Which Policies and Rules Govern AI Use in Academic Research?

Which AI Rules Actually Apply to Your Research?

You use an AI tool to help write code for an analysis, summarize articles, improve a paragraph, or examine research data. Which policy tells you whether that use is allowed?

The answer is less tidy than many researchers expect. There is rarely one document called "the AI policy" that settles everything. Academic research operates within overlapping systems of law, research ethics, institutional governance, funding requirements, publication standards, contractual obligations, and professional norms. AI has been inserted into that existing regulatory environment rather than replacing it with a single new rulebook.

This matters because permission from one authority does not necessarily mean permission from another. Your university may permit a particular AI tool while your ethics approval restricts how participant data can be processed. A funder may allow AI-assisted proposal preparation while imposing conditions on its use. Later, the journal receiving your manuscript may have its own disclosure or confidentiality requirements.

The practical question, therefore, is not simply "Am I allowed to use AI?" It is "Which rules apply to this particular AI use, at this particular stage of this particular research project?"

AI Use in Research Is Usually Governed by Several Layers of Rules

Think of AI Governance as a Stack of Overlapping Requirements

A useful way to understand AI governance in research is as a policy stack. Different layers answer different questions, and several layers may apply to the same action.

Law Can Apply Even When It Does Not Mention Generative AI

Researchers should not assume that only laws containing the words "artificial intelligence" matter. Existing rules governing personal data, confidentiality, copyright, intellectual property, consumer protection, research involving particular populations, and regulated sectors may affect an AI-assisted research activity even if those rules predate modern generative AI.

Data protection is an especially important example. Sending information to an external AI service is itself a form of data processing in many circumstances. Whether it is permissible may depend on what information is transferred, the legal basis for processing it, where it goes, how the provider handles it, and what safeguards are in place.

In the Philippines, for example, the National Privacy Commission's Advisory No. 2024-04 specifically addresses the application of the Data Privacy Act of 2012, its implementing rules, and NPC issuances to AI systems processing personal data. The advisory makes clear that these technology-neutral data-protection requirements can apply to the development or deployment of AI systems when personal data are processed, including during training and testing.

Your Institution Can Add Rules Beyond the Law

Universities and research organisations commonly establish requirements that go beyond minimum legal obligations. These may appear in a dedicated AI policy, but they may also be distributed across research-integrity policies, information-security rules, data-management procedures, acceptable-use policies, ethics guidance, software procurement rules, and policies on confidential or sensitive information.

This is why searching only for a document titled "AI Policy" can miss relevant requirements. The practical process for finding your university's applicable AI rules may require checking several institutional sources.

Rules can also vary within a university. A central institutional policy may establish the baseline while a laboratory, research centre, faculty, hospital, or other unit imposes additional requirements because it handles particular forms of data or operates within a regulated environment. Whether different departments can impose different AI requirements therefore matters when research crosses organisational boundaries.

Your Ethics Approval May Govern AI Use Even Without an AI-Specific Clause

Research involving human participants creates another layer. An ethics committee or institutional review board may have approved a particular protocol describing how data will be collected, stored, accessed, analysed, and shared. Introducing an external AI service can alter that arrangement.

For example, a study may have been approved on the understanding that interview transcripts remain on encrypted institutional systems and are accessible only to named members of the research team. Uploading those transcripts to an external generative AI platform for thematic coding could raise questions about confidentiality, data transfer, consent, security, and whether the processing remains consistent with the approved protocol.

Consequently, the relevant question is not only whether the institution generally allows the AI tool. Researchers may also need to determine whether the proposed use remains within the approved study or whether research ethics requirements restrict that use.

Funders Can Establish Their Own AI Conditions

Funding organisations can regulate activities associated with applications, assessments, funded research, or reporting. These requirements are not necessarily identical across funders.

Current policies illustrate the variation. UK Research and Innovation has a policy addressing generative AI in funding application preparation and assessment. The U.S. National Science Foundation has issued requirements concerning generative AI and confidentiality in its merit-review process, including restrictions on reviewers uploading proposal materials to non-approved generative AI tools. The U.S. National Institutes of Health has gone further in a different context: effective for applications submitted to the September 25, 2025 receipt date and beyond, NIH states that applications or sections substantially developed by AI will not be considered the applicants' original ideas.

These are not universal rules for all research. They are examples of why researchers need to check the particular AI restrictions imposed by their funder rather than generalising from another organisation's policy.

Contracts and Data Agreements Can Create Additional Restrictions

Some obligations come from agreements rather than general institutional policy. Industry-sponsored projects, clinical collaborations, licensed datasets, restricted-access archives, government data, and multi-institution projects may be governed by contracts, nondisclosure agreements, data-use agreements, or consortium agreements.

A dataset may be available to you for research without being available for transfer to a third-party AI provider. Similarly, a collaboration agreement may require confidential project information to remain within specified systems. The fact that you are authorised to access information does not necessarily mean you are authorised to disclose it to another service for processing.

Journals and Publishers Govern What Happens at Publication

Publication introduces another authority. Journals and publishers increasingly maintain policies concerning AI-assisted manuscript preparation, disclosure, authorship, generated or modified images, editorial confidentiality, and the use of AI during peer review.

The International Committee of Medical Journal Editors, for example, states that AI and AI-assisted technologies should not be listed as authors and that humans remain responsible for the accuracy and integrity of AI-assisted content. Its recommendations also call for transparency about AI use and warn that uploading submitted manuscripts to AI systems can violate confidentiality where confidentiality cannot be assured.

A journal's rules can therefore matter even when the researcher's institution permits the underlying tool. Whether a journal can impose stricter AI requirements is best understood as a separate publication-governance question.

Professional Guidance Is Not Necessarily the Same as Binding Policy

Researchers will also encounter recommendations from scholarly associations, international organisations, editorial groups, and research-integrity bodies. These documents can be highly influential without necessarily having the same status as legislation, a grant condition, or an institutional rule.

For example, the European Research Area's Living Guidelines on the Responsible Use of Generative AI in Research provide recommendations for researchers, research organisations, and funders. The guidelines were updated in May 2026 to reflect technological developments while continuing to emphasise research integrity, accountability, transparency, and responsible use. UNESCO likewise provides broader guidance on generative AI in education and research.

The distinction matters. A respected international guideline can help you decide what responsible practice looks like, but it does not automatically override a legal requirement, an approved ethics protocol, or a journal's submission policy.

Different Rules Can Apply at Different Stages of the Same Project

The relevant policy set can change as research moves from idea to publication. During proposal development, funder rules may be especially important. During participant recruitment and data collection, ethics and privacy requirements may dominate. During analysis, institutional data-security requirements and the approved methodology become particularly relevant. During manuscript preparation and submission, journal and publisher rules enter the picture.

This also explains why a one-time policy check at the beginning of a multiyear project may not be enough. AI services and organisational policies change quickly, so researchers conducting long projects may need a deliberate process for tracking changes in applicable AI policies.

The AI Task Matters as Much as the AI Tool

A policy rarely becomes meaningful merely because "AI was used." What matters is what the system was asked to do and what information was exposed to it.

Using an approved AI assistant to rephrase a non-confidential sentence may create a very different risk profile from uploading raw interview transcripts. Generating exploratory code from a hypothetical example differs from asking AI to analyse identifiable participant data. Using AI to brainstorm search terms differs from allowing it to generate substantive sections of a funding application.

For policy purposes, document the activity at a useful level of specificity: the tool or system used, the task performed, the information supplied, the output produced, how the output affected the research, and what human verification occurred.

One AI Task Can Trigger Several Policies at Once

The example illustrates a broader principle: AI compliance is usually activity-specific. Asking "Does my university allow ChatGPT?" is often too broad to produce a useful answer. Asking "May I upload these interview transcripts to this version of this service for this analytical purpose under my approved protocol?" is much closer to the question that actually needs answering.

Common Mistakes When Interpreting AI Policies

Check the Policy That Governs the Activity, Not Just the Tool

You do not need to read every AI policy ever written before asking an AI system to improve the wording of a non-sensitive sentence. Policy checking should be proportionate to the activity and its consequences.

The need for careful verification increases when AI will receive confidential, personal, sensitive, proprietary, unpublished, or contractually restricted information; influence research methods or analysis; contribute materially to a proposal or publication; interact with participants; or perform an activity governed by an external authority.

For collaborative work, it can also be useful to establish internal expectations before AI becomes embedded in the workflow. A documented AI-use plan at the beginning of a project can clarify permitted tools, restricted information, documentation practices, verification responsibilities, and disclosure expectations. Such an agreement supplements applicable external requirements. It cannot override them.

What to Check Before Using AI for a Research Task

Frequently Asked Questions About AI Rules in Research

There Is No Single AI Rulebook for Research

How to Cite This Guide

This guide is intended to be read, shared, and used in research, teaching, and academic work. If you draw on its ideas, explanations, or other content, please acknowledge the source by citing the guide. Doing so gives appropriate credit and helps your readers locate the original resource.