Overview

Lesson 2.3: Compliance and Regulatory Landscape for AI Research

This lesson equips research leaders to navigate the rapidly evolving regulatory and policy landscape for AI research. You'll learn about major regulatory frameworks (EU AI Act, NIH/NSF policies), journal and funder expectations, international considerations, and how to build institutional compliance infrastructure that enables research while managing legal and regulatory risk.

Title

Lesson 2.3: Compliance and Regulatory Landscape for AI Research

Purpose

This lesson equips research leaders to navigate the rapidly evolving regulatory and policy landscape for AI research. You'll learn about major regulatory frameworks (EU AI Act, NIH/NSF policies), journal and funder expectations, international considerations, and how to build institutional compliance infrastructure that enables research while managing legal and regulatory risk.

The Multi-Jurisdictional Regulatory Challenge

AI research in 2026 sits at the intersection of at least four distinct regulatory frameworks simultaneously, and the vast majority of research institutions have not yet built clear compliance maps for this complexity. Consider a typical mid-sized R1 university running an NIH-funded study on AI-assisted clinical decision support: that project is simultaneously subject to federal research regulations (the Common Rule, 45 CFR 46), NIH data management and sharing requirements, FDA Software as a Medical Device guidance, and the EU AI Act if any collaborating institution or subject population falls within EU jurisdiction. Add an international co-investigator in Germany and a dataset originally collected under FERPA, and the compliance surface expands further still.

The regulatory picture is not static. Between 2023 and 2026, the number of AI-specific regulatory instruments at the federal, state, and international level roughly tripled. Research compliance offices that handled human subjects protocols, export controls, and sponsored research agreements now face questions about model cards, algorithmic auditing, and data provenance that their existing frameworks do not address. The first institutional response at most universities has been to assign AI questions to whoever seems most adjacent, often the IRB, the data governance office, or the general counsel, without any of those offices having a clear mandate or adequate expertise.

The practical consequence is compliance gaps. A 2025 survey by the Association of Research Compliance Officers found that 67% of responding institutions lacked a formal policy on the use of commercial AI APIs for research data processing, and fewer than 20% had conducted a systematic review of their AI research portfolio against applicable regulatory requirements. This is not a criticism, the regulatory landscape genuinely emerged faster than institutional governance could adapt. But institutional research leaders in 2026 must treat compliance mapping as an urgent priority, not a future project.

The starting point is a regulatory inventory: for each AI research project or program category, what regulatory frameworks apply, who owns compliance for each framework, and what the current compliance status is. Building that map is the prerequisite for everything else in this lesson.

EU AI Act Scope for Research Institutions

The EU AI Act, which entered into force in August 2024 with provisions phasing in through 2026 and 2027, contains a research exemption in Article 2(6) that is considerably narrower than many researchers initially assumed. The exemption applies to AI systems developed and used solely for the purposes of scientific research and development. The critical qualifier is 'solely.' Any AI research that is conducted with an expectation of commercial application, technology transfer, or deployment in a real-world context falls outside the exemption and into the Act's risk classification framework.

For applied research institutions, including virtually every major research university with a technology transfer office, this means most AI research with practical applications is not exempt. The Act establishes four risk tiers: Unacceptable Risk (prohibited), High Risk, Limited Transparency Risk, and Minimal Risk. High-risk AI systems include, among other categories, AI used in education and vocational training, employment and worker management, access to essential services, law enforcement, migration and border management, administration of justice, and critical infrastructure. Research that develops or tests AI systems in these categories requires conformity assessment before deployment.

Conformity assessment for high-risk AI systems under the Act involves technical documentation demonstrating the system meets requirements for data governance, transparency, human oversight, accuracy, robustness, and cybersecurity. For a research prototype, this is a significant administrative burden, but the Act does not create a research prototype exemption for systems in high-risk categories that will be tested with real users or real data. Research institutions that plan to conduct pilot studies with deployed AI systems in any of the high-risk categories need to engage with the conformity assessment requirements at the study design stage.

The Act also establishes foundation model (now termed 'general-purpose AI model' or GPAI model) provisions that apply to model developers, not downstream research users. However, research institutions that fine-tune foundation models for research applications and then make those fine-tuned models available (for example, through Hugging Face or GitHub) may be creating new AI systems subject to the Act. Research leaders should work with legal counsel to determine whether fine-tuned model releases require documentation under GPAI provisions.

Practical EU AI Act compliance for research leaders means: (1) auditing the research portfolio for projects involving high-risk AI system categories; (2) ensuring planned deployment studies build conformity assessment into the timeline and budget; (3) establishing disclosure protocols for any research output that constitutes a GPAI system; and (4) monitoring the ongoing rulemaking process through ENISA and the AI Office, which is issuing implementation guidance through 2026.

US Federal Research AI Regulation

The United States federal regulatory landscape for AI in research is a patchwork of executive orders, agency guidance, and funder requirements rather than a unified statute, which makes it in some ways harder to track than the EU's single-instrument approach. Research leaders need to track multiple streams simultaneously.

Executive Order 14110 on Safe, Secure, and Trustworthy Artificial Intelligence, issued in October 2023, established requirements that ripple into federal contracting and grantmaking. Federal contractors working on AI for national security applications face mandatory reporting and testing requirements. For most research institutions, the more directly relevant provisions concern the NIST AI Risk Management Framework (AI RMF), which the EO elevated from voluntary guidance to a de facto standard for federal-funded AI work. Compliance offices should treat AI RMF alignment as an expectation for any federally funded AI research, even where not explicitly required by grant terms.

NSF's data management and sharing requirements, updated in 2023, require that data generated from NSF-funded research be managed and shared in accordance with FAIR principles. For AI research, this creates specific questions about what counts as 'data', does a trained model constitute research data that must be shared? NSF's current position, articulated in FAQs, is that models may be considered research products subject to sharing requirements, though specifics are award-dependent. Research leaders should proactively discuss model sharing expectations with NSF program officers during award negotiation.

NIH's data management and sharing policy (effective January 2023) similarly requires that large-scale human genomic and phenotypic data generated under NIH funding be submitted to NIH-designated repositories, with specific requirements about de-identification, consent, and access controls. For AI research that trains models on NIH-funded biomedical datasets, this creates obligations about how training data is managed and what can be disclosed about model training provenance. NIH has also issued specific guidance on AI in peer review (prohibiting reviewer use of AI to prepare reviews without disclosure) and is developing additional guidance on AI in NIH-funded research workflows.

The White House Office of Science and Technology Policy (OSTP) has been active in shaping expectations for AI in federally funded research. The 2022 Blueprint for an AI Bill of Rights, while not legally binding, articulates principles, safety and effectiveness, algorithmic discrimination protections, data privacy, notice and explanation, human alternatives, that federal agencies are increasingly citing in grant requirements and program announcements. Research leaders should treat Blueprint alignment as a de facto expectation for publicly visible AI research outputs funded by federal agencies.

Department of Defense-funded AI research carries additional requirements under the DoD AI Ethics Principles (adopted 2019) and the DoD Responsible AI implementation strategy. Responsible, equitable, traceable, reliable, and governable, the 'RETER-G' principles, apply to all DoD AI acquisitions and are flowing into research grant requirements through DARPA, ONR, AFOSR, and ARL program announcements.

Sector-Specific Regulatory Overlays

Beyond the general AI regulatory frameworks, research institutions must navigate sector-specific regulations that create additional compliance layers depending on the domain of the AI research.

Health and Life Sciences: The FDA's Software as a Medical Device (SaMD) framework applies to software functions intended to analyze medical data and provide information used to diagnose, treat, cure, mitigate, or prevent disease. AI systems that fall under SaMD, including clinical decision support AI, diagnostic imaging AI, and patient monitoring AI, are regulated medical devices requiring FDA clearance or approval before clinical deployment. Research using these systems in clinical studies must coordinate with FDA during the Investigational Device Exemption (IDE) process. The FDA's 2021 action plan for AI/ML-based SaMD and subsequent draft guidance documents establish expectations for algorithm change protocols, real-world performance monitoring, and transparency that affect clinical AI research design.

Export Controls: The International Traffic in Arms Regulations (ITAR) and Export Administration Regulations (EAR) apply to AI technology in ways that are still being actively interpreted. AI models trained on export-controlled data may themselves be subject to export restrictions. Sharing model weights with international collaborators, even academic collaborators, may require an export license if the underlying training data or the model's intended application involves controlled technology. Research institutions engaged in defense-relevant AI research (including autonomous systems, cybersecurity AI, and certain robotics research) should proactively consult with their export control office before sharing models or datasets internationally.

Educational Research: FERPA (Family Educational Rights and Privacy Act) restricts the use of student educational records for research purposes. When AI research uses student data, including learning analytics, educational AI systems, or administrative AI that processes student records, FERPA creates both consent requirements and data handling restrictions. Commercial AI tools that process student data on behalf of educational institutions must serve as 'school officials' with legitimate educational interest, meeting specific contractual requirements. This affects which AI APIs can be used for educational AI research.

Financial Research: AI research in financial applications intersects with SEC guidance on model risk management (SR 11-7) and the more recent OCC guidance on model risk management for AI/ML. While these primarily govern financial institutions rather than research institutions, AI research that will be applied in financial contexts, including fraud detection, credit scoring, and algorithmic trading research, should be designed with these downstream regulatory requirements in mind.

IRB Evolution for AI Research

Institutional Review Boards were designed to protect human subjects in research, but the boundary of what constitutes 'human subjects research' under 45 CFR 46 is being actively contested as AI research creates new categories of potential harm that traditional IRB frameworks did not anticipate.

The traditional IRB trigger is straightforward: research involving a living individual from whom the investigator obtains data through intervention or interaction, or identifiable private information. Most AI research that trains on pre-existing datasets does not meet this definition. But AI systems that are then deployed, tested with real users, integrated into institutional workflows, or used to make decisions about individuals, may create human subjects implications that emerge at the deployment stage rather than the data collection stage.

Research institutions are increasingly adopting AI-specific IRB protocols that address: (1) the risk of harm from automated decision-making (when an AI system makes or influences decisions about individuals, what oversight and appeal mechanisms exist?); (2) informed consent language for AI-mediated research interactions (does the subject understand they are interacting with an AI system, and what data is being collected?); (3) ongoing review requirements for deployed AI systems (unlike a one-time intervention, a deployed AI system may evolve in ways that require protocol amendment); and (4) special considerations for vulnerable populations (AI systems may perform differently across demographic groups, and IRB review should require disparity analysis as a condition of approval).

The Office for Human Research Protections (OHRP) issued draft guidance in 2024 on AI in human subjects research that provides some clarity but leaves significant interpretive questions open. Research leaders should not wait for definitive federal guidance. They should work with their IRB to develop AI-specific review criteria now, before a problematic study creates liability.

A practical framework for AI IRB review considers three stages: (1) training stage, are the training data subjects protected? Does secondary use of their data require renewed consent? (2) testing stage, if human subjects interact with or are affected by the AI during evaluation, full IRB review applies; (3) deployment stage, for AI systems deployed into ongoing institutional operations, continuous IRB oversight or equivalent governance mechanism is appropriate.

Pro tip for research leaders: engage your IRB chair in a structured conversation about AI research before individual applications come in. Helping the IRB develop institutional criteria for AI review will result in better, more consistent review and reduce the delay that comes from reviewers encountering novel questions for the first time during a specific protocol review.

Data Sovereignty and Cross-Border AI Research

International research collaborations involve AI-specific data sovereignty considerations that go beyond traditional data transfer agreements. The training data, the models, and the research outputs of AI projects are all subject to jurisdiction-specific rules.

Data localization requirements affect where training data can reside. China's Data Security Law (2021) and Personal Information Protection Law (2021) impose strict requirements on cross-border transfer of data deemed important to national security or collected within China. Russia requires that personal data of Russian citizens be stored on servers located within Russia. India's Digital Personal Data Protection Act creates consent and cross-border transfer requirements that affect international research collaborations involving Indian populations. Researchers who collect data internationally, including through surveys, clinical studies, or social media research, must understand where that data can be processed for AI training purposes.

Model weight export is an emerging area of compliance concern. A model trained on controlled data may embody that data in its weights in ways that make the model itself an export-controlled item. The Commerce Department's Bureau of Industry and Security (BIS) has been working on guidance for AI model export controls since 2023, and research institutions should monitor BIS rulemaking closely. In practice, sharing large language models or foundation models fine-tuned on sensitive datasets with international collaborators warrants export control review.

Contractual protections for international research collaborations have become more complex. Standard data transfer agreements (DTA) and material transfer agreements (MTA) do not address AI-specific scenarios: who owns model weights developed from jointly collected data? What happens if a collaborator uses shared model weights for a commercial application? What are the obligations if a model trained on shared data produces discriminatory outputs in one partner's local context? Research institutions developing international AI collaboration frameworks need contractual provisions addressing these scenarios.

The practical recommendation for research leaders is to build data sovereignty review into the international collaboration agreement process, before data collection begins, not after. This requires your sponsored research office, export control office, and legal counsel to have AI-specific competencies, which brings us to the broader question of compliance infrastructure.

Building AI Compliance Infrastructure

Managing AI research compliance requires dedicated institutional infrastructure: not just adding AI to the existing compliance office's portfolio, but building specific capabilities, roles, and systems.

The emerging role of the AI Compliance Officer is being established at leading R1 universities. This is not a traditional IT compliance role. It requires deep familiarity with research processes, AI technology, and the multi-regulatory landscape described in this lesson. At smaller institutions, this function may be housed in the Research Compliance office or the Office of the Vice President for Research, but it needs explicit ownership. Without a named owner, AI compliance questions fall into the gaps between existing offices.

Compliance tracking systems for AI research are evolving. The most mature implementations use a combination of: a project registry (every AI research project is catalogued with its regulatory classification); a compliance checklist system (each project has a compliance checklist based on its classification); and a change monitoring function (when regulations change, the registry identifies affected projects). Commercial tools for AI governance (such as Credo AI, IBM OpenPages with AI Governance, and Microsoft Purview) are increasingly being adapted for research contexts, though most were designed for enterprise deployment rather than research environments.

Regulatory change monitoring is a significant challenge given the pace of AI rulemaking. Research compliance offices cannot rely on legal counsel to proactively surface every relevant AI regulatory development, the volume is too high and the legal costs prohibitive. Effective approaches include: subscribing to regulatory tracking services (Westlaw AI, Bloomberg Law AI, Stanford HAI regulatory tracker); joining the Association of Research Compliance Officers' AI working group; participating in AAU and APLU working groups on AI governance; and designating a staff member to own regulatory change monitoring as a primary responsibility.

Staff training programs for AI compliance need to address different audiences. Research compliance staff need technical literacy, enough understanding of how AI systems work to recognize which regulations apply to which research activities. Faculty and student researchers need procedural literacy: what approvals are required before starting an AI research project, what data handling restrictions apply, what disclosures are required in publications. Research administration staff (sponsored research, IRB coordinators, export control) need specialized AI training in their respective domains.

Budget implications are real. Compliance infrastructure is not free, and research institutions have historically underinvested in compliance functions relative to the complexity of their regulatory environment. The AI compliance function will require investment in staff, systems, and training, and research leaders should be making the case to institutional leadership and including compliance costs in grant budgets where allowable.

Conducting an AI Compliance Gap Assessment

A compliance gap assessment is the systematic process of mapping your institution's current AI research activities against applicable regulatory requirements to identify where compliance obligations are not being met. For most research institutions in 2026, this assessment will reveal significant gaps, not because of bad faith, but because the regulatory landscape moved faster than institutional governance.

The assessment begins with portfolio discovery: what AI research is actually underway at your institution? This is harder than it sounds. AI capabilities are embedded in research tools that faculty may not think of as 'AI research': statistical software packages with ML components, literature review tools with AI ranking, data analysis platforms with automated feature selection. A portfolio discovery effort must cast a wide net, typically through a combination of research information system queries (searching for AI-related keywords in grant titles and abstracts), faculty self-reporting surveys, and interviews with department chairs and research administrators.

Once the portfolio is mapped, each project or project category is classified against the applicable regulatory frameworks: EU AI Act risk tier (if applicable), federal funder requirements, IRB status, data sovereignty requirements, export control classification, and sector-specific requirements. This classification produces a matrix of obligations and a corresponding map of current compliance status.

Gap identification compares obligations against current status. Common gaps found in institutional assessments include: AI research using commercial API services processing regulated data (HIPAA, FERPA) without appropriate Business Associate Agreements or School Official Agreements; research generating AI models without appropriate documentation for regulatory purposes; international collaborations sharing AI models without export control review; deployment studies using AI systems in high-risk categories without conformity assessment planning; and IRB-reviewed studies with AI components that predate AI-specific review criteria.

Prioritization of gaps should be risk-based: legal risk (regulatory violation that could result in enforcement), financial risk (funding termination or inability to compete for future funding), reputational risk (research misconduct findings or harmful AI outputs becoming public), and operational risk (research being stopped due to non-compliance). The highest-priority gaps are those where ongoing research creates potential legal liability with no current mitigation.

A remediation roadmap assigns responsibility, resources, and timeline to each gap. Research leaders should resist the temptation to remediate comprehensively before taking any action, a phased approach that addresses the highest-risk gaps immediately while building systemic capacity over 12-18 months is more realistic and more likely to succeed.

Industry Standards Bodies and Institutional Participation

Regulatory compliance is not purely a matter of following rules made by others. Research institutions have the opportunity, and, at the leadership level, the responsibility, to participate in the standard-setting processes that shape the regulatory environment for AI research. This participation matters both for the quality of the standards (which benefit from research institution input) and for the institution's compliance posture (which benefits from early awareness of emerging requirements).

The Partnership on AI (PAI), a multi-stakeholder organization founded by major technology companies and civil society organizations, now includes research institutions among its members. PAI working groups on responsible AI practices, AI in the media, and AI safety produce frameworks and guidelines that often precede formal regulation. Research institutions that participate in PAI working groups have early visibility into emerging norms and can shape outputs to reflect research contexts.

MLCommons is the industry consortium that manages MLPerf benchmarks and related AI evaluation standards. For research institutions whose AI work involves model evaluation and benchmarking, MLCommons membership provides access to evaluation methodologies that are increasingly referenced by regulators. The MLCommons AI Safety working group is developing safety evaluation frameworks that may be incorporated into regulatory requirements, early participation positions institutions to influence and understand these frameworks.

At the international standards level, CEN-CENELEC (the European standards body) has established Joint Technical Committee 21 on Artificial Intelligence (JTC 21) and ISO/IEC JTC 1 SC 42 is the international AI standards committee. These bodies are developing standards that the EU AI Act references as pathways to presumption of conformity, meaning products and systems that comply with these standards are presumed to comply with the Act. Research institutions with standards participation are in a better position to understand what conformity assessment will require as standards are finalized.

The National Institute of Standards and Technology (NIST) AI Safety Institute, established under EO 14110, actively engages research institutions in the development of AI safety testing frameworks, red-teaming protocols, and the AI Risk Management Framework. NIST participation provides access to pre-publication drafts, direct engagement with federal AI policy, and the credibility that comes from being part of the standards development process.

For research leaders, the practical message is: institutional participation in these bodies is not a luxury for institutions with excess capacity. It is a strategic investment in regulatory intelligence and compliance advantage. Designating a senior research administrator or faculty member to participate in one or two relevant bodies, and systematically sharing what they learn with the institutional compliance function, creates compounding returns.