01 · The Question
Do Research Teams Need Rules Beyond Institutional AI Policies?
Your university already has an AI policy. The funder has requirements. The ethics committee has approved the study. Eventually, the journal may have another set of rules. Does a research team really need to add its own?
Often, yes, particularly when several people will use AI during the same project.
External policies typically establish boundaries. They may tell researchers which systems are prohibited, what information cannot be uploaded, or when AI use must be disclosed. They do not necessarily decide the everyday questions inside a research team: Which AI tasks will this project permit? Which tools will everyone use? Who verifies generated code? Can interview transcripts be processed with AI? What records should be kept? What happens if a collaborator uses an unapproved tool?
Project-level rules can turn broad external requirements into a common working practice.
03 · What You Need to Know
A Team AI Rule Is an Operating Agreement, Not a New Regulatory System
External Policies Often Leave Legitimate Choices to the Researchers
An institutional policy might say that generative AI is permitted with non-confidential information. That still leaves many decisions unresolved.
Should researchers use AI to draft code? Can it summarise articles? May it propose qualitative codes? Can it rewrite manuscript passages? Should prompts and outputs be retained? Does every use need another team member's review?
External policies cannot reasonably prescribe every workflow for every research project. Teams therefore have room, and sometimes a practical need, to establish more specific expectations within the boundaries those policies create.
This distinction follows from the broader system of overlapping AI requirements in research: external authorities establish applicable obligations, while the research team decides how compliant work will actually be organised.
Collaborative Research Already Depends on Agreed Responsibilities
The idea of team-level AI rules is not an entirely new form of research governance. Collaborative research has long required researchers to clarify roles, data practices, authorship, responsibilities, compliance, and decision-making.
The U.S. Office of Research Integrity advises collaborators to establish a common understanding before work begins concerning project goals, individual roles, data collection and sharing, changes to research design, publication responsibilities, reporting, intellectual property, and other project matters. ORI similarly recommends effective management plans covering training, supervision, formal agreements, and compliance.
AI adds another category of decisions to this familiar collaboration problem. The technology is new. The need to decide who may do what with shared research material is not.
Team Rules Can Prevent Inconsistent AI Practices
Without an explicit agreement, individual researchers may make reasonable but incompatible assumptions.
One researcher might use AI only for grammar correction. Another might consider AI-generated code entirely routine. A third might upload qualitative data for preliminary coding because their previous project allowed it. Someone else may assume all generative AI is prohibited.
These differences can become consequential when the work is combined into one dataset, analysis, manuscript, or grant report.
| Question |
Why the Team Should Decide |
| Which AI tools may be used? |
Prevents collaborators from using services with incompatible security, privacy, or contractual arrangements. |
| What information may be entered? |
Clarifies treatment of participant data, confidential material, unpublished findings, manuscripts, and proprietary information. |
| Which research tasks may involve AI? |
Creates consistency across literature work, coding, analysis, programming, writing, and other activities. |
| Who verifies AI outputs? |
Prevents generated material from entering the research record without appropriate human review. |
| What should be documented? |
Makes later methodological reporting, disclosure, audit, or reconstruction easier. |
| Who decides when the rules are unclear? |
Prevents individual team members from making consequential policy interpretations independently. |
| What happens when policies change? |
Provides a process for updating the workflow during a long project. |
Team Rules Should Be More Specific Than “Use AI Responsibly”
"Use AI responsibly" is a principle, not much of an operating procedure.
A useful rule should tell researchers what action to take. For example, a team might permit an institutionally approved AI coding assistant for programming but require all generated code affecting analysis to be reviewed and tested by a named researcher before execution on project data.
Another team might prohibit participant-level data from being entered into any generative AI system unless the system and use have been specifically approved under the project's ethics and data-security arrangements.
The rule should be specific enough that two team members reading it are likely to reach the same conclusion.
Rules Should Address Data Before They Address Writing
Discussion of research AI often begins with manuscript writing because generative text is highly visible. For many projects, however, the more consequential question is what researchers put into the system.
Participant records, unpublished results, interview transcripts, proprietary datasets, grant applications, confidential manuscripts, passwords, credentials, source code, or commercially sensitive information can create risks before the AI generates a single sentence.
Teams should therefore establish information-handling boundaries early. A simple classification such as public, internal, confidential, participant-level, and restricted material may help, provided it corresponds with the institution's actual data-classification framework rather than inventing competing categories.
Watch Out
A project-level rule cannot make an external AI service safe for information that institutional policy, ethics approval, a data-use agreement, or applicable law prohibits you from sending there. Team permission is not authorisation from the authority that controls the information.
Teams Should Decide What Human Verification Means
Statements such as "all AI output must be verified" sound reassuring but can become meaningless unless the team specifies what verification requires.
Verification should reflect the task. AI-generated statistical code may need testing against known cases and inspection by someone competent in the method. A literature summary should be checked against the original sources. A generated citation should be verified against the actual publication. A qualitative interpretation should be evaluated against the underlying data and analytical framework.
The European Commission's updated 2026 Living Guidelines on responsible generative AI use in research continue to emphasise accountability, transparency, responsibility, and research integrity. Those principles become operational only when the people conducting the research know who is accountable for checking particular outputs.
Team Rules Can Establish Documentation Thresholds
Recording every autocomplete suggestion would be impractical. Recording nothing can create a different problem when AI materially influences the research.
A team can establish a proportional threshold. Routine spelling assistance might require no project log, while AI used to generate analytical code, classify research data, create synthetic data, substantially restructure manuscript content, or support interpretation might require documentation.
The documentation can identify the system, purpose, relevant inputs, nature of the output, human verification, and how the output was ultimately used. The exact record should be proportionate to the methodological and integrity significance of the activity.
Team Rules Should Address Accountability
AI does not become the responsible member of the research team merely because it produced the output.
Someone should remain accountable for generated code, analyses, text, classifications, figures, and other material that enters the research workflow. That responsibility should normally follow expertise and project roles rather than being assigned vaguely to "the team."
ORI's collaborative research guidance has long emphasised clear allocation of roles and responsibilities. AI makes that allocation more important because an output can appear polished enough that responsibility becomes strangely easy to misplace.
Rules Matter Even More Across Institutions
A team spanning several universities may contain researchers subject to different institutional requirements. In that situation, the project-level rule can establish the shared workflow after the applicable external requirements have been mapped.
The team should first determine which institutional AI policies apply to the collaboration. It can then choose a common procedure that satisfies those requirements.
International collaborations may require still more care because national and cross-border AI requirements can differ.
Team Rules Need a Change Process
An AI-use rule written at the beginning of a three-year project can become obsolete surprisingly quickly. Tools change, institutional policies change, collaborators join, datasets evolve, and publishers introduce new requirements.
The team's rules should therefore identify who can propose a change, who approves it, when external approval must be sought, and how collaborators are informed.
This prevents the informal pattern in which one researcher quietly adopts a new tool and the team discovers the change when the manuscript is nearly finished.
07 · A Quick Checklist
What Research Team AI Rules Should Cover
When establishing team AI rules, check:
Identify the external university, ethics, funder, contractual, legal, and publication requirements the team must follow.
Specify which AI systems or categories of systems may be used for project work.
Define what research information must never be entered into unapproved AI services.
Identify permitted, restricted, and approval-required AI activities where useful.
Assign responsibility for verifying consequential AI outputs before they enter the research record.
Define which AI uses should be documented and what information should be recorded.
Establish who can approve new AI uses or tools during the project.
Define what team members should do if they are uncertain whether an AI use is permitted.
Establish how policy changes and new AI tools will be communicated to the team.
Review the rules periodically and whenever the project, data, collaborators, or applicable policies materially change.