AI Research Governance

What can I send to an AI system in a research project?

Decide by material, not by task. Restricted material (direct participant identifiers, special-category data, anything where consent does not cover AI processing, client material under a contractual bar) is not sent at all. Controlled material (de-identified transcripts, open ends, client-confidential material the contract permits) goes to approved systems only, with the step registered. Internal working material and open published material carry lighter rules. Unclassified material defaults to the most restrictive tier, which is what stops the classification being quietly bypassed.

Does our existing participant consent cover AI processing?

If it does not mention it, it does not cover it. The common middle case is consent that refers to processing by the research team or its service providers, which could be read to include it but which a participant would not have understood that way. The options are to re-consent, restrict AI use to steps the consent plainly covers, aggregate so the material is no longer personal data, or not use AI on it. De-identification does not settle it, because the participant's interest includes what reads their words.

What should an AI disclosure in a research report say?

Three things: what the AI did, what a human verified, and by whom. "AI tools were used in the preparation of this report" tells a reader nothing. A useful disclosure names the steps (transcription, coding against a human-approved frame), the verification performed (a stratified sample independently coded, every quote checked against transcript), the measured agreement where coding was involved, the named people who did it, and the sign-off date. Write it from the step register, not from what was intended.

How do I record AI use so it can be audited later?

One line per AI step, filled at the time, kept with the project files: the step, the material and its tier, the system and version, what it was asked to do, the date, who ran it, what human check was applied, by whom, and what the check found. It takes about a minute per step. A register completed near delivery is a reconstruction, and it should be labelled as one, with what is unknown.

Why did rerunning our AI analysis give different results?

Because a different model version, or sometimes the same one, can produce different themes, different boundary classifications and different emphasis. This is a property of the method rather than a defect, and it belongs in the disclosure. The practical rules: record the system and version for every step, pin one version for comparative work, and when a version changes mid-project either finish the affected stream on the pinned version or re-run and re-verify, recording which you did.

Is running an AI analysis twice a form of validation?

No. A rerun tests stability, not correctness, and two agreeing AI passes are one piece of evidence produced twice. Presenting that agreement as corroboration is a traceability failure. Correctness is tested only against source material or against independent human work.

How do I measure the accuracy of AI coding?

Have a human independently code a random sample and compute agreement per code, not overall, because overall agreement hides the failure that matters: rare and boundary codes collapse while the aggregate stays high. Stratify the sample to over-represent rare codes. Then disclose the figure a reader should rely on, which is the worst per-code rate among the codes carrying findings, not the flattering average. Where accuracy cannot be measured, label the output unvalidated and do not let it carry a headline.

What questions should I ask about an AI system before using it on research data?

Three. What happens to the input: is it retained, for how long, is it used to improve the service, can it be deleted, where is it processed. Who else can see it: subprocessors, support access, human review of submitted content. And who owns the output, and could it reproduce material you have no right to publish. A team that cannot answer these for a system it is using has a governance gap rather than a policy debate.

What makes an AI governance policy that people actually follow?

Brevity and applicability. Seven sections: a classification table, an approved-systems list with the tier each may receive, the register requirement, the human check standard mapped to task types, the disclosure standard with pre-written templates, the consent rule, and an exception route with a named authoriser. Every rule names who decides. And the exception route exists deliberately, because a policy with no legitimate way to depart from it will be departed from invisibly.

Do we have to tell clients and participants that AI was used?

Yes, in forms appropriate to each. Participants are told at consent, in plain language, what will process their words and what a human does with the result. Clients get the detailed method statement, ideally established at proposal stage rather than discovered at delivery. The standing professional obligation is not to present AI-assisted work as though it were not, and where a client asks for the disclosure to be omitted from a public document, that is a decision for a named human that does not change the obligation to participants or the internal record.