AI Readiness for Research Compliance: Where to Start

Many research offices are already fielding questions about artificial intelligence (AI). Faculty might want to use AI to draft protocols. Leadership wants to know how AI can help with review turnaround. Vendors are adding AI to their product roadmaps. 

The more pressing question is what the institution should do first, so that its approach remains defensible when an Institutional Review Board (IRB), an Institutional Animal Care and Use Committee (IACUC), or a federal sponsor asks how a decision was made. 

This article answers that question for research universities and research organizations. It explains what AI readiness in research compliance involves, which federal signals already shape it, how to set AI implementation priorities that match institutional risk, and what to ask of technology partners. It is current as of October 2026.

What AI Readiness Means for a Research Compliance Program

AI readiness is an institution's ability to introduce AI into compliance work without weakening oversight. It has less to do with buying a tool than with four conditions that need to be in place first. The conditions are 

• clear governance over who approves AI use
• data that is consistent enough to analyze
• workflows where a person remains accountable for each determination
• explainability, meaning the institution can show why an AI tool produced a given output, what information it drew on, and who reviewed it before it informed a decision
• staff who understand what a tool can and cannot do

Research compliance raises the bar on each of these conditions. Research protocols hold unpublished research plans, participant information, and, in clinical settings, protected health information (PHI). Committee determinations carry regulatory weight under the Common Rule (45 CFR 46), the Public Health Service (PHS) Policy on Humane Care and Use of Laboratory Animals, and the Animal Welfare Act regulations. A tool that summarizes, flags, or drafts inside that environment inherits those obligations.

The system supports the process; the principal investigator (PI) remains responsible for the protocol, and the institution remains responsible for oversight. That boundary does not move because the software underneath it has changed.

It also helps to separate AI from automation. Many functions institutions already rely on, such as completeness checks before submission, expiration reminders, and routing rules, are rules-based automation. They behave the same way every time. AI tools, including large language models, produce outputs that can vary and can be wrong in ways that look plausible. Readiness planning treats the two differently. Automation needs configuration and testing. AI also needs output reviews, documentation of how it was used, and firm limits on what it can influence.

The Federal Signals Already Shaping AI Use in Research

A single federal rule does not govern AI in research compliance. Several notices, advisory recommendations, and voluntary frameworks shape what institutions can and should do.

‍

Each development in the table carries a different level of obligation. The sections below take them in the same order and explain what each one means for a research compliance program.

Confidentiality in NIH Peer Review (NOT-OD-23-149)

NIH’s 2023 notice applies to NIH’s own peer reviewers rather than to institutions. Its reasoning is still relevant to compliance offices. NIH’s concern was that online AI tools offer no guarantee about where submitted content is stored, viewed, or reused. Compliance offices hold comparable confidential material, and the same reasoning applies when staff consider pasting protocol text into a public AI tool.

Originality in NIH Grant Applications (NOT-OD-25-132)

NIH's 2025 notice addresses how investigators prepare grant applications. Investigators may still use AI for limited assistance, but NIH grant applications, or sections of them, that are substantially developed by AI will not be treated as the applicant’s original ideas. The notice also limits each PI to six applications per calendar year. For institutions, the practical questions are how internal review and sign-off of grant applications reflect the originality expectation, and how the application limit is tracked for each investigator.

SACHRP Recommendations on AI in Human Subjects Research

The recommendations from the Secretary’s Advisory Committee on Human Research Protections (SACHRP) are not requirements. They are useful because they frame questions IRBs already face when a study uses AI. These include when people whose data is used to build a model become human subjects, what consent forms should disclose, and how reviewers should weigh the potential for bias. Institutions may adopt these points as recommended practice.

The NIST AI Risk Management Framework

The National Institute of Standards and Technology (NIST) framework is voluntary and not specific to any sector. Many organizations use it as a reference point for AI governance because it gives information technology, compliance, and risk teams a common vocabulary for identifying and managing AI risk.

Existing Human Subjects and Animal Research Requirements

As of October 2026, the Common Rule, FDA human-subjects regulations, PHS Policy, and the Animal Welfare Act regulations have not been amended to address AI. Their existing requirements apply to any research or committee process that uses AI. For IRBs, the criteria for approval, informed consent, and privacy protections are unchanged. For animal research programs, program reviews, protocol approvals, and veterinary care decisions remain with the IACUC, the Institutional Official, and the attending veterinarian.

Read together, these signals point in a consistent direction. Federal bodies are focused on confidentiality, originality, and human accountability rather than on prohibiting AI outright. That gives compliance leaders a workable starting position: protect confidential content, keep people responsible for determinations, and document how AI was used.

How Should Research Institutions Start With AI Adoption?

Before selecting a tool or a use case, an institution benefits from putting two foundations in place. The first is governance that defines who approves and oversees AI use. The second is data and systems that can support that use. An institution that begins with a tool may discover policy gaps only after staff are already using it. An institution that begins with these foundations can approve useful pilots faster, because the guardrails and the data are ready. The sections below cover governance first, then data and system foundations.

Establish Governance for AI Use

Governance sets out who decides, what staff may do, how AI-assisted work is recorded, and what is already in use. Four steps give an institution that footing.

Name who owns AI decisions in compliance

Responsibility for AI in compliance is shared among information technology, the research office, privacy, and the committees. Without a named owner, each group assumes another has approved it. A practical model gives the CIO responsibility for security, data handling, and technical due diligence. The Research Compliance Director decides whether a use case fits regulatory and committee obligations. Committee chairs and the privacy officer are brought in before any tool touches review materials, and the Institutional Official knows which AI uses are active in programs covered by the institution’s assurances.

Set an acceptable-use standard for compliance staff

Staff need to know what material can go into which tools. A short internal standard can group content into classes: public policy documents, internal procedures, protocol content, participant or animal health information, and unpublished grant material. For each class, the standard states whether no AI tool, only institution-approved tools, or any tool may be used. This is a recommended institutional practice rather than a federal requirement, but it follows the confidentiality reasoning NIH has already applied to peer review.

Decide how AI-assisted work will be documented 

AI may already be present in faculty drafting habits, in features vendors enabled during routine upgrades, and in browser tools staff adopted on their own. An inventory of current use, including features embedded in existing systems, gives leadership an honest baseline. It also shows where institutional data may already be leaving institutional control.

Assess Data and System Foundations

Governance determines how AI may be used. An institution’s data and systems determine whether that use produces reliable results. An AI tool can analyze only the information available to it. When protocol information, training records, conflict of interest (COI) disclosures, and post-approval monitoring (PAM) findings are kept in systems that do not exchange data, AI outputs reflect the same gaps and become harder to verify or explain.

For institutions that already run an electronic research administration (eRA) or compliance system, the constraints worth examining are familiar ones. These include limited reporting, systems that cannot share data, forms that are difficult to change, and workload growing faster than staffing. Such limits are manageable in routine processing. They become more significant once AI is introduced, because analysis depends on data that is structured consistently across committees and over time.

Four questions help the CIO and the Research Compliance Director judge whether current systems can support AI use:

• Consistency: Are core data points such as investigator, funding source, species, risk level, and approval dates captured in structured fields across committees, or held in attachments and free text? Structured data gives AI tools a reliable basis for analysis.
• History: Does the system retain version history and decision dates? This supports trend analysis and helps the institution show how a decision developed over time.
• Interoperability: Can compliance data be exchanged with grants, human resources, training, and financial systems through supported integrations? Without that exchange, AI outputs draw on an incomplete picture.
• Access control: Can the institution restrict which users and tools see which information, and review who accessed what? These controls allow the acceptable-use standard set during governance to be applied in practice.

If several answers are weak, strengthening data infrastructure is often a more valuable first investment than an AI tool. It improves reporting and committee visibility now, and it prepares the institution for analytics and responsible AI use later.

Setting AI Implementation Priorities by Risk and Value

Once governance and data foundations are understood, the next decision is sequence. Sound AI implementation priorities rank use cases by two factors: how close the AI output sits to a regulatory determination, and how much measurable administrative burden it removes. Uses that sit far from determinations and carry high administrative volume come first.

‍

The first tier shows why the investigator experience is a practical starting point. When a check tells a PI, before submission, that the consent form and the protocol describe different procedures, the institution can reduce returned submissions without affecting the committee’s judgment. 

The second tier is where governance proves its value. A summary of a long protocol can help a coordinator triage, but if reviewers rely on the summary instead of the protocol, an AI error can become a review error. Pilots in this tier need a defined review step and a record of how outputs were checked.

The third tier does not mean AI has no future role near determinations. It reflects where accountability sits today. The institution should always be able to show that qualified people made the decisions the regulations assign to them.

Running a First Pilot That Produces Evidence

A first pilot should answer one question well: does this use case reduce burden without adding compliance risk? Institutions get a clearer answer when they keep scope narrow and measure results against their own baseline.

Record the baseline before the tool goes live

Capture current figures for the workflow in question, such as the share of submissions returned for incomplete information, days from submission to completed pre-review, or staff hours spent on a recurring report. Without a baseline, a pilot produces impressions rather than evidence.

Limit scope to one committee and one workflow

A pilot that covers IRB pre-review, IACUC amendments, and COI disclosures at the same time will be hard to evaluate. One committee and one workflow make it possible to attribute changes to the tool and to spot problems early.

Document how AI was used

For each pilot, keep a short record of the tool, its configuration, what content it received, who reviewed its outputs, and what changed as a result. This supports internal audit, answers sponsor or accreditation questions if they arise, and gives the governance group what it needs to approve the next phase.

Prepare staff and investigators

Coordinators and reviewers need to understand what the tool does, where it is known to be weak, and that their judgment still governs. Investigators need clear guidance on what institutional AI assistance means for their submissions, particularly in light of NIH's originality expectations. Adoption tends to depend on trust as much as on capability.

Questions to Ask Technology Partners

Most institutions will encounter AI through their existing vendors as well as new ones. Evaluations hold up better when they ask about specific behavior rather than general capability. Useful questions include:

• Where is institutional data processed and stored when an AI feature runs, and is it used to train models outside the institution’s environment?
• Which features use AI and which are rules-based automation? Both have value, but they need different testing.
• Can the institution enable, restrict, or switch off AI features by committee or by user role?
• How are AI outputs logged, and can staff see the source material behind each suggestion?
• What security certifications and independent assessments apply to the environment that runs these features?
• Which deployment options are available, such as on-premises or hosted, and how does each fit institutional policy?
• How are AI features priced, whether included in the existing license, offered as an add-on, or charged by usage, and how will costs change as adoption grows? A complete estimate should also account for configuration, integration, staff training, and ongoing review of AI outputs.

Ask vendors to demonstrate the use cases that matter most to your program, using scenarios supplied in advance, or to support a sandbox or proof of concept. That standard is fair to vendors and gives the institution evidence it can act on. Open questions about data handling or integration are better settled during evaluation than left for implementation.

How Key Solutions Supports AI Readiness

At Key Solutions, AI readiness begins with the systems that manage protocols, grants, and conflict of interest disclosures, because these systems contain the data that any AI use will depend on.  

Research compliance is covered through eProtocol, with modules for Human Subjects (IRB), Animal Subjects (IACUC), Biosafety (IBC), Stem Cells (SCRO), Radiation Safety (RSC), Chemical Safety (CSC), Controlled Substances (CS), and Post-Approval Monitoring (PAM). Research administration is supported through eGrants, with modules for Pre-Award, Post-Award, System-to-System (S2S) submission to Grants.gov, Effort Reporting, and Sponsored Projects Administration. Conflict of interest is managed through eCOI, which supports disclosure, routing, and review. Each committee works through its own forms and review workflow, and information is shared across committees and functions through an integrated data model.

Four factors are relevant for institutions planning AI adoption:

• Compliance and research administration from one provider: Protocol, grants, and COI information are designed to work together. This supports cross-committee reporting today and gives analytics and AI work a consistent data foundation.
• AI introduced within the products where it adds value: Key Solutions is extending its products to incorporate AI for specific use cases. This work builds on established workflow functions such as completeness checks, version control, and event-triggered notifications. The eGrants Opportunity Finder already uses AI to identify funding opportunities based on research abstracts and areas of expertise. AI-assisted checks extend the existing completeness checks to flag inconsistencies before a submission reaches review.
• Professional Consulting Services across the implementation journey: The Key Solutions Professional Consulting Services (PCS) team supports institutions at each stage described in this article:
  
  • Readiness assessment: Reviewing governance, data, and systems to determine whether the institution is prepared for AI use.
  • Use-case selection: Identifying which workflows are suited to AI and which decisions should remain with people.
  • Implementation: Configuring, integrating, and piloting selected use cases, drawing on Data Analytics, Data Infrastructure, and AI/ML Integrated Services.

• Deployment choice and security: The products can be deployed on-premises or as software as a service (SaaS). Key Solutions is ISO 27001:2022 certified and brings 15+ years of focus on life sciences research.

Learn more about research compliance software, IRB software, grants management, and AI/ML Integrated Services.

Moving From Interest to a Defensible First Step

AI readiness in research compliance rewards institutions that do the foundational work first. Governance with named owners, an acceptable-use standard for confidential material, data that holds together across committees, and a first pilot measured against a baseline will carry an institution further than an early tool purchase. Those steps also prepare the program for the questions sponsors, accreditors, and committees are likely to ask as AI use grows.

AI and data integrity are among the themes on the agenda at the 2026 Public Responsibility in Medicine and Research (PRIM&R) Annual Conference in Denver, November 16 to 18. Key Solutions will be at booth 306 to discuss how compliance programs are approaching these questions.

To see how an integrated compliance and research administration environment can support your institution's AI readiness work, schedule a demo.

Frequently Asked Questions

‍