01 · The Question
Who Gets to Say Yes or No to an AI Tool?
A research assistant wants to use generative AI to help code qualitative data. A statistician wants an AI coding assistant. A co-author wants AI to restructure part of the manuscript. Who decides whether these uses are acceptable?
The principal investigator may have overall responsibility for the project, but not every AI decision is simply a matter of managerial authority. A decision involving participant data may require ethics or privacy review. A methodological use may require expertise the principal investigator does not have. A new external service may need institutional security approval.
A good research team therefore distinguishes between decisions it can make internally and decisions that require approval or interpretation from an external authority.
03 · What You Need to Know
Not Every AI Decision Belongs to the Same Person
The Principal Investigator Usually Has an Important Role, but Not Unlimited Authority
Principal investigators commonly carry substantial responsibility for the conduct of a research project, including supervision, compliance, data management, and the integrity of the work. It is therefore reasonable for the principal investigator or equivalent project lead to have an important role in establishing AI-use expectations.
Responsible collaborative research, however, also depends on clearly allocated roles and expertise. The U.S. Office of Research Integrity recommends that collaborators establish responsibilities for project management, data, compliance, publication, supervision, and other research activities rather than leaving important decisions undefined.
The principal investigator cannot personally authorise conduct prohibited by an institutional policy, ethics approval, contract, funder, or applicable law. Leadership responsibility is not a waiver mechanism.
Methodological AI Use Should Involve Methodological Expertise
If AI will materially affect statistical analysis, qualitative coding, image analysis, simulation, modelling, programming, or another research method, someone competent in that method should participate in the decision.
The question is not simply whether the tool is convenient. Researchers need to consider whether its use is methodologically defensible, whether outputs can be verified, whether the procedure can be documented adequately, and whether AI introduces biases or errors relevant to the study.
A project lead who lacks the necessary technical expertise should not become the sole methodological gatekeeper merely because their name appears first on the grant.
Data Decisions Should Involve Whoever Is Responsible for the Data
AI use involving sensitive, confidential, proprietary, participant-level, or otherwise restricted information requires particular care.
The relevant decision may involve the principal investigator, data steward, data protection officer, information-security team, ethics body, dataset owner, or another authority depending on the project.
A research assistant should not independently decide that a participant dataset is "anonymous enough" for an external AI service. Nor should a project leader assume that possession of a dataset means unrestricted authority to disclose it to another processor.
| Proposed AI Use |
Who May Need to Be Involved |
| Grammar assistance with non-confidential text |
Usually individual researcher within established team and institutional rules |
| AI-generated analytical code |
Researcher responsible for analysis and relevant methodological expert |
| AI coding of qualitative participant data |
Project lead, qualitative-methods expertise, data or ethics authority where applicable |
| New AI service processing confidential data |
Project leadership plus relevant privacy, security, data, or institutional authority |
| AI interacting directly with participants |
Project leadership, methodological expertise, and research ethics oversight |
| AI-assisted manuscript preparation |
Authors within applicable institutional and journal requirements |
| Changing an AI method described in an approved protocol |
Research team plus ethics or other approving authority where required |
Research Ethics Decisions Belong to the Ethics Authority
A team can decide that it would like to use AI with participant data. It cannot decide for itself that an ethics amendment is unnecessary when the applicable review procedure assigns that determination to the ethics body.
Where AI changes participant interactions, data processing, confidentiality, risk, or an approved procedure, researchers should determine whether ethics review or approval is required.
The team's role is to formulate and justify the proposed research procedure. The ethics body's role is to exercise the authority assigned to it under the relevant oversight framework.
Information-Security Approval Is Not a Popular Vote
Research teams may prefer a particular AI platform because it is powerful, inexpensive, or familiar. Those advantages do not establish that the service is approved for confidential institutional information.
If institutional policy requires security or privacy assessment of external AI systems, the appropriate institutional office makes that determination. The team should not substitute its own informal technical assessment for required approval.
Individual Researchers Can Retain Discretion for Low-Consequence Uses
Governance becomes counterproductive if every spelling correction requires a committee meeting.
A team can define a category of routine AI activities that individual researchers may undertake without additional project approval, provided those activities remain within applicable external and project rules.
Examples might include using an approved system with public information to brainstorm search terms, explain generic programming syntax, or improve non-confidential prose.
The boundary should be clear enough that researchers know when they have moved from routine discretion into an activity requiring review.
Higher-Risk Decisions Benefit From More Than One Perspective
Consequential AI decisions often cut across several domains. An AI transcription service, for example, raises methodological questions about accuracy, privacy questions about recordings, technical questions about data processing, and ethics questions about what participants were told.
No single researcher necessarily understands all of those dimensions.
The European Commission's updated Living Guidelines for responsible generative AI use in research emphasise accountability and responsibility while recognising responsibilities across researchers, research organisations, and funders. Within a project, the same logic supports involving the people who actually hold the relevant expertise and formal responsibility.
The Team Should Define an Escalation Threshold
Researchers need to know when they can decide independently and when they should stop and ask.
Routine decision
The use falls clearly within established project and external rules and does not introduce new sensitive data, methods, systems, or consequential risks.
Escalated decision
The use introduces a new AI system, sensitive information, participant interaction, substantive methodological change, uncertain policy interpretation, or another consequential departure from the agreed workflow.
This threshold can be incorporated into the team's AI-use plan.
Decision Authority Should Be Documented
If everyone assumes someone else approves AI use, nobody really does.
The project should identify who maintains the rules, who approves routine extensions, who evaluates methodological uses, and who contacts institutional authorities when necessary. Complex projects may use a small governance group rather than assigning every decision to one person.
This is particularly useful in multi-institution collaborations, where one project lead may not have authority over another institution's systems or researchers.
07 · A Quick Checklist
Before Assigning AI Decision Authority
For each consequential AI decision, check:
Identify who is accountable for the research activity affected by the AI use.
Include methodological expertise when AI materially affects methods, analysis, or interpretation.
Include data, privacy, or security expertise when protected information or new systems are involved.
Determine whether ethics, funder, contractual, or institutional approval is required outside the research team.
Define which low-consequence uses researchers may undertake without additional approval.
Establish an escalation process for uncertain or novel AI uses.
Record consequential decisions and the basis on which they were made.
Review decision authority when project roles, collaborators, data, or external policies change.
