03 · What You Need to Know
Resolving Institutional AI Policy Conflicts in Collaborative Research
Why Different Universities May Have Different AI Rules
Universities may adopt different AI policies because they operate under different institutional risk assessments, contractual arrangements, information-security capabilities, and research governance structures.
One institution may provide an enterprise AI environment with specific contractual protections. Another may restrict external AI processing until its information-security office completes an assessment.
These differences do not necessarily indicate that one institution understands AI better than another.
They may reflect different obligations, resources, and acceptable processing arrangements.
Research collaborators should therefore examine the substance of each policy rather than treat institutional disagreement as evidence that one rule must be unreasonable.
Permission to Use an AI Tool Is Not Universal Authorization
Institutional approval can have a limited scope.
A university may approve an AI system for public literature exploration, programming assistance, or administrative writing while prohibiting the upload of identifiable participant records.
Approval may also apply only to particular accounts, departments, or technical configurations.
For example, an institutionally managed AI service may operate under contractual terms that do not apply to a collaborator's personal account with the same provider.
Researchers should distinguish access to the tool from authorization to process particular information.
The relevant question is not merely whether the university allows the product, but whether the proposed research activity is permitted under the actual arrangement.
Which Institution's Policy Applies?
There is no universal rule that the lead institution's policy automatically overrides every other requirement.
The applicable obligations depend on who is conducting the activity, which institution controls the information, where processing occurs, and what agreements govern the research.
For example, University B may impose restrictions on data collected under its research ethics approval.
Those restrictions may remain relevant even when University A provides the technical infrastructure.
Conversely, University A may establish rules governing its own researchers and institutional systems that University B's collaborators must respect when accessing them.
Researchers should identify the authority and scope of each obligation rather than assume that institutional rank, project leadership, or technological ownership determines the answer.
Different Institutional Rules May Govern Different Activities
| Requirement |
Potential scope |
Research implication |
| Institutional AI policy |
Staff, students, approved tools, and permitted activities |
May restrict particular AI uses |
| Research ethics approval |
Approved procedures and participant information |
May limit data processing or require amendments |
| Data-sharing agreement |
Access, transfers, permitted uses, and recipient obligations |
May restrict external AI processing |
| Information-security policy |
Systems, accounts, access, and data classifications |
May require an approved processing environment |
| Funder agreement |
Funded activities and contractual responsibilities |
May impose additional conditions |
| Applicable data-protection law |
Processing activities within its legal scope |
May require safeguards or impose restrictions |
| Journal policy |
Manuscript preparation, submission, and publication |
May establish disclosure or other AI requirements |
Several requirements may apply simultaneously. The team should establish whether the proposed workflow satisfies each relevant obligation.
Why the Lead Institution Does Not Automatically Have the Final Say
A principal investigator may coordinate a project, but project leadership does not necessarily confer authority to override another institution's contractual or research ethics obligations.
For example, the lead university may host the shared dataset while a partner institution retains obligations concerning the participant information it contributed.
The research agreement may specify which organization is responsible for particular processing decisions.
Where responsibilities are unclear, the relevant institutional authorities should clarify them.
The team's governance arrangement should reflect actual legal and institutional responsibilities rather than informal assumptions about who leads the study.
Why Data Ownership Alone May Not Resolve the Conflict
Researchers sometimes assume that the institution owning a dataset can authorize any subsequent processing.
However, ownership, custodianship, contractual control, and personal data protection are distinct concepts.
A university may possess research records while remaining subject to participant consent, confidentiality obligations, or applicable privacy law.
Similarly, a collaborating institution may have access rights without unrestricted authority to transfer the information elsewhere.
The team should examine the actual data governance arrangement rather than rely exclusively on a general claim of ownership.
Can a University Prohibit AI Use by Researchers at Another Institution?
An institution ordinarily governs its own personnel and systems through its internal policies.
However, its restrictions may also affect external collaborators through contracts, data-sharing agreements, access conditions, or research protocols.
For example, University B may require that information it supplies be processed only through approved systems.
University A's researchers may need to comply with that condition when using University B's information, even if their own institution generally permits a wider range of AI tools.
Whether such a restriction is enforceable depends on the actual agreement and applicable law.
Researchers should not assume that an internal university policy automatically has unlimited extraterritorial authority.
Why the Strictest Policy Is Not Always the Complete Answer
Research teams may attempt to resolve disagreement by adopting whichever policy appears most restrictive.
This can be a useful precaution, but it is not a complete method for determining compliance.
For example, one institution may prohibit external data transfers while another requires specified retention and audit procedures.
Neither requirement can necessarily be reduced to a simple ranking of strictness.
The team must determine whether the proposed workflow satisfies all applicable obligations.
Where requirements are incompatible, researchers may need an alternative arrangement or formal institutional clarification.
How Should Researchers Evaluate the Actual AI Tool?
The assessment should examine the service configuration and processing arrangement rather than the product name alone.
Relevant considerations may include data retention, provider access, subprocessors, processing locations, access controls, and contractual protections.
Some services provide different conditions for institutional and personal accounts.
Consequently, approval of one configuration should not automatically be extended to another.
The related question of managing AI tools with different privacy policies requires examining actual provider terms and the information being processed.
What If the Shared Data Include Research Participants?
Participant information may be governed by approved research procedures, consent arrangements, confidentiality commitments, and data-protection requirements.
Introducing an external AI service may create a new processing arrangement.
For example, a research ethics approval may authorize interview analysis by named researchers using institutional systems without expressly addressing external AI processing.
Whether additional authorization is necessary depends on the approved protocol and institutional procedures.
Researchers should consult the relevant research ethics authority before implementing a material change.
Approval from another university does not automatically modify the original research ethics conditions.
Can Researchers Avoid the Conflict by Removing Identifiers?
Removing direct identifiers may reduce some confidentiality risks.
However, participants may remain identifiable through contextual details, combinations of characteristics, or unusual experiences.
Some data-sharing agreements also restrict processing of information that is not directly identifiable.
Researchers should therefore assess whether de-identification is sufficient for the particular purpose and processing environment.
It should not be treated as automatic authorization for a previously prohibited activity.
What If the Institutions Are in Different Countries?
International collaboration may introduce additional legal and contractual requirements.
For example, the European Union's General Data Protection Regulation establishes requirements concerning personal data processing and international transfers when it applies.
In the Philippines, Republic Act No. 10173 establishes a framework for personal information protection.
The applicability of these laws depends on the organizations, information, and processing activities involved.
Researchers should avoid assuming that one country's rules automatically govern every aspect of a multinational project.
Appropriate institutional or legal guidance may be necessary to establish the permitted data flows.
What Alternatives Are Available When an AI Tool Is Prohibited?
A restriction on one tool does not necessarily prohibit every form of AI-assisted research.
Depending on the applicable requirements, the team may use an approved institutional environment, perform certain tasks without AI, or restrict AI assistance to public and nonconfidential information.
For example, researchers might use synthetic data to explore general analytical code while processing the actual confidential dataset through authorized software.
However, synthetic data should be constructed and handled appropriately, particularly when derived from sensitive records.
Alternative arrangements must satisfy the same governing obligations as the original proposal.
Should Collaborators Standardize on One Approved Tool?
Using a shared authorized environment may simplify governance and documentation.
However, standardization is not always necessary.
Researchers may use different tools for public literature exploration, programming, and nonconfidential language editing while reserving restricted data processing for approved systems.
The appropriate arrangement depends on the research tasks and applicable requirements.
The objective should be authorized and accountable processing rather than uniform software use for its own sake.
What If a Collaborator Already Used the Prohibited Tool?
The team should establish what information was processed, which service received it, and which requirements may have been affected.
If restricted data were transferred without authorization, the responsible institution's information-security or research ethics incident procedures may apply.
Relevant authorities may need to assess containment, provider contact, notification, or other corrective measures.
Deleting a conversation does not necessarily establish that all processed information has been removed.
The team should avoid concealing the incident or assuming that the absence of immediate harm eliminates reporting obligations.
How Should the Conflict Be Documented?
The team should preserve an accurate record of the applicable requirements, proposed AI activity, institutional clarification, and final decision.
For example, a decision record may identify that external AI processing of interview transcripts was not authorized and that an approved alternative was selected.
Documentation should be proportionate and should not unnecessarily reproduce confidential research information.
It may be incorporated into the project's data-management plan or research team AI-use agreement.
Material changes should be communicated before collaborators implement the revised workflow.
Who Should Resolve the Disagreement?
The principal investigator may coordinate discussions, but the relevant institutional authorities should resolve questions within their respective responsibilities.
These may include research ethics committees, information-security offices, data-protection personnel, research governance offices, or legal advisers.
For example, an information-security office may assess a technical processing environment, while a research ethics committee determines whether a proposed procedure is consistent with the approved protocol.
The precise allocation of authority depends on institutional arrangements.
Researchers should not rely on an AI-generated interpretation of institutional rules as the final decision.
Why Institutional Restrictions Should Be Reviewed Over Time
AI tools, provider agreements, institutional policies, and research activities may change.
A tool prohibited for confidential data processing at one point may later become available through an approved institutional arrangement.
Conversely, changes to a service or project may introduce new restrictions.
Researchers should review the applicable conditions before materially changing the workflow.
However, later authorization does not automatically make earlier unauthorized processing compliant.
Institutional requirements should be evaluated according to the conditions applicable when the activity occurred.
What Is the Research Integrity Implication?
The European Code of Conduct for Research Integrity emphasizes reliability, honesty, respect, and accountability.
These principles support accurate representation of research procedures and responsible handling of confidential information.
However, institutional policy conflicts should not automatically be characterized as misconduct.
A disagreement may arise from legitimate differences in governance arrangements or uncertainty about authority.
The appropriate response is to clarify obligations, protect the research, and follow applicable procedures.
Research integrity requires more than selecting a technically capable AI system. It also requires using that system within the conditions governing the research.
