03 · What You Need to Know
Determining the Appropriate Level of AI Processing Disclosure
Why More Information Does Not Always Mean Better Informed Consent
Informed consent is intended to support a meaningful decision about research participation. It is not simply an exercise in providing the largest possible quantity of information.
For example, participants may need to know that their interview transcripts will be processed through an external AI service. They may not need a detailed explanation of transformer architectures, tokenization, or model parameters.
Excessive technical information can obscure the practical implications of participation, particularly when important details are buried among explanations that participants cannot readily interpret.
Under the United States Common Rule, 45 CFR 46.116 requires consent information to be presented in understandable language and organized to facilitate comprehension, including a concise and focused presentation of key information in applicable cases.
These requirements apply within that regulatory framework rather than universally to every study. Nevertheless, they illustrate why meaningful consent involves communicating relevant information effectively rather than maximizing document length.
Distinguish Material Information From Technical Background
Researchers should identify which aspects of AI processing may affect participants' decisions, expectations, or rights.
Material processing information
Information about what will happen to participant data, why it will happen, who may be involved, and what consequences or choices are relevant.
Technical background information
Details about how the system operates internally that may not be necessary for understanding the research activity.
For example, whether interview recordings will be transferred to an external provider may be material. The number of model parameters is unlikely to be relevant unless a particular technical feature affects the study's risks or procedures.
The distinction is contextual. Researchers should not assume that every technical detail is irrelevant or that every provider feature requires a separate consent statement.
What Information Should Participants Generally Receive?
When AI processing is relevant to informed participation, several categories of information may warrant explanation.
| Information Category |
What Participants May Need to Understand |
Illustrative Explanation |
| Purpose of AI use |
Why the system will be used. |
AI will assist with organizing interview responses. |
| Information processed |
What participant data will be submitted. |
Selected portions of interview transcripts will be processed. |
| Processing organization |
Whether an external provider or another organization is involved. |
The research team will use an institutionally authorized external service. |
| Processing location |
Whether data may be processed outside the institution or jurisdiction. |
Processing may involve infrastructure in another country, where applicable. |
| Retention |
Whether and for how long submitted information may be retained. |
The service retains information according to verified contractual conditions. |
| Researcher oversight |
How AI-generated outputs will be checked and used. |
Researchers will review suggested categories against the original transcripts. |
| Risks and safeguards |
What foreseeable concerns exist and how they will be addressed. |
Direct identifiers will be removed and contextual identification risks assessed. |
| Participant choices |
Whether participants have relevant options or rights concerning processing. |
Available choices and withdrawal procedures will be explained. |
These are potential disclosure elements rather than a universal checklist of mandatory wording. The relevant details depend on the research and applicable requirements.
Researchers should verify the actual arrangements before describing them to participants.
Explain What AI Will Do With the Information
Participants may understand the phrase "AI-assisted research" in different ways.
For example, one participant may assume that AI will correct transcription errors, while another may believe the system will independently evaluate their professional competence.
A useful disclosure should describe the actual task.
If AI will generate preliminary coding suggestions, explain that function rather than describing the system vaguely as analyzing participant behavior.
If AI will conduct interviews or provide personalized feedback, the explanation should reflect that direct interaction.
Researchers should avoid implying that AI will independently determine the meaning of participants' experiences when the system is intended only to support preliminary organization.
Identify the Information AI Will Receive
Participants may consider it important whether AI will receive complete interview transcripts, selected excerpts, recordings, or aggregated information.
For example, processing selected de-identified excerpts differs from submitting complete identifiable transcripts containing personal and professional disclosures.
Researchers should describe the categories of information accurately and avoid calling data anonymous merely because names have been removed.
Qualitative transcripts may remain identifiable through institutional positions, distinctive events, or combinations of contextual details.
Disclosure should therefore reflect the actual identifiability and sensitivity of the material rather than relying on reassuring terminology.
Explain External Processing Without Suggesting That Data Become Public
When an external AI provider processes participant information, researchers may need to explain that another organization is involved.
However, external processing does not necessarily mean that the information becomes publicly available or is used to train models.
The actual conditions depend on the service configuration and contractual arrangements.
Researchers should distinguish restricted processing by an authorized provider from unrestricted public disclosure.
They should also avoid describing an AI chat as private in a way that implies the information never leaves the institution when the service operates externally.
The relevant considerations are explored further in whether an AI provider becomes a recipient of research data.
Should Participants Know Where AI Processing Occurs?
Processing location may be relevant when participant information is transferred to another jurisdiction or when applicable law requires information about international data transfers.
For example, a university may use an AI service whose infrastructure processes data outside the country where the research was conducted.
Participants may need appropriate information about such arrangements, particularly where they affect applicable protections or rights.
However, the exact technical location of every server is not necessarily required in every consent form.
Researchers should verify what location information is available and what disclosure is required under the governing framework.
The issue is addressed more specifically in disclosing AI processing locations to participants.
Explain Data Retention Accurately
Participants may want to know whether an AI provider retains submitted information and what happens after processing.
For example, a service may retain certain prompts, files, or operational logs under specified conditions.
Researchers should distinguish retention of original research records by the institution from retention associated with an external AI service.
They should not promise that deleting a conversation immediately removes every copy unless the actual service arrangement supports that claim.
Where retention conditions are material or legally required to be disclosed, the participant information should explain them in understandable terms.
Further considerations concerning AI provider data retention disclosure should be based on verified provider conditions.
Do Participants Need to Know Whether AI Outputs Will Be Verified?
Researcher oversight may be relevant when AI-generated outputs contribute to findings or decisions affecting participants.
For example, an AI system may suggest preliminary themes from interview transcripts. Researchers may then review those suggestions against the original data.
Explaining that human researchers retain responsibility for interpretation may help clarify the system's role.
However, the statement should describe an actual verification procedure rather than offer a general assurance that all outputs are accurate.
Human oversight also does not eliminate every concern, including unauthorized data processing or unsupported sensitive inferences.
Should Researchers Disclose Possible AI Errors?
Relevant limitations and foreseeable risks should be communicated in a way that supports informed participation.
For example, if participants will receive AI-generated educational feedback during an intervention, inaccurate or inappropriate responses may be material to their decision.
By contrast, an AI tool used only to organize preliminary research notes may have different implications.
Researchers should explain risks proportionately rather than present an exhaustive catalogue of hypothetical AI failures.
They should also describe the safeguards intended to manage relevant risks without claiming that those safeguards eliminate uncertainty.
Can Researchers Use Layered Disclosure?
Layered disclosure can provide key information in the main participant information sheet while making additional detail available through supplementary materials.
For example, the main document might explain that an external AI service will process selected interview excerpts for preliminary organization.
A supplementary data-processing statement could provide more detailed information about the provider, retention, and relevant technical safeguards.
However, essential information should not be hidden in an optional document that participants are unlikely to encounter.
Layering should improve comprehension rather than reduce the visibility of material information.
Researchers should also follow institutional requirements concerning the approved format and content of participant materials.
How Can Researchers Determine Whether a Disclosure Is Too Vague?
A practical approach is to ask whether a participant could reasonably understand what happens to their information from the statement provided.
| Disclosure Wording |
Limitation |
More Informative Alternative |
| "AI may be used." |
Does not identify the function or information involved. |
"AI will assist with preliminary organization of selected interview excerpts." |
| "Your data will be secure." |
Provides an unsupported general assurance. |
"The processing will follow the verified security and access conditions approved for the study." |
| "Your responses will remain anonymous." |
May be inaccurate when contextual identification remains possible. |
"Direct identifiers will be removed, and contextual identification risks will be assessed." |
| "AI will analyze your responses." |
Does not explain the analytical role or oversight. |
"AI will suggest preliminary categories that researchers will review against the original responses." |
The alternatives are illustrative and should only be used when they accurately describe the approved research procedures.
Clearer language should not be confused with a guarantee that the underlying processing is ethically acceptable.
How Can AI Help Review the Completeness of Participant Disclosure?
Generative AI may assist with identifying potentially missing explanations in draft participant information materials.
However, it cannot establish actual provider conditions or institutional requirements without verified information.
Illustrative AI Prompt
Reviewing AI Processing Disclosure for Completeness and Clarity
"Review the following draft participant information statement describing generative AI processing. I will provide the approved research procedures, data categories, verified provider arrangements, retention conditions, participant rights, and institutional requirements. Identify information that may be missing or unclear concerning the purpose of AI use, data inputs, external processing, confidentiality, retention, researcher oversight, and participant choices. Distinguish information material to informed participation from unnecessary technical detail. Suggest clearer wording without inventing provider policies, institutional approval, or privacy guarantees. Flag unresolved facts for verification."
The researcher should verify the resulting suggestions and obtain the required institutional review before using revised consent materials.
What Does the Philippine Data Privacy Act Require?
In the Philippines, the Data Privacy Act of 2012 establishes principles of transparency, legitimate purpose, and proportionality in personal information processing.
Section 16 includes data subject rights concerning information about the processing of personal data, subject to the Act's provisions and applicable exceptions.
Relevant disclosures may concern the purpose and scope of processing, recipients or classes of recipients, retention, and other information specified by the law.
Researchers should distinguish the requirements of data-protection notices from those of research participation consent, although the documents may overlap in practice.
The applicable legal basis for processing personal information should not automatically be equated with consent to participate in a research study.
Researchers should consult institutional ethics and data protection personnel when the proposed AI processing raises uncertainty about disclosure obligations.
What If the Processing Arrangements Are Not Yet Known?
Researchers should not invent provider conditions or promise safeguards that have not been verified.
For example, if the AI service has not yet been selected, the researcher may be unable to establish its retention period, processing locations, or contractual conditions.
In such circumstances, the researcher should identify the unresolved arrangements and follow the institutional process for finalizing the proposed processing before implementation.
A vague statement that "an appropriate AI service will be used" should not be treated as sufficient authorization for transferring participant information to any later-selected provider.
The relevant details should be established before the researcher makes factual assurances or begins processing protected information.
How Much Disclosure Is Enough?
There is no universal word count or fixed number of paragraphs that makes an AI disclosure sufficient.
The appropriate detail depends on the nature of the processing, its risks, participant population, applicable requirements, and the decisions participants are being asked to make.
A low-risk administrative activity may require little or no separate explanation. An AI-mediated intervention involving sensitive participant information may require considerably more detail.
Researchers should evaluate whether the disclosure communicates the material facts accurately and understandably.
The goal is not to produce the shortest possible consent form. It is to avoid both material omissions and unnecessary complexity.