor AI terms can change between renewals, so treat AI data-use language as a contract review item, not a settled fact. Our related article covers the broader discipline: What does AI data governance actually require in 2026?

Which AI models actually touch your meeting content?

Zoom uses a federated architecture that routes AI requests across its own models and third-party subprocessors. Its AI documentation in the Zoom library, as retrieved August 6, 2026, lists the following. Zoom publishes no as-of date for this list and states that changes to the models used in federation can occur at any time, so treat it as a dated snapshot and re-check Zoom's current documentation and subprocessor disclosures:

On retention by those providers, Zoom's documentation states that third-party model providers do not retain customer content, with limited exceptions for trust and safety purposes such as detecting and reporting CSAM, and that providers are subject to security assessments at least annually. Zoom encrypts data in transit between customers, Zoom data centers, and model providers, and at rest on Zoom's platform. The federation mix can change at any time, which is another reason to re-verify at each contract renewal.

Can processing be restricted geographically?

Yes. Zoom offers three AI deployment options, described in its October 2025 data governance blog and current security documentation:

• ZMO (Zoom Models Only): Zoom-hosted models only, no third-party providers, processing within Zoom's infrastructure. Available for accounts in the US, EU, Singapore, Saudi Arabia, Australia, India, and Canada.
• ZM+: Zoom models plus Anthropic models accessed through Amazon Bedrock, with processing kept within Zoom's trust boundary. Available in the US and EU, and the default for EU customers.
• Federated: the full multi-provider option, which may involve global processing, including in the United States.

In June 2026 Zoom also announced Zoom AI On-Prem for regulated enterprises, and AI Companion is FedRAMP JAB Moderate authorized on the Zoom for Government platform, which runs in AWS GovCloud with US-based personnel.

What do participants see when AI is active?

Zoom's documentation states that participants joining a meeting see in-product indicators for the AI features active in that meeting. Participants can ask the host to disable meeting summary and meeting questions, and hosts can turn features off mid-meeting and delete the meeting's AI assets. Administrators control availability at the account, group, and user levels and can lock settings.

What Zoom does not document is a region-specific consent gate for AI features, so if your organization operates under two-party consent norms or works with external participants regularly, write your own host procedure: announce AI at the start, record the announcement in the agenda, and disable AI for meetings where a participant objects. Notice builds trust faster than fine print.

What retention controls should administrators set?

• Summary retention: summaries are stored according to account, group, and user retention settings. No default number is published, so set one deliberately.
• Meeting Summary Zero Data Retention: when enabled, hosts decide per meeting whether a transcript is retained, via a checkbox.
• In-meeting deletion: hosts can delete meeting assets during the meeting.
• Email exposure: admins and users can choose whether summary emails contain the full text or only a link, which matters when summaries reach inboxes outside your retention system.

Our recommended rule: do not retain a transcript simply because the platform can. Match retention to the purpose of the meeting record, and treat AI summaries as drafts until a person reviews them.

What about HIPAA, FedRAMP, and financial services?

Zoom identifies portions of its AI portfolio as ISO 27001, ISO 27701, and ISO 27017/18 certified and within its SOC 2 scope. Certifications are scoped to identified systems, report periods, and legal entities, so review the current certificate and SOC report scope for the exact service being deployed rather than assuming every new agent, connector, or on-premises feature is covered identically. For healthcare, Zoom supports HIPAA compliance programs by executing a Business Associate Agreement, but a BAA does not by itself establish that every AI feature is appropriate or available for every healthcare workflow. Confirm eligibility, contractual coverage, configuration, retention, and permitted data use for each feature before processing protected health information. For US government, AI Companion holds FedRAMP JAB Moderate authorization on Zoom for Government. For financial services, Zoom publishes no FINRA-specific AI guidance; firms subject to books-and-records and supervision obligations typically pair Zoom with archiving vendors that capture AI summaries, and should decide explicitly whether AI summaries are records. When in doubt, treat them as discoverable.

Frequently asked questions

References

Prepared by ADAM Pulse (USA Telecom Consulting LLC) — managed Zoom Phone / network services. Support: (888) 989-4872 · support@adampulse.us