👋 Hey, I'm Kaleb. I help research teams go from surviving to thriving in the Age of AI.
Have you updated your participant consent forms to cover AI? That might throw a wrench in your AI Research Engine.
Most research teams I work with haven't. Then the old interviews end up in an insights bot anyway.
Here's why that matters. Your past participants signed up for a study. For most teams I work with, those forms never mentioned AI.
The issue is running a study through a new AI tool means telling people which tools handle their data (GDPR Art. 13). Reusing old sessions for something new, like an AI research insights bot that searches across studies, building digital twins, or training a model, usually counts as a new purpose, and that needs more: you tell people before it starts (Art. 13(3)) and ideally get their consent on each use case.
Why? If a study relied on consent, it gets harder. Every company needs a legal reason to use people's data, and "they agreed" is only one option. If "they agreed" was your reason, you can't switch to a different reason later because the agreement didn't cover AI. EU regulators put it plainly: you "cannot swap from consent to other lawful bases" (EDPB, 2020). You ask again, or you leave that data out.
Skip this, and you risk both the law and your participants' trust. To further muddy the waters of consent: these are EU and UK rules. US teams face their own state laws, starting with recording and voiceprints.
Want the full details and in-depth consent form? Sign up for the AIxUXR newsletter below to get this week’s Consent & AI Disclosure pack (and other packs, prompts, and playbooks).
The default: tell everyone, and only use AI on a yes
Put this in every form, starting with your next study:
We’d like to use AI tools to transcribe and help analyze this study. [Name the tools, e.g. “an AI notetaker.”] [Only if your contract says so: These tools don’t use what you say to train their AI.] [Only if you also have zero data retention: They don’t keep your data after they process it.] [If true: Our research team checks everything the AI produces.]
We’ll only use AI on your session if you tick yes. You get your full incentive either way.
☐ Yes, you can use AI tools on my session
☐ No, please don’t use AI on my session
It asks for a real choice without claiming a legal basis your privacy team didn't choose. A blank box means no: "Silence, pre-ticked boxes or inactivity should not therefore constitute consent" (GDPR Recital 32). For the full layered form, see the Desk section below where you can go see the full consent pack and a full form.
Want it tailored? The AI disclosure drafter builds a version for your tools and your study.
Must vs. should
There are two layers here, and it helps to keep them apart.
Must (the legal floor): tell people which AI tools handle their data, and tell them before any new use starts. Get consent where the law requires it, like studies that relied on consent and recording where everyone's OK is required. Sensitive topics like health or religion need an extra condition, such as explicit consent. Your privacy team owns this layer.
Should (my rule): ask everyone for a yes before AI touches their session, even where the law doesn't require it.
What about your old interviews?
Ask your privacy team. Send them the three questions in the Desk below, starting with the first: which legal basis did we use for our past studies? No privacy team? Ask your legal counsel, or whoever signs your vendor contracts. If no one knows, that's your first finding.
Sort them while you wait. Don't freeze everything:
Green, go: anonymized insights that can't point back to a person, and studies whose form already asked for consent for this use.
Yellow, ask first: raw transcripts and recordings from studies that didn't rely on consent. Must: your privacy team checks the legal side. Should: ask participants for a yes before their sessions go in.
Red, keep out for now: raw data from studies that relied on consent when the form didn't mention AI. Instead, you’ll need to either go back and seek consent or leave them out. Note: sessions where health, religion, or similar topics came up also wait for your privacy team.
Already in a tool? Don't panic-delete. Check whether the vendor keeps the data or trains on it, limit who can see raw quotes, and add those studies to the list for your privacy team.
Move each group once your privacy team confirms its basis.
bottom line
No consent? no AI research insights bot, digital twins, or AI product.
That's my principle and opinion, and I'd suggest you hold it too, regardless of what legal says you're allowed to do. Just because you can, doesn't mean you should. Legally permissible doesn't always promote trust. It's the principle.
Want to go deeper or bring in your privacy team?
The Consent & AI Disclosure Pack includes scenarios, EU and US rules, and an FAQ with sources. Subscribe below to get it.
Not legal advice. I'm a researcher, not a lawyer. These are the questions to bring to the people who give legal advice.
THE DESK
three questions for your privacy team
Look. I’m not a lawyer or a legal expert. If your head is spinning trying to figure this out, let your internal experts guide you. Below are three simple questions to ask them. Copy them into a message and update the [brackets].
Which legal basis did we rely on for past studies, and does it cover AI analysis and a searchable repository?
What did we tell participants, and what do we need to tell them before we reuse their sessions for [AI processing and products (e.g., Research Insights Bot, Digital Twins, or insert AI Feature or product name)]?
What would an insight need to look like to count as anonymous?
The full layered consent form, with the AI tools table, a checklist, and worked examples for insight bots, synthetic personas, and digital twins, is in The Consent & AI Disclosure Pack. It goes out with the email edition. Subscribe below and I’ll send you the pack.
The Tabs
A collection of what I’ve been reading the past couple of weeks, if you’re curious like I am:
Article 6: Lawfulness of processing (GDPR)—The six legal bases, straight from the law. Short, and the place to start.
A guide to lawful basis (ICO)—The UK regulator's plain-language walk-through of how to pick a basis.
Guidelines 05/2020 on consent (EDPB)—The regulators' own words on why you can't swap away from consent later (para 123). Dry, and worth ten minutes.
Introduction to anonymisation (ICO)—The clearest single page I've found on why names-removed isn't anonymous.
Article 50: Transparency obligations (EU AI Act Service Desk)—Where the AI Act actually reaches researchers: AI moderators and emotion recognition. Not your synthesis.
How do we ensure lawfulness in AI? (ICO)—Where lawful basis meets AI. It's under review, so check the date.
Quietly changing your terms of service could be unfair or deceptive (FTC)—The US regulator on using customer data for AI training after the fact. Short, and the US version of tell people first.
California Consumer Privacy Act, full text (CPPA)—If your participants are in California. Section 1798.100 covers what to tell people at collection.
The HEARTS Check
In my ResearchOps Review article in October, I scored my own AI research pipeline with HEARTS, my framework for checking AI research workflows. Consent was one of the dings on Safety. My setup asked whether consent covered AI processing. It never required it. The transcripts came from a past study whose consent form didn't cover AI, and the pipeline still let me run.
Safety scored 2.2 out of 5 on version 1. Version 2 brought it to 3.2, though it still relies on the researcher to confirm consent.
HEARTS scores for my AI research pipeline, version 1 to version 2. Safety rose from 2.2 to 3.2, the biggest change of the six lenses.
Same lesson from the other side: find out what's actually true before you trust the form. Read the full article >
Tell me in the comment box below: if your team is building an insights bot, did you make sure to get consent for AI processing from participants? I'm collecting the patterns.
Stay curious, stay critical, stay cool.
Kaleb
AI Usage Disclosure: Practicing the T in HEARTS. This piece is human-led and AI-assisted. The story, the point of view, and every editorial choice are mine. I used AI to help with gathering, structuring and formatting the content. The judgment calls—what to keep, what to cut, what's true to my experience—stayed with me.