Does Existing Participant Consent Cover AI Use That Was Not Anticipated When the Study Began?

What if Participants Consented Before Generative AI Was Part of the Study?

Your study began before you planned to use generative AI. Participants have already been recruited, interviews completed, surveys collected, or clinical data assembled. Now an AI tool could transcribe recordings, code responses, classify images, extract variables, or assist with analysis.

Do you need to go back to every participant and obtain new consent?

Not necessarily. But the opposite assumption is equally risky: existing consent does not automatically authorize every new technology simply because the data are already in your possession.

The answer depends on what participants originally agreed to, what the new AI processing actually changes, whether the new use remains within the study's approved purpose and governance arrangements, and which ethical, regulatory, legal, contractual, and institutional requirements apply.

Existing Consent May Cover Some New AI Uses, but Do Not Assume It Does

Whether Old Consent Covers New AI Depends on What Has Actually Changed

The Fact That AI Was Invented Later Is Not the Decisive Issue

Consent forms cannot predict every future software package, algorithm, statistical method, or computing environment. Research methods evolve.

If a study approved the analysis of de-identified numerical data by the research team, replacing one statistical implementation with another does not necessarily require participants to be re-consented simply because the newer implementation happens to contain machine-learning functionality.

Conversely, an apparently modest AI task may create a significant change if identifiable participant information is now transmitted to an external provider that was never part of the original research arrangement.

The relevant question is therefore not “Did the consent form say AI?” It is “Does the proposed AI processing remain within what was authorized and reasonably represented to participants?”

Read the Actual Consent Form, Not Your Memory of It

Researchers sometimes summarize an old consent form as “they agreed that we could use the data for research.” The document may be considerably more specific.

It might say that:

• data will be used only for the present study;
• recordings will be accessible only to the research team;
• data may be reused for future research in a particular field;
• identifiable information will not be disclosed outside the institution;
• data will be destroyed after a defined period;
• de-identified information may be shared with other researchers; or
• participants agree to specified secondary uses.

Those details can determine whether the new AI workflow is consistent with the original commitment.

“Data Analysis” Is Not an Unlimited Authorization

A statement that participant data will be “analyzed” tells participants something about purpose but may say very little about recipients, confidentiality, or processing arrangements.

Suppose participants were told that interview recordings would remain on an encrypted university server and be accessible only to the research team. A researcher later decides to upload those recordings to a public AI service for transcription.

Calling transcription “data analysis” does not resolve the contradiction between the new disclosure and the original confidentiality arrangement.

Researchers should therefore distinguish the analytical purpose from the data-processing pathway used to achieve it.

“Future Research” or Broad Consent Can Be Meaningful, but It Has Boundaries

Some research frameworks explicitly recognize forms of broad consent for future or secondary research. Under the U.S. Common Rule, for example, broad consent is an optional mechanism for the storage, maintenance, and secondary research use of identifiable private information or identifiable biospecimens, subject to specified elements and conditions. It is not simply a phrase that researchers can retrospectively read into ordinary consent.

OHRP's materials also emphasize that broad consent is not required for all secondary research and that other regulatory pathways may apply depending on identifiability and the nature of the secondary use.

Other legal frameworks handle research reuse differently. UK ICO guidance, for example, recognizes that scientific research consent may sometimes cover general areas of research where specific future purposes cannot be fully identified at the time of collection, while still requiring appropriate safeguards and attention to the scope of what people agreed to.

Do not therefore assume that “future research” means “any future use by any technology for any purpose.” Interpret the consent under the framework that governs the study.

The New AI Use May Be a Methodological Change or a New Data Use

This distinction can help structure the assessment.

The boundary is not always sharp, which is precisely why researchers should not make the determination solely by choosing a convenient label.

External AI Processing Can Be More Significant Than the AI Method Itself

Imagine that researchers originally planned to conduct thematic analysis of interview transcripts manually. They later decide to use a locally deployed language model within the same approved secure environment to suggest candidate codes.

Now compare that with uploading identifiable transcripts to a consumer generative AI service operated by an external company.

Both workflows use AI. Their implications for consent may be very different.

The second workflow may introduce an additional recipient, contractual relationship, processing location, retention policy, or confidentiality risk. Whether AI processing counts as sharing participant data with another party can therefore become central to assessing existing consent.

De-Identification Can Change the Regulatory Analysis Without Erasing Prior Commitments

Researchers may consider de-identifying data before applying a new AI method. Effective anonymization can materially alter the privacy-law or human-subjects analysis in some frameworks.

Under U.S. Common Rule guidance, for example, some secondary uses of information that investigators cannot readily link to individuals may fall outside human-subjects research requirements or qualify for particular exemptions. The regulatory treatment depends on the circumstances.

But OHRP's SACHRP guidance also illustrates an important ethical distinction: even where coded or de-identified material falls outside particular human-subject regulations, investigators and institutions may still have obligations to honor commitments made to participants about permitted uses.

This is why de-identification does not automatically settle the ethical permissibility of a new AI use.

A Regulatory Exemption Does Not Rewrite the Original Consent

This point is easy to miss.

A new use may no longer require participant consent under a particular regulation because the data have been de-identified, because a secondary-research exemption applies, or because another legal pathway permits processing. That answers one regulatory question.

It does not necessarily erase an explicit promise made during the original research.

For example, SACHRP has discussed scenarios in which coded material may no longer constitute human-subjects research under the Common Rule while the original investigator and institution nevertheless remain obligated to honor restrictions promised to participants regarding how their materials would be used.

Researchers should therefore ask both “Is new consent legally or regulatorily required?” and “Would this use contradict what we told participants?”

The Sensitivity of the New AI Processing Matters

An AI system used to correct obvious formatting errors in a de-identified numerical dataset is not equivalent to an AI system used to infer mental-health status, political orientation, disease risk, or another sensitive characteristic from participant data.

SACHRP has warned that AI can generate new inferences and create individual or group harms that were not necessarily contemplated when data were originally collected.

If the new AI use changes what researchers are trying to learn about participants rather than merely how an already authorized analysis is performed, the case for fresh ethical scrutiny becomes substantially stronger.

Consent Is Not the Only Source of Authority You Need to Check

Even when the original consent appears broad enough, the approved ethics protocol may specify particular data-handling arrangements. Institutional policy may prohibit certain external AI services. A data-use agreement may restrict onward disclosure. A funder or sponsor may impose additional requirements.

Existing consent is therefore one piece of the authorization puzzle, not the entire puzzle.

If AI was not part of the approved protocol, determine whether introducing AI into the ongoing study requires an ethics amendment.

Privacy Law May Permit Some Research Reuse Without Making Consent Irrelevant Everywhere

Researchers should also avoid overgeneralizing from one jurisdiction's data-protection rules.

For example, current UK ICO guidance states that personal data may be further processed for qualifying research-related purposes under particular conditions, including necessity, fairness, lawfulness, and appropriate safeguards. It also distinguishes ethical consent to participate from the lawful basis for data processing.

At the same time, the ICO notes specific implications when the original lawful basis for data processing was consent and discusses broad consent in scientific research.

The correct conclusion is not that research reuse always requires renewed consent or that it never does. The governing framework, original basis, scope of consent, safeguards, and proposed use all matter.

When the Same Existing Consent Can Lead to Different AI Decisions

Common Mistakes When Applying Old Consent to New AI Uses

Compare the New AI Workflow With the Research Arrangement Participants Accepted

Do not begin by asking whether you can find the letters “AI” in an old consent form. Reconstruct what participants were actually told and compare that with the proposed new workflow.

If renewed consent would be impracticable, that fact may be relevant under some regulatory frameworks, but researchers should not invent their own waiver. Whether consent can be waived, whether an exemption applies, or whether another pathway authorizes the research is a determination governed by the applicable framework and appropriate authority.

Before Applying Existing Consent to a New AI Use

Questions About Existing Consent and Later AI Use

Old Consent Does Not Automatically Forbid or Authorize New AI

How to Cite This Guide

This guide is intended to be read, shared, and used in research, teaching, and academic work. If you draw on its ideas, explanations, or other content, please acknowledge the source by citing the guide. Doing so gives appropriate credit and helps your readers locate the original resource.