Should Researchers Name the Specific AI Provider in the Consent Form?

Should Your Consent Form Say ChatGPT, OpenAI, or Simply Generative AI?

You are preparing a consent form for a qualitative study involving university instructors. The research team plans to use ChatGPT to assist with organizing selected interview excerpts and generating preliminary analytical categories.

You decide to disclose AI involvement, but you are uncertain how specifically the provider should be identified.

Would stating that "generative AI will assist with data analysis" be sufficient? Should the form explicitly name OpenAI as the provider? What if the university later changes its approved AI service or the research team decides to use a different model?

Naming a provider may appear to improve transparency. However, the provider's name alone does not explain whether participant information will be processed through a consumer chatbot, an enterprise service, or another arrangement with different contractual protections.

The relevant question is whether identifying the provider helps participants understand the processing of their information and whether the applicable ethical and legal requirements call for that identification.

Name the Provider When Its Identity Is Required or Material to the Processing

How to Identify AI Providers Appropriately in Research Consent Materials

Why Does the AI Provider's Identity Matter?

An AI provider may operate the system through which participant information is processed. Depending on the service arrangement, it may receive data, process information under contractual instructions, retain operational records, or involve additional subprocessors.

Participants may reasonably consider the involvement of another organization relevant to their decision to participate.

For example, a university instructor may be comfortable having interview transcripts analyzed within the university but have questions about submitting those transcripts to an external commercial service.

However, provider identity does not independently establish whether a processing arrangement is appropriate or inappropriate.

Two services operated by the same provider may have different retention, access, security, and contractual conditions.

The ethical significance therefore concerns both who operates the system and what the organization is authorized to do with the information.

Distinguish the AI Provider, Product, and Processing Arrangement

Researchers sometimes use a product name as though it fully describes the processing environment.

For example, saying that a study uses ChatGPT identifies a product family but may not specify the subscription, institutional agreement, or data-handling configuration.

The processing arrangement adds another important dimension: the contractual and technical conditions governing how information is handled.

For example, a researcher might use an institutionally managed AI service with specified data retention and access restrictions. Those conditions may be more relevant to confidentiality than the provider's brand name alone.

Researchers should identify the actual service and verify the conditions governing their particular account rather than rely on general statements about the provider.

What Do Data-Protection Frameworks Require?

Data-protection laws may require information about organizations receiving personal data, although the precise disclosure obligations differ across jurisdictions.

Under the European Union's General Data Protection Regulation, Articles 13 and 14 require information about recipients or categories of recipients of personal data, where applicable.

This does not necessarily mean that every individual processor must always be named in every research consent form. The legal requirements depend on the processing circumstances and the applicable transparency obligations.

In the Philippines, Republic Act No. 10173 establishes data subject rights and transparency requirements concerning personal information processing.

Section 16 includes information concerning recipients or classes of recipients to whom personal data are or may be disclosed, subject to the Act's provisions.

Researchers should therefore distinguish a legal requirement to provide information about data recipients from an assumed universal requirement to identify every AI product by brand name.

They should also recognize that a research consent form and a data privacy notice may serve related but distinct purposes.

When Might Naming the Specific Provider Be Appropriate?

Several circumstances may make provider identification particularly relevant.

These examples are illustrative rather than universal legal determinations.

The appropriate wording depends on what the provider will do, the information involved, and the governing institutional requirements.

Is Naming OpenAI or ChatGPT Enough?

No. Identifying a provider or product does not necessarily explain how participant information will be handled.

For example, a consent form stating "ChatGPT will be used to analyze interviews" leaves several important questions unanswered.

Will the system receive complete transcripts or selected excerpts? Will the information be identifiable? What processing conditions apply? How will researchers verify the output?

Different service configurations may also have different contractual and data-handling arrangements.

Researchers should not assume that a provider's general privacy statements apply identically to every product, account, or institutional agreement.

The name can help identify the service, but the processing description must explain what the research team actually intends to do.

Can Researchers Identify a Category of Providers Instead of Naming One?

Potentially. Some legal frameworks allow information about categories of recipients, and institutions may accept appropriately specific descriptions of certain processing arrangements.

For example, a participant information sheet might describe the use of an institutionally authorized external AI processing service.

However, such wording should not be used to conceal the involvement of a particular organization when its identity is required or materially relevant.

Researchers should also avoid vague categories such as "technology partners" when they fail to communicate the actual processing relationship.

If the provider has not yet been selected, the researcher should clarify the proposed conditions and follow the institution's approval process before transferring participant information.

The appropriate level of specificity should be established through applicable ethics and data-protection requirements.

Should the Provider Be Named in the Consent Form or Privacy Notice?

Research institutions may use separate documents for informed consent and personal data processing information.

For example, a consent form may explain the research purpose and participation procedures, while a privacy notice provides detailed information about data recipients, retention, and data subject rights.

These documents may overlap, but they do not necessarily serve identical legal or ethical functions.

Researchers should follow the institution's approved documentation structure and ensure that participants can access material information before making relevant decisions.

Placing provider information in a privacy notice does not justify concealing material processing from the consent process.

Conversely, naming the provider in a consent form does not automatically satisfy every applicable privacy notice requirement.

Why Provider Identity Does Not Establish Confidentiality

A recognizable AI provider may offer several products with different processing arrangements.

Researchers should therefore avoid statements such as "Your information is safe because we use a well-known AI provider."

Confidentiality depends on the actual safeguards, contractual conditions, access restrictions, and institutional authorization.

For example, an appropriately configured enterprise service may operate under specific restrictions on data use and retention.

However, the researcher must verify that those restrictions apply to the particular service used for the study.

Provider reputation is not a substitute for assessing the actual processing arrangement.

What If the AI Provider Changes During the Study?

Researchers may need to change providers because of institutional procurement decisions, service availability, or methodological requirements.

For example, a study may initially plan to use one authorized AI service but later consider another provider with different retention or processing conditions.

The researcher should compare the new arrangement with the approved protocol and participant information materials.

If the provider change materially affects data processing, confidentiality, participant expectations, or approved procedures, institutional notification, amendment, or additional participant information may be required.

However, not every technical substitution necessarily requires reconsent or a new ethics application.

The appropriate procedure depends on the significance of the change and the governing requirements.

Researchers should examine changes to AI processing after participants have consented before implementing a materially different arrangement.

Can Researchers List Several Potential Providers?

Some studies may anticipate using more than one AI service, particularly when different systems perform different functions.

For example, one service may transcribe interviews while another assists with organizing de-identified excerpts.

Researchers should accurately describe the intended processing and identify relevant organizations or recipient categories as required.

However, listing numerous hypothetical providers should not be used to create unrestricted permission to transfer participant data to any service later selected.

The proposed arrangements should be sufficiently defined for meaningful institutional review and participant information.

Where a provider is selected later, the researcher should verify its conditions and determine whether the existing authorization covers its use.

Should Participants Be Told Whether the Provider Uses Data for Model Training?

Whether submitted research information may be used for model improvement or training can be material to participant understanding and data-protection assessment.

However, the answer depends on the actual provider, product, settings, and contractual agreement.

Researchers should not assume that every AI service uses submitted data for training or that every service prohibits such use.

Where the processing conditions restrict model training, the researcher should verify that the restriction applies to the specific arrangement.

Similarly, where broader processing is permitted, the researcher should determine whether it is compatible with the approved research purpose and applicable requirements.

Disclosure should reflect verified conditions rather than generalized claims about the provider.

How Does Provider Identity Relate to Data Retention?

Different AI providers and service configurations may retain submitted information for different purposes and periods.

For example, a service may retain certain operational logs even when user-visible conversations are deleted.

Researchers should distinguish the retention of research records by the institution from retention associated with the AI provider.

Participants may need information about these arrangements when they are material or legally required to be disclosed.

Naming the provider does not automatically communicate its retention conditions.

The separate issue of whether participants should be told about AI provider data retention requires attention to the actual service agreement.

Does Naming the Provider Affect Participant Expectations?

Potentially. Participants may have different expectations about information processed within their university and information handled by an external technology company.

For example, an instructor may agree to a confidential interview expecting the research team to examine the transcript through institutionally controlled procedures.

Learning that a commercial AI provider will process the transcript may prompt questions about access, retention, or the possibility of further processing.

However, researchers should not assume that every participant will object to external AI involvement. Some may regard the arrangement as acceptable when appropriate safeguards are explained.

The relevant ethical concern is whether the participant information accurately reflects the processing relationship.

This connects to the distinction between institutional permission and participant expectations.

What Does an Appropriate Provider Disclosure Look Like?

A useful disclosure identifies the relevant service and explains its function without making unsupported claims about confidentiality.

This wording is a template rather than an assertion that any particular provider or service has been authorized.

Researchers should replace the placeholder with verified information and ensure that the referenced privacy notice actually contains the relevant details.

The final wording should be consistent with the approved protocol, provider agreement, and applicable institutional requirements.

How Can AI Help Draft Provider Disclosure Language?

Generative AI can help organize information about a proposed service and prepare understandable consent wording.

However, it should not be relied upon to determine the provider's actual contractual or legal obligations.

The researcher should verify the resulting draft against authoritative provider documentation and the applicable institutional agreement.

Can Provider Disclosure Replace Ethics Approval?

No. Naming an AI provider does not independently authorize the transfer or processing of participant information.

For example, a researcher cannot make an unauthorized external processing arrangement acceptable merely by identifying the provider in the consent form.

The proposed workflow must still satisfy applicable research ethics, data protection, information security, and institutional requirements.

Likewise, the provider's identity does not establish that AI-generated interpretations are methodologically valid.

Disclosure supports informed participation but does not replace substantive evaluation of the processing arrangement.

What If the Provider Cannot Be Identified Clearly?

Sometimes a research team may use a service that incorporates AI capabilities supplied by another organization.

For example, an institutional application may provide an AI interface while relying on a separate provider for model processing.

The researcher should determine which organizations are involved in the relevant data processing arrangement and what information must be disclosed.

However, the organization supplying the underlying model is not automatically a direct recipient of participant data in every technical configuration.

The actual information flow and contractual relationships must be examined.

Researchers should not infer provider roles solely from branding or the name of the model displayed in the interface.

Where the arrangement is unclear, appropriate institutional technical and data-protection personnel should be consulted before protected information is processed.

Deciding Whether to Name an AI Provider in an Interview Consent Form

The decision is not based solely on whether the provider is recognizable. It depends on the actual processing relationship and the information participants need under the applicable requirements.

Even when the provider is named, the researcher must still explain the material features of the processing arrangement rather than rely on the name to communicate confidentiality or authorization.

Common Misconceptions About Naming AI Providers in Consent Forms

Identify the Provider When It Helps Explain a Material Processing Relationship

Before finalizing a consent form, determine which AI service will actually process participant information and under what conditions.

Then examine whether the provider must be identified by name or whether an appropriately specific description of recipient categories is permitted under the applicable framework.

Ensure that the consent form, privacy notice, and research protocol provide consistent descriptions of the actual processing arrangement.

The purpose of naming the provider is not to display a recognizable brand. It is to help participants understand who may handle their information and under which conditions.

Before Naming an AI Provider in Research Consent Materials

Frequently Asked Questions About Disclosing AI Providers in Research Consent

Provider Transparency Requires More Than Naming a Company

How to Cite This Guide

This guide is intended to be read, shared, and used in research, teaching, and academic work. If you draw on its ideas, explanations, or other content, please acknowledge the source by citing the guide. Doing so gives appropriate credit and helps your readers locate the original resource.