03 · What You Need to Know
“Unapproved AI Use” Describes a Process Failure, Not Yet Its Severity
First Determine What Actually Happened
A vague statement such as "they used ChatGPT on the study" is not enough to assess the situation.
Establish the tool or service used, account type, task performed, information entered, outputs produced, dates of use, whether material was retained by the service, how the output entered the research workflow, and whether the activity is continuing.
A factual reconstruction is more useful than beginning with accusations.
| Question |
Why It Matters |
| What AI system was used? |
Different services and account configurations have different institutional approvals and data arrangements. |
| What information was entered? |
Determines potential privacy, confidentiality, contractual, security, and intellectual-property consequences. |
| What did the AI produce? |
Helps identify effects on methods, analysis, writing, code, or interpretation. |
| Was the output used in the research? |
Determines whether results, records, or manuscripts may need review or correction. |
| Is the activity continuing? |
Determines whether immediate containment is needed. |
| Which rules applied? |
Distinguishes an internal procedural deviation from a potentially reportable external breach. |
Stop Ongoing Exposure Before Debating Blame
If confidential or participant information is still being sent to an unapproved service, stop the affected future processing while the situation is assessed.
Containment should be proportionate. Do not automatically delete research records, destroy outputs, or instruct collaborators to erase evidence. Those actions can interfere with investigation, audit, data-retention requirements, or the ability to understand what occurred.
Preserve relevant records while obtaining guidance on what should happen next.
Distinguish an Internal Rule Violation From an External Compliance Problem
A team can establish rules that are stricter than the minimum required externally. Breaking one of those rules does not automatically mean that law, ethics approval, or institutional policy was violated.
Internal deviation
The collaborator departed from the team's agreed procedure, but the activity may still have complied with applicable external requirements.
External compliance issue
The activity may also have breached institutional policy, ethics approval, privacy or security requirements, a contract, funder condition, journal rule, or applicable law.
This distinction matters for proportionality. A team should not label a colleague's procedural mistake as research misconduct merely because the internal workflow was not followed.
Do Not Automatically Call It Research Misconduct
"Research misconduct" is a formal term in many systems and should not be used casually.
Under the U.S. federal research misconduct framework administered by the Office of Research Integrity, research misconduct means fabrication, falsification, or plagiarism in proposing, performing, reviewing, or reporting research. It does not simply mean every violation of a research policy or every instance of poor practice.
Other countries and institutions may use different definitions and broader categories of unacceptable research practice. The relevant institutional framework should therefore determine classification.
Unapproved AI use could contribute to misconduct in some circumstances, for example if it facilitates fabrication or falsification, but the fact that AI was used without team approval does not by itself establish that conclusion.
Assess Whether Research Data Were Exposed
If the collaborator entered participant, confidential, proprietary, or restricted information into an AI service, determine exactly what was transmitted.
Relevant questions include whether the information contained direct identifiers, whether individuals could be re-identified, whether the service retains submitted information, whether provider personnel or subprocessors can access it, and whether the transfer complied with the institution's approved data-handling arrangements.
If a potential privacy or security incident occurred, follow the institution's incident-response procedure rather than attempting to resolve the matter entirely within the research team.
Watch Out
Do not ask the collaborator to conceal, delete, or retrospectively rewrite records merely to make the AI use less visible. Accurate records are essential for determining what occurred and what remediation is appropriate.
Assess Whether the Research Itself Was Affected
Unapproved AI use can create a methodological problem even when no sensitive data were exposed.
If AI generated analytical code, classifications, summaries, statistical interpretations, synthetic observations, or manuscript claims, determine whether those outputs affected the study's results or conclusions.
Re-run analyses where necessary. Verify code independently. Compare AI-assisted classifications with the approved analytical procedure. Check references against original sources. Remove unsupported generated claims.
The goal is to determine whether the research record remains defensible.
Human Verification After the Fact May Not Solve Every Problem
Researchers sometimes respond, "But I checked the output afterward."
Verification can address accuracy, but it does not necessarily resolve confidentiality, privacy, ethics, contractual, or security violations created when information was uploaded in the first place. Nor does checking generated text automatically make a prohibited AI workflow compliant.
Accuracy and permission are separate questions.
Check Whether the Ethics Protocol Was Affected
If the unapproved use involved participant data or altered an approved research procedure, determine whether the responsible ethics body needs to be notified.
The team should not independently assume that retrospective disclosure is unnecessary. Follow the institution's established process for protocol deviations, unanticipated problems, amendments, or other reportable events as applicable.
Check Funder and Contractual Obligations
Funders, data providers, industry partners, and collaborating institutions may impose requirements concerning confidential information, data processing, security, or AI use.
If the unapproved activity potentially violated those requirements, the project lead should determine what notification or remediation process applies.
This is one reason teams should identify funder AI requirements before a problem occurs.
Publication May Need to Pause
If the affected material has entered a manuscript, abstract, report, or submission, verify it before proceeding.
A journal submission should not continue merely because a deadline is inconvenient. Determine whether generated material is accurate, whether methodological reporting needs revision, whether AI disclosure is required, and whether the journal permits the use.
If the manuscript has already been submitted, the appropriate response depends on the significance of the issue and the journal's policies. Seek editorial or institutional guidance when correction is necessary.
The Response Should Address the System, Not Only the Individual
An incident can reveal that the team's rules were unclear, inaccessible, outdated, or never communicated to junior researchers.
ORI guidance on collaborative research emphasises clear roles, management, communication, training, and written agreements. If a reasonable collaborator could not tell what the team's AI expectations were, disciplinary language alone will not fix the underlying governance problem.
After the immediate issue is addressed, review whether the team's AI rules need clarification.
07 · A Quick Checklist
When You Discover Unapproved AI Use
Before deciding how serious the incident is, check:
Stop any continuing AI activity that could create further risk or noncompliance.
Identify the AI service, account type, dates, prompts or tasks, inputs, and outputs involved.
Preserve relevant records rather than automatically deleting evidence of the activity.
Determine whether participant, confidential, proprietary, unpublished, or otherwise restricted information was exposed.
Check which team, institutional, ethics, funder, contractual, legal, and publication requirements applied.
Determine whether AI outputs affected data, analysis, code, interpretations, figures, or manuscripts.
Independently verify or repeat affected research procedures where necessary.
Follow formal incident, ethics, privacy, security, or reporting procedures when applicable.
Correct the team's AI rules, training, or communication if the incident exposed a governance weakness.
