Rethinking the Ethical Gatekeeper: How AI Is Exposing the Limits of IRB Practice and What Research Ethics Boards Must Do Next

Melissa Langworthy

The Tool No One Reviewed

Picture a common scene in development research. A team based at a Northern university is conducting a multi-country study on women’s economic inclusion in East Africa. The study is IRB-approved. Consent forms have been translated. Field facilitators have been trained. The researchers are experienced and well-intentioned. Partway through, the team adopts an AI-powered transcription tool to process hours of focus group recordings in Swahili, Amharic, and Luganda. It is faster, cheaper, and apparently accurate.

What the researchers do not know, or do not ask, is this: the transcription tool was trained predominantly on English-language audio data. Its error rate for Swahili-inflected speech is substantially higher than for standard American English, and it performs worst on non-dominant dialects and on the speech patterns of older women with lower levels of formal education, precisely the demographic whose testimony the study was designed to centre. The tool’s terms of service allow the provider to retain and use audio data for further model training. The women whose voices were recorded consented to participate in a research study, but they did not consent to having their words retained by a commercial AI company based in California. AI tools are quickly being taken up in research, and yet protocols for participant consent and IRB oversight have not kept pace.

This hypothetical is a composite of documented practices that recur across the development research sector, especially given the tightening funding ecosystem following the USAID closure and other reductions in aid contributions. Navigating these constraints, AI tools are being adopted, sometimes mid-study, often without protocol amendments. They are being applied to data from communities whose languages, cultural contexts, and epistemological frameworks were not represented in the data on which those tools were trained. The ethical review systems that exist to protect research participants are often not notified nor are they designed to keep ahead of the complex protection issues raised by AI.

The asymmetry of power in this picture is a structural component in this conversation. The AI tools are built in the Global North, trained on Global North data, and owned by Global North companies. Development researchers frequently hold institutional affiliations in the Global North. The communities whose knowledge is gathered, processed, and analysed through these tools are in the Global South. The benefits of the research, in the form of publications, institutional reputation, and policy influence, flow predominantly northward. The risks, including misrepresentation, re-identification, and the loss of control over community data, remain largely with the communities., while the benefits in terms of efficiency and cost remain with the research institution. This is the same extractive logic that development research has long been challenged to confront, however, AI has given it a new and more opaque mechanism.

This article argues that the current IRB model is not equipped to interrupt that dynamic. It identifies where the system is failing, examines how those failures reproduce and intensify existing power imbalances, and proposes a concrete agenda for reform. It also asks what Includovate’s own IRB, established with an explicit commitment to inclusive and decolonial research ethics, must do to meet the moment.

IRBs Were Built for a Different World

The modern IRB emerged from catastrophe. The Tuskegee Syphilis Study, in which Black men with syphilis were denied effective treatment so that researchers could observe the disease’s progression over decades, was a defining violation. The Belmont Report of 1979 formalised three principles in response: respect for persons (autonomy and informed consent), beneficence (minimising harm), and justice (the fair distribution of research risk and benefit) (National Commission 1979).

These principles were sound, yet the systems built to apply them were quickly outpaced by research evolution. The principles assumed a specific research context where one researcher, a defined pool of participants, a finite dataset, and a clear moment of consent before the study began bounded the study. They also assumed, mostly implicitly, that the researcher and the research institution bore meaningful accountability to the communities they studied. Development research has long exposed the inadequacy of that assumption. In practice, accountability has flowed upward, toward funders and publishers, not laterally toward communities. AI compounds both failures simultaneously.

AI tools learn from data at scale, and their outputs can change after a study commences. A model trained on community focus group transcripts may produce different outputs when retrained on new data midway through a project. Re-identification algorithms can reconstruct individual identities from data considered anonymised at the point of IRB approval (SACHRP 2022). When those tools are owned by external commercial entities, the community’s data may persist and be used in ways the original study design never contemplated, and which no consent form addressed.

The structural problem compounds the procedural one. In the United States, over 2,300 IRBs operate across more than 1,800 registered institutions, with 56 per cent managed by universities or academic medical centres (SACHRP 2022; OHRP 2023). These boards are frequently reviewing the research of the institution that employs them, and they are dominated by reviewers from the Global North. Research conducted in Uganda, Bangladesh, or Bolivia is assessed through ethical frameworks developed in Washington and Brussels, by reviewers whose professional formation has taken place almost entirely in those same contexts. The incentive structure already pulls toward protecting institutional reputation rather than participant welfare. AI tools that are poorly suited to non-Western contexts, and whose risks are not legible to Northern-trained reviewers, pass through IRB review unscrutinised, because the review process was not designed to see them.

Three Failures That AI Makes Visible

1. The Consent Framework Is Broken

Informed consent, as currently practised in IRB review, is a point-in-time transaction. A participant reads a description of a study, understands the risks, and agrees. This model was already inadequate for participatory and community-based research, where the research relationship is ongoing and negotiated over time (Langworthy , Mrazova, and Curbelo 2026), but AI makes it structurally incoherent.

When a participant’s interview responses are used to train a language model or processed by a third-party AI tool whose terms of service permit data retention, the data does not remain in the container defined by traditional consent models. It may generate outputs the participant never anticipated and be retained in the model after the study ends. The right to withdraw, a cornerstone of ethical research practice, becomes practically meaningless if a participant’s data is already encoded into a system owned by a company the participant has never heard of and cannot contact (Russo Carroll et al. 2025).

In development research contexts, this problem is compounded by literacy, language, and power. Consent processes that rely on written documentation are inaccessible to participants with low literacy. Explanations of AI data processing that are technically accurate may be meaningless to a participant in rural Zambia with no prior exposure to cloud computing or machine learning. Further, the power differential between a foreign research team and a community that may depend on the programme the research is evaluating makes truly voluntary consent structurally difficult to achieve, regardless of what the consent form says. AI adds a new layer to an already compromised process: the information a participant would need to meaningfully consent to AI-enabled research, including how the tool processes their data, what re-identification risks exist, whether the model will be retrained, and what happens to their data after the study ends, is rarely required by IRB protocols and is rarely communicated at all (Rutgers University Office for Research 2026).

2. The Data Sovereignty Gap

Informed consent frameworks are built around individual rights. The communities most exposed to AI research harm, including Indigenous communities, communities of people with disabilities, and low-income communities in the Global South, experience that harm collectively, not only individually. This is a fundamental mismatch that IRBs have not yet addressed.

Indigenous data sovereignty holds that Indigenous peoples have inherent rights to govern the collection, ownership, and application of data about their communities, knowledge systems, and territories (Kukutai and Taylor 2016). These rights are affirmed in Article 31 of the United Nations Declaration on the Rights of Indigenous Peoples, which specifies that Indigenous peoples have the right to maintain, control, and protect their cultural heritage, traditional knowledge, and traditional cultural expressions, including data (United Nations 2007).

AI research violates these rights in ways existing IRB frameworks cannot see. Data breadcrumbing, in which AI systems pull together fragments of data to reconstruct information about a person or community without approval or compensation, is one mechanism. The automated generation of Indigenous artwork, language content, or cultural artefacts from scraped data is another (Russo Carroll et al. 2025; Perera et al. 2025). These are not hypothetical risks. They are documented harms, and they follow a recognisable colonial pattern: knowledge and cultural production originating in communities in the Global South is extracted, processed by institutions and companies in the Global North, and returned, if it is returned at all, in a form that serves Northern interests and reflects Northern assumptions.

The CARE Principles for Indigenous Data Governance (Collective Benefit, Authority to Control, Responsibility, Ethics) provide a framework for evaluating and preventing group-level harm (Carroll et al. 2020). They have not been integrated into mainstream IRB review processes, including the Common Rule, which remains oriented around individual-level risk assessment. Includovate has long identified that IRBs have little procedure for addressing data sovereignty rights, and that this gap extends to basic questions of who controls research data and how materials gathered during fieldwork may be used (Langworthy, Mrazova, and Curbelo 2026). AI intensifies every dimension of this problem and gives it new technical mechanisms that IRBs are not equipped to evaluate.

3. The Algorithmic Bias Problem in Research Design

AI tools used in development research do not merely analyse data; they shape what is seen, what is categorised as significant, and whose experience is treated as a valid data point. This is a structural feature of systems trained predominantly on data from majority populations in the Global North, applied to communities in the Global South whose languages, communication patterns, and cultural frameworks were not part of that training.

The consequences of this are direct and measurable. Automated speech recognition tools perform significantly worse on non-dominant language varieties and accents. Sentiment analysis tools trained on English-language social media data systematically misread emotional expression in other linguistic and cultural contexts. Image recognition tools trained on Western photographic conventions misclassify or fail to recognise culturally specific practices, dress, and social arrangements. Each of these is a source of systematic error that will propagate through any analysis built on AI-processed data.

In the Global South, AI systems trained on data from Western, educated, industrialised, rich, and democratic (WEIRD) populations produce outputs that misrepresent or actively harm non-Western communities. Scholars have described this as cognitive imperialism: the dominance of Western epistemologies encoded into AI systems that then shape knowledge production about societies those systems were never designed to understand (Ndasauka et al. 2024). A 2024 community-centred study found systematic evidence that generative AI models produce harmful outputs when representing non-Western cultures (Ghosh et al. 2024). People with disabilities face an analogous problem: existing de-biasing measures tend to flatten variance within and among disabled people, reinforcing medical-model pathologisation rather than disability justice (Tilmes 2022; El Morr et al. 2024).

IRBs have no current mechanism for evaluating algorithmic bias as an ethical risk to research participants, even though it shapes research findings directly, and even though those findings may inform policy and programme decisions that affect the communities from which the data was taken (see Box 1).

Box 1: What algorithmic bias means for participatory research

In community-based participatory research, AI tools are increasingly used for transcription, thematic coding, sentiment analysis, and image recognition. Each process makes classification decisions. A transcription tool with high error rates for Swahili-inflected speech will distort findings from East African focus groups. A sentiment analysis tool that misreads non-Western emotional expression will produce a systematically skewed picture of community attitudes. An image recognition tool that cannot classify culturally specific practices will render those practices invisible in the analysis. These are not minor technical issues. They are ethical risks to the validity of findings and, where findings inform policy or programme design, to the communities those programmes are meant to serve. IRBs cannot currently evaluate these risks because they lack both the technical expertise and the procedural frameworks to do so.

Three Cases That Demand a Reckoning

Case Study 1: The Kenyan Maasai and AI-Generated Cultural Misrepresentation

In 2024, the Kenyan State Department of Culture used AI-generated images to represent Maasai culture in a public campaign. The images were inaccurate in ways that matter profoundly to the community: a neck bracelet traditionally worn by Maasai women to signify status, role, and spiritual connection was depicted being worn by men. The symbolism embedded in Maasai cultural attire is specific and relational, not decorative. Its misrepresentation is not an aesthetic error. It is a distortion of cultural meaning produced by a system that scraped Maasai imagery without community consent and reproduced it without community review (Malinda 2025).

While this was not a research study under IRB oversight, it is a clear example of how AI-generated cultural content can cause collective community harm without triggering any of the institutional structures that normally prompt ethical review. When researchers use AI tools to analyse, generate, or interpret materials related to Indigenous or non-Western communities, the risk of equivalent harm is inherent in the methodology. The AI system does not know what it does not know about Maasai cultural protocols. Often, neither does the researcher who deploys it.

The incident reflects a pattern well-documented in the literature: AI systems draw on Indigenous and cultural data from sources that distort narrative, strip context, and sever the relational accountability that gives cultural knowledge its meaning (Blak Focus 2025). For development researchers using AI tools to analyse interview data, map community assets, or generate culturally contextualised outputs, the Maasai case is a cautionary tale.

Case Study 2: Koko and the Consent Vacuum in Digital Research

The Koko cases, though originating in a US commercial context, illuminate consent failures that development researchers encounter in different forms. In the first incident, GPT-3 generated mental health support messages for approximately 4,000 users, many in emotional crisis, without disclosure of AI involvement and without IRB approval. In the second, at-risk young adults on social media platforms were randomised into AI-assisted and standard crisis response groups. The study was classified as nonhuman subjects research by a university IRB, exempting it from consent requirements. Agreement to a terms of service document was treated as sufficient (Maiberg 2023; Grohol 2023).

The structural parallel for development research is direct. Studies that use AI tools to process participant data collected through digital platforms, community surveys, or remote sensing may be classified as involving secondary data or nonhuman subjects, exempting them from meaningful review. The communities whose data is processed have no knowledge that an AI system is involved, no mechanism to object, and no recourse if the processing produces harmful outputs. The IRB exemption mechanism, designed to reduce administrative burden, creates a governance vacuum in precisely the contexts where oversight is most needed.

Three specific failures the Koko cases make legible are worth naming. IRB exemptions designed for low-risk research can be applied to digital AI research in ways that remove all meaningful participant protection. The classification of research as involving or not involving human subjects is made by institutions with an interest in minimising oversight burden, not by those whose interests are at stake. And voluntary reform, triggered only by public exposure, is not a governance system. It is a failure mode that development researchers and their communities cannot afford to rely on.

Case Study 3: The Alaska Native Health Research Model

The community-engaged AI research framework developed for the Alaska Tribal Health System offers the clearest available counter-example to the IRB-as-gatekeeper model, and the one most directly applicable to development research practice.

The framework embeds an Ethical, Legal and Social Implications (ELSI) structure across all stages of AI research, from tool selection and design through implementation and ongoing monitoring. Communities are not presented with a completed tool and asked to consent. They are involved in deciding whether a tool should be developed, what it should do, who should govern its outputs, and what happens to community data after the study ends. The framework explicitly addresses Tribal data sovereignty, the distribution of power within research partnerships, and the technical capacity of communities to participate meaningfully in AI governance (Berdahl et al. 2025).

A scoping review informing this work found that only 0.2 per cent of over 1,000 AI healthcare publications mention community involvement in AI development, and a single published study described stakeholder involvement in AI development for marginalised communities at the time of review (Berdahl et al. 2025). The Alaska model is not an outlier in the sense of being exotic or impractical. It is an outlier in the sense of being almost entirely alone. An approach that directly addresses the power imbalances at the heart of AI-enabled development research exists and has been documented, yet it has failed to implement practices across the field.

What IRBs Must Do: A Reform Agenda

Reform must work at two levels simultaneously: what IRBs require of researchers, and what IRB members are equipped to evaluate. These are not the same problem and they require different solutions. Procedural updates without capacity development produce better paperwork and no better outcomes. Capacity development without procedural change produces more informed reviewers who still lack the authority to act on what they know.

The Regulatory Landscape Is Already Moving

IRBs that treat AI governance as a future concern are already behind. A cluster of binding and near-binding regulatory frameworks is now in force or entering force that directly affects how development research involving AI must be reviewed (see Box 2). The field is not waiting for ethical consensus to form. Funders and regulators are acting. IRBs that do not build AI governance capacity now will leave the research organisations they serve exposed, both ethically and in terms of funder compliance.

Box 2: Key frameworks now affecting development research IRB practice

UNICEF Policy on Ethics in Evidence Activities (in force May 2026)

This is the first major multilateral funder policy to name AI explicitly as a governance concern in research ethics, and it is binding on all UNICEF implementing partners. Several provisions directly mandate IRB-level engagement. Any use of AI to determine or interpret results in an evidence activity is classified as high-risk, requiring independent ethics review rather than internal researcher approval (UNICEF 2026, para. 4.14.9). Implementing partners must ensure all primary data collection staff have completed ethics training that includes AI (para. 3.12). Consent processes must explicitly disclose AI’s role in the evidence activity, making IRB review of consent language for AI disclosure adequacy a new requirement (para. 4.16-19).

The policy also introduces the concept of Categorical Privacy: the risk that aggregate or community-level data can cause discrimination or harm even when no individual is identifiable (para. 2.4). IRBs have not traditionally assessed this. For development research working with national datasets, community surveys, or geographically bounded populations, this represents a new category of harm that standard individual-consent frameworks cannot address. The sensitive topic areas listed in Annex 1, which include gender roles, violence and trauma, FGM, sexual exploitation, reproductive health, mental health, and political views, are standard territory in development research, meaning the AI governance provisions of this policy apply to the overwhelming majority of development IRB submissions.

EU AI Act Article 50 (in force August 2026)

From 2 August 2026, transparency labelling obligations apply to AI-generated content shared publicly or with EU-based stakeholders (European Parliament 2024, Art. 50). Research publications and reports that are AI-assisted may require labelling. IRBs reviewing research with EU funders should be building AI disclosure requirements into their review framework now. Non-compliance carries significant financial exposure: fines of up to €15 million or 3 per cent of annual global turnover. A grace period applies to AI systems already on the market before August 2026, with machine-readable marking requirements deferred until December 2026.

GDPR Articles 9 and 35 (in force, consistently underused by IRBs)

Article 9 of GDPR designates racial or ethnic origin, health data, sexual orientation, and political opinions as special category data requiring explicit consent and a lawful basis for processing (European Parliament 2016, Art. 9). AI-assisted processing of even anonymised data containing these characteristics likely triggers Article 9 obligations. Most development sector IRBs are not currently assessing this. Article 35 requires Data Protection Impact Assessments before high-risk processing; AI-assisted research involving special category data triggers this requirement, and IRBs should require evidence of DPIA completion in relevant submissions.

Emerging funder expectations: FCDO and others

FCDO is investing £63.6 million over five years in an AI for Development programme with IDRC, focused explicitly on responsible AI in developing country research ecosystems (FCDO 2024). The World Bank and GIZ are developing analogous frameworks. These requirements are not yet mandatory, but funder expectations are shifting rapidly from voluntary to expected. IRBs that build AI governance capacity now are equipping the research organisations they serve to compete for and comply with the next generation of development research funding.

For IRBs operating in the development sector, this regulatory landscape raises a specific interpretive challenge. Most of these frameworks were designed with Northern research and technology contexts in mind: GDPR is a European regulation; the UNICEF policy reflects a multilateral institutional framing; the EU AI Act was built primarily around consumer protection and high-risk commercial AI applications. The task for an IRB like Includovate’s is not only to implement these frameworks but to interpret and apply them for contexts they were not primarily designed to address: participatory research with marginalised communities in low-income countries, Indigenous knowledge systems, disability-inclusive research, and survivor-centred methodologies where standard risk categories are inadequate.

Two specific gaps in the current regulatory landscape are clear. First, none of the frameworks above provide guidance on AI-specific risks in research involving children, including child-centred consent and assent processes, the prohibition on AI-generated descriptions of children’s experiences, and the heightened re-identification risks for children in geographically bounded communities. Second, survivor-centred research involving AI tools, including AI-assisted analysis of trauma narratives, disability accounts, or testimony from survivors of gender-based violence, has no standard safeguarding assessment framework within IRB review. These are contexts where Includovate has direct expertise and where the organisation is positioned to develop guidance that does not yet exist.

Procedural Reforms

Require AI-Specific Supplemental Documentation

Any research protocol involving AI tools, including AI-assisted transcription, coding, sentiment analysis, image recognition, or content generation, should require a dedicated supplemental submission addressing AI-specific risks. The questions this documentation must answer are knowable: What does the tool do, and on what data was it trained? Does that training data include populations comparable to the communities in this study? What data from this study will the tool access and retain? How was algorithmic bias assessed before use? What re-identification risks exist, including Categorical Privacy risks at community level? How will participants be informed of AI involvement, in language and formats accessible to them? What happens to their data if they withdraw or when the study ends? (Rutgers University Office for Research 2026; Northeastern University 2025; UNICEF 2026).

Several academic institutions, including Rutgers, Northeastern, and Harvard’s Catalyst Program, have begun developing such frameworks (Rutgers University Office for Research 2026; Northeastern University 2025; Harvard Catalyst 2025). What does not yet exist is guidance tailored to Global South, Indigenous, and disability research contexts, where existing institutional guidance is almost entirely absent, where the power differentials are greatest, and where the risks of AI misapplication are highest.

Establish Mandatory Data Sovereignty Review for Research with Indigenous and Marginalised Communities

IRB review of research involving Indigenous communities should require explicit documentation of how the research adheres to the CARE Principles for Indigenous Data Governance and, where applicable, the OCAP Principles (Ownership, Control, Access, Possession) developed by the First Nations Information Governance Centre (Carroll et al. 2020; First Nations Information Governance Centre 2014). This documentation must address collective consent processes, not only individual consent; community governance of data throughout the research lifecycle; the right of communities to review outputs before publication; and explicit restrictions on secondary use of data for AI training or model development.

The Common Rule currently omits any requirement to consider collective or group-level harms in human subjects research. Scholars and Indigenous data governance experts have called explicitly for its revision to address AI and machine learning applications (Russo Carroll et al. 2025). Systemic regulatory reform is slow, and it originates in the Global North. The UNICEF policy’s concept of Categorical Privacy begins to address group-level harm, but only for UNICEF-funded research. Independent IRBs like Includovate’s can adopt higher standards within their own processes such as applying a Categorical Privacy assessment to all research involving community-level datasets, regardless of funder.

Implement Continuous Review Triggers for AI Research

Standard IRB approval is a point-in-time decision. AI systems trained on participant data can change materially after approval, introducing ethical risks the original review never considered. Review processes must include mandatory reporting and reassessment triggers when an AI tool is significantly updated or retrained during a study, when model outputs begin influencing real-world decisions affecting participants, or when a tool is proposed for use beyond its original approved context (BeyondBound 2025; Sullivan et al. 2026). This need is now reinforced by funder policy: the UNICEF Ethics Policy’s high-risk classification of AI-interpreted results implies an ongoing, not only initial, oversight obligation (UNICEF 2026, para. 4.14.9).

This continuous review model has a direct parallel in clinical trial monitoring, where interim analyses can prompt protocol review or early termination. It requires IRBs to move from a one-time gatekeeper role to an ongoing oversight relationship with researchers using evolving tools. For development research, which often runs across multiple years and multiple countries, this shift is particularly important: the AI landscape changes faster than most multi-year study timelines.

Close the Exemption Loophole for Digital Research with Vulnerable Populations

The de-identification exemption under the Common Rule is functionally broken in the context of AI. Re-identification techniques have advanced to a point where data considered anonymous can be reconstructed with reasonable probability by an actor with access to other datasets (SACHRP 2022). The UNICEF policy’s concept of Categorical Privacy adds a further dimension: even community-level aggregate data that contains no individual identifiers can create discrimination risk when AI-processed. IRBs reviewing protocols that claim de-identification exemptions must treat both individual re-identification risk and community-level Categorical Privacy risk as conditions of exemption.

Beyond de-identification, the loophole that allows research involving AI tools to be classified as nonhuman subjects research must be challenged. Development funders and professional bodies must establish standards that extend ethical oversight to any research in which AI systems process community data, regardless of whether a human researcher is defined as the direct instrument of data collection.

Capacity Reforms

Require AI Literacy as a Condition of Reviewing AI Protocols

The CITI Program, the standard foundational training for IRB members, does not cover AI-specific risk assessment. IRB members reviewing protocols involving AI tools should be required to demonstrate literacy sufficient to evaluate algorithmic bias, model interpretability, re-identification risk, Categorical Privacy, data permanence, and the ethical implications of iterative model development (Harvard Catalyst 2025). This requires the capacity to ask the right questions and recognise when a researcher’s risk assessment is inadequate.

For Includovate’s IRB, the training need is specific: not general AI literacy, but literacy calibrated to AI risk in research with Global South communities, Indigenous participants, and people with disabilities, the contexts where generic Northern guidance consistently fails. The regulatory frameworks now entering force, including the UNICEF Ethics Policy and the EU AI Act, create a new practical argument for this training investment: IRB members who cannot evaluate AI-specific risks are leaving the organisations they review exposed not only to an ethical failure, but to funder non-compliance.

Include Community Expertise in Review

No level of technical AI expertise substitutes for knowledge of a community’s cultural protocols, power dynamics, and historical relationship with research institutions. IRBs reviewing research with specific communities should include members who hold that knowledge: lived-experience experts, community advisors, and Indigenous data governance practitioners.

Research on participatory approaches with transgender youth illustrated this clearly: the structural tension between inclusive methodologies and IRB classification systems became apparent only when reviewers lacked the experience to understand how community advisory board members could simultaneously be co-investigators and research participants (Shook et al. 2025). AI-enabled participatory research creates the same problem in a more acute form. A community member who contributes knowledge to a study that then trains an AI model may have their intellectual contribution encoded into a system without any of the authorship, governance, or ongoing consent rights that contribution warrants. IRBs cannot recognise this problem without members who understand it from the inside.

Move Upstream: From Protocol Review to Design Engagement

IRBs review research after the methodology has largely been determined. For AI research, this is too late. The decisions that determine ethical risk, which tool to use, what data to train it on, how outputs will be interpreted, and who will govern the model, are made at the design stage. By the time a protocol reaches IRB review, those decisions are embedded. Reviewing them is not the same as shaping them.

The Alaska Tribal Health System’s ELSI framework demonstrates what upstream engagement produces: research where communities have genuine governance over AI tools that will affect them, not merely the right to be informed (Berdahl et al. 2025). Independent IRBs like Includovate’s, which have no institutional research agenda creating a conflict of interest, are structurally well-placed to offer this kind of upstream engagement as a service

The Includovate IRB: What We Do Well and What We Must Do Next

Includovate’s IRB was established in 2019 as an independent, non-university board with a mandate to review research conducted in any country and across all sectors affecting marginalised communities. Its structural independence from any institutional research programme eliminates the conflict of interest that compromises many conventional boards. Its board is constituted to include members from low- and middle-income countries across disciplines, genders, and nationalities, a deliberate counterweight to the Northern epistemological bias that Includovate has publicly identified as a failing of mainstream IRB practice (Ganguly 2022; Langworthy, Mrazova, and Curbelo 2026).

The IRB’s published commitments already address several principles directly relevant to AI research: explicit recognition that universal research ethics norms frequently reflect Northern epistemologies that can harm Global South communities; a commitment to challenging parachute research practices and extractivist data relationships; and an acknowledgment that data sovereignty rights are inadequately addressed by most IRB processes (Langworthy, Mrazova, and Curbelo 2026). These commitments are the analytical foundation from which AI-specific reform should be built, and they distinguish Includovate’s review from that of most Northern institutional boards.

A Call to Action

The ethical review board was invented to protect research participants from institutional power. AI, without adequate oversight, concentrates that power further and makes it less visible. It enables research at scale while obscuring its own processes. It produces harms that are diffuse, delayed, and collective rather than individual and immediate. And in the context of development research, it layers new technical mechanisms onto power imbalances that were already profound.

For researchers, the obligation is clear: do not wait for regulatory reform to apply ethical standards to AI-enabled research: (1) Seek IRB review even when it is not legally required, (2) Require AI-specific documentation as a condition of your own practice, (3) Partner with communities during tool selection and study design, not only at the point of consent.

If you are using an AI tool to analyse data from communities in the Global South, ask whose values are encoded in that tool, whether those communities had any role in its development, what your tool’s error rates are for the languages and dialects you are analysing, and what happens to community data after your study ends. These are the minimum due diligence that development research ethics demands. Additionally, in an increasing number of funding contexts, they are questions your funder will begin to ask.

For IRBs, the reforms outlined here are achievable now, within existing structures, without waiting for regulatory mandates. Every IRB reviewing development research involving AI has the authority to require better disclosure, more meaningful consent processes, community-level data governance including Categorical Privacy assessment, and ongoing review when AI tools evolve. The procedural and capacity changes described above represent a minimum standard for any board that takes its mandate seriously when the research it reviews crosses the boundaries that have historically divided those who benefit from research from those who bear its risks.

Includovate commits to developing AI-specific supplemental review requirements tailored to Global South, Indigenous, and disability research contexts; a formal data sovereignty protocol for research involving Indigenous and collective communities; a continuous review mechanism for studies using iterative AI tools; targeted AI literacy training for board members focused on the intersection of AI risk and research with marginalised communities; and applied guidance for interpreting the UNICEF Ethics Policy and emerging funder requirements in participatory and community-based research settings. We invite peer institutions, researchers, and community organisations to contribute to developing these frameworks and to hold us accountable for delivering them.

In the age of AI, the IRB must evolve past a rubber stamp to an act of collective protection. In development research, where the distance between those who design research and those who live with its consequences is already too great, that protection has never been more necessary, or more possible to provide, than it is now.

References

Berdahl, Carolyn T., et al. 2025. “Community-Engaged Artificial Intelligence: An Upstream, Participatory Design, Development, Testing, Validation, Use and Monitoring Framework for Artificial Intelligence and Machine Learning Models in the Alaska Tribal Health System.” Frontiers in Artificial Intelligence 8. https://doi.org/10.3389/frai.2025.1568886.
BeyondBound. 2025. “The AI Research Surge: How IRBs Can Keep Pace Without Compromise.” BeyondBound Blog. https://beyondbound.blog/institutional-review-board/the-ai-research-surge-how-irbs-can-keep-pace-without-compromise/.
Blak Focus. 2025. “AI Bias and Indigenous Knowledges.” Deakin University. https://blogs.deakin.edu.au/article/blak-focus-july-2025-edition-ai-bias-and-indigenous-knowledges/.
Carroll, Stephanie Russo, Ibrahim Garba, Oscar L. Figueroa-Rodriguez, Jarita Holbrook, Raymond Lovett, Simeon Materechera, Mark Parsons, Kay Raseroka, Desi Rodriguez-Lonebear, and Robyn Rowe. 2020. “The CARE Principles for Indigenous Data Governance.” Data Science Journal 19 (43): 1-12. https://doi.org/10.5334/dsj-2020-043.
El Morr, Christo, Bashar Kundi, Fatima Mobeen, Sogand Taleghani, Yahya El-Lahib, and Rachael Gorman. 2024. “AI and Disability: A Systematic Scoping Review.” Journal of Disability and Rehabilitation: Assistive Technology. https://doi.org/10.1177/14604582241285743.
European Parliament and Council of the European Union. 2024. Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 Laying Down Harmonised Rules on Artificial Intelligence (Artificial Intelligence Act). Official Journal of the European Union, L 2024/1689. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:L_202401689.
European Parliament and Council of the European Union. 2016. Regulation (EU) 2016/679 of the European Parliament and of the Council on the Protection of Natural Persons with Regard to the Processing of Personal Data (General Data Protection Regulation). Official Journal of the European Union, L 119. https://eur-lex.europa.eu/eli/reg/2016/679/oj.
FCDO. 2024. AI for Development Programme. UK Foreign, Commonwealth and Development Office. https://www.gov.uk/government/publications/ai-for-development-programme.
First Nations Information Governance Centre. 2014. Ownership, Control, Access and Possession (OCAP): The Path to First Nations Information Governance. Ottawa: First Nations Information Governance Centre.
Ganguly, Shreya. 2022. “An Inclusive and Innovative Approach to Research Ethics: Includovate’s Internal Review Board.” Includovate. https://www.includovate.com/an-inclusive-and-innovative-approach-to-research-ethics-includovates-internal-review-board/.
Ghosh, Sourojit, Pooja N. Venkit, Sanjana Gautam, et al. 2024. “Do Generative AI Models Output Harm While Representing Non-Western Cultures: Evidence from a Community-Centered Approach.” In Proceedings of the AAAI/ACM Conference on AI, Ethics, and Society, 7: 476-489.
Grohol, John. 2023. “Koko Used GPT-3 AI Without Informed Consent from Users.” New England Psychologist, January 11. https://www.nepsy.com/articles/leading-stories/koko-used-gpt-3-ai-without-informed-consent-from-users/.
Harvard Catalyst Regulatory Program. 2025. “Educational Resources on AI and Human Participant Research.” Harvard University. https://catalyst.harvard.edu/regulatory/ai-human-participant-research/educational-resources/.
Kukutai, Tahu, and John Taylor, eds. 2016. Indigenous Data Sovereignty: Toward an Agenda. Canberra: ANU Press.
Langworthy, Melissa, Alena Mrazova, and Natalia Curbelo. 2026. “Transformational Research Starts with Inclusive and Ethical Review Boards (IRBs).” Includovate. https://www.includovate.com/transformational-research-starts-with-inclusive-ethical-review-boards-irbs/.
Maiberg, Emanuel. 2023. “‘Horribly Unethical’: Startup Experimented on Suicidal Teens on Social Media with Chatbot.” Vice/Motherboard. https://www.vice.com/en/article/horribly-unethical-startup-experimented-on-suicidal-teens-on-facebook-tumblr-with-chatbot/.
Malinda, Samson. 2025. “Indigenous Peoples and AI: Defending Rights, Shaping the Future of Technology.” Cultural Survival, August 8. https://www.culturalsurvival.org/news/indigenous-peoples-and-ai-defending-rights-shaping-future-technology.
National Commission for the Protection of Human Subjects of Biomedical and Behavioral Research. 1979. The Belmont Report: Ethical Principles and Guidelines for the Protection of Human Subjects of Research. Washington, DC: US Department of Health, Education, and Welfare.
Ndasauka, Yamikani, et al. 2024. “Cognitive Imperialism in Artificial Intelligence: Counteracting Bias with Indigenous Epistemologies.” AI and Society. https://doi.org/10.1007/s00146-024-02065-0.
Northeastern University Human Subject Research Protection. 2025. “New Form: AI Systems Used in Human Subjects Research.” https://dhr.research.northeastern.edu/new-form-ai-systems-used-in-human-subjects-research-9-8-2025/.
Office for Human Research Protections (OHRP). 2023. OHRP Registered IRBs and Institutional Profiles. US Department of Health and Human Services. https://www.hhs.gov/ohrp/register-irbs-and-obtain-fwas/index.html.
Perera, Maneesha, Rajith Vidanaarachchi, Sangeetha Chandrashekeran, Melissa Kennedy, Brendan Kennedy, and Saman Halgamuge. 2025. “Indigenous Peoples and Artificial Intelligence: A Systematic Review and Future Directions.” Big Data and Society 12 (2). https://doi.org/10.1177/20539517251349170.
Russo Carroll, Stephanie, Backbone Wagner, Vanessa Y. Hiratsuka, and Nanibaa’ A. Garrison. 2025. “Common Rule Revisions to Govern Machine Learning on Indigenous Data: Implementing the Expectations.” PMC. https://pmc.ncbi.nlm.nih.gov/articles/PMC11920922/.
Rutgers University Office for Research. 2026. “New AI Consent Guide Helps Researchers Strengthen IRB Submissions and Protect Participants.” January. https://research.rutgers.edu/news/new-ai-consent-guide-helps-researchers-strengthen-irb-submissions-and-protect-participants.
Secretary’s Advisory Committee on Human Research Protections (SACHRP). 2022. IRB Considerations on the Use of Artificial Intelligence in Human Subjects Research. Washington, DC: US Department of Health and Human Services. https://www.hhs.gov/ohrp/sachrp-committee/recommendations/irb-considerations-use-artificial-intelligence-human-subjects-research/index.html.
Shook, Abby, et al. 2025. “Navigating Challenges with IRB Review for Community-Engaged Research with Transgender Youth in the United States.” Ethics and Human Research. https://doi.org/10.1002/eahr.70002.
Sullivan, Timothy, et al. 2026. “Streamlining IRB Review of AI Human Subjects Research: The Three-Stage Framework.” Frontiers in Systems Biology. https://doi.org/10.3389/fsysb.2026.1804193.
Tilmes, Nanna. 2022. “Disability, Fairness, and Algorithmic Bias in AI Recruitment.” Ethics and Information Technology. https://doi.org/10.1007/s10676-022-09633-2.
UNICEF. 2026. Policy on Ethics in Evidence Activities. New York: United Nations Children’s Fund. https://www.unicef.org/evaluation/media/3611/file/UNICEF%20Policy%20on%20Ethics%20in%20Evidence%20Activities%20%28May%202026%29.pdf.
United Nations. 2007. United Nations Declaration on the Rights of Indigenous Peoples. New York: United Nations.