Which AI Policy Applies When Researchers From Several Institutions Collaborate?

Which Institution's AI Rules Govern a Joint Research Project?

You are collaborating with researchers from another university. Both institutions have AI policies, but they are not identical. One permits a particular AI service for research data, while the other prohibits it. Which rule applies to the project?

This becomes even more complicated when the collaboration involves shared datasets, joint ethics approval, different institutional systems, external funders, or contractual agreements. A simple rule such as "the principal investigator's university policy applies" may not actually describe the governance arrangement.

The better approach is to determine which institution or authority governs each part of the collaboration. The answer can differ depending on the researcher, the data, the AI system, the research activity, and the agreement under which the collaboration operates.

There May Be Several Applicable AI Policies

Multi-Institution Research Creates Multiple Governance Layers

Your Home Institution Does Not Automatically Become Irrelevant

A researcher generally remains subject to the policies that govern their relationship with their own university or research organisation. This can include rules on information security, confidentiality, data protection, acceptable technology use, research integrity, intellectual property, and approved software.

As a result, a collaborator cannot necessarily say, "Our lead university allows this AI tool, so everyone on the project can use it." The lead institution's policy may be relevant to some project activities without eliminating the obligations of other researchers.

This is a natural extension of the broader principle that AI use in research can be governed by several overlapping authorities.

The Research Activity Matters More Than Institutional Membership Alone

Consider three researchers from three institutions working on one project. One prepares a public literature review, another processes identifiable participant data, and a third develops analytical code using a restricted dataset.

It would be unnecessarily crude to ask which single university policy governs "the project." The more useful question is which rules govern each activity.

This activity-based approach usually produces a more defensible governance model than choosing one institution as the universal policy source.

The Collaboration Agreement Can Matter More Than a General AI Policy

Multi-institution projects are often governed by formal agreements. Depending on the project, these may address data access, confidentiality, intellectual property, security, publication, responsibilities, or permitted uses of shared information.

That agreement can impose requirements that researchers would not discover by searching either university's general AI page.

NIH guidance on responsible data sharing illustrates the importance of agreements in collaborative research. NIH recommends that data-sharing and data-use agreements clarify responsibilities, limitations on data use, privacy and confidentiality protections, and the roles of parties receiving access to research data.

For AI use, this can be decisive. A collaboration agreement may permit researchers to access a dataset for scientific analysis while prohibiting them from transferring it to third-party services without additional authorisation.

Shared Data Creates a Shared Risk Even When Policies Differ

Suppose Institution A allows an AI platform with institutionally managed security controls. Institution B does not approve that platform for confidential data. If the project stores sensitive data in Institution B's environment and researchers from Institution A want to transfer that data to the AI platform, the question cannot be answered solely from Institution A's policy.

The team needs to determine what authority governs that dataset and transfer. The relevant constraints may come from the data provider, ethics approval, contract, privacy law, institutional security requirements, or the agreement between the collaborators.

NIH's data-sharing guidance emphasises that human-participant data sharing must address privacy and confidentiality risks and may require controlled access or other safeguards. These issues do not disappear merely because the people accessing the data belong to different institutions.

One Institution May Control the Infrastructure

Sometimes the simplest solution is determined by where the actual processing occurs.

If a university hosts the secure research environment and controls the dataset, its security requirements may determine which AI tools can operate there. If another institution owns a restricted dataset, that institution may impose conditions on how collaborators access or process it.

This does not mean infrastructure ownership automatically resolves every policy question. It means that technical control and institutional authority should be identified explicitly rather than assuming they are irrelevant.

A Joint Ethics Arrangement Does Not Necessarily Eliminate Local Requirements

Multi-institution studies can use different arrangements for ethics oversight, including reliance agreements or other collaborative review structures where permitted. The exact arrangement matters.

An ethics approval may establish what the study is allowed to do with participant data, but institutional privacy and security requirements may still govern the systems used to carry out those procedures. Researchers therefore need to understand both the ethical approval and the institutional controls around the data.

If adding AI changes the approved research procedure, the team should determine whether the relevant ethics body must review that change, just as an individual researcher would when introducing AI into an approved human-participant study.

Funder Requirements Can Sit Above the Institutional Arrangements

A common funder can impose conditions on all participating institutions. Those conditions may concern data management, confidentiality, research integrity, security, reporting, or AI use in applications and assessment.

That creates another layer. The fact that two universities have compatible internal policies does not establish that their shared procedure satisfies the funder.

Researchers should therefore identify the funder's AI requirements separately from the institutional rules.

The Team May Need a Common Minimum Standard

Once the applicable requirements have been mapped, the team needs a practical operating rule.

A sensible approach is to identify the most restrictive requirement that legitimately applies to a particular shared activity and build the workflow around it where doing so allows the team to satisfy all relevant obligations. This is a practical coordination strategy, not a universal legal principle that "the strictest policy always wins."

For example, if one partner's policy permits public AI tools for public material and another partner's policy allows only institutionally approved AI for any project-related material, the team may choose the approved institutional environment for the shared workflow. This can reduce ambiguity and simplify training, documentation, and oversight.

The approach becomes more important when research teams establish a common AI-use plan at the beginning of the project.

Document Who Is Responsible for What

A multi-institution AI workflow should identify responsibility rather than treating "the consortium" as though it were one person.

At minimum, collaborators should know who decides which AI systems are approved, who controls the relevant data, who verifies outputs, who handles incidents, who maintains records, and who communicates with the ethics body, funder, or journal when questions arise.

Clear allocation of responsibility becomes particularly important when an AI output contributes to a joint publication and multiple institutions need to demonstrate how the work was conducted.

Policy Conflict Should Be Resolved Before the Shared Workflow Begins

If Institution A allows a service but Institution B prohibits it, do not wait until after the shared dataset has been uploaded to decide what the collaboration's rule should have been.

Identify the conflict early, establish whether the restrictions attach to particular researchers or shared project material, and ask the responsible institutional authorities for clarification where necessary.

A documented resolution is especially useful for projects lasting several years, because AI policies can change and new collaborators may join after the original agreement was created.

Two Universities, One Dataset, Different AI Policies

Common Mistakes in Multi-Institution AI Research

Build the AI Workflow Around the Shared Activity

For multi-institution work, the most useful unit of analysis is usually the shared activity rather than the institution alone. Ask who controls the data, who performs the AI processing, whose systems are involved, what approvals apply, and what agreement governs the collaboration.

A common written AI-use plan can then turn the result into operational instructions for the team. This becomes especially important when collaborators join from different departments, institutions, or countries.

Before Collaborators Use AI on Shared Research

Frequently Asked Questions About Multi-Institution AI Policies

There May Be No Single AI Policy for a Joint Project

How to Cite This Guide

This guide is intended to be read, shared, and used in research, teaching, and academic work. If you draw on its ideas, explanations, or other content, please acknowledge the source by citing the guide. Doing so gives appropriate credit and helps your readers locate the original resource.