Overview
Artificial intelligence (AI) technologies are computer systems, computations, and technologies intended to perform tasks normally requiring human intelligence. AI includes machine learning (ML), natural language processing (NLP), large language models (LLM), and similar forms of computation and prediction. It also includes AI assistants, such as chatbots, and other AI-driven applications, interfaces, dashboards, and information systems.
This guidance provides general information on IRB submission and review of human research developing and deploying AI.
Important for approved studies: All studies developing or deploying AI must include the required information below in PittPRO. This includes previously approved studies, especially those that do not explicitly reference the use of AI or for which the plans for use have substantially changed. In those cases, submit a Modification with the necessary information to ensure compliance.
Generative AI (GenAI)
To promote the protection of University computing resources and University data, Pitt Information Technology has an Operating Standard on the requirements for use of GenAI tools: Acceptable Use of Generative Artificial Intelligence Tools. Restrictions exist on what GenAI tools and types of data may be used.
Pitt Information Technology must approve the GenAI tool to be used. A list of pre-approved GenAI tools can be found here: University GenAI Tools List. GenAI tools that have not been pre-approved must undergo a Vendor Security Risk Assessment.
Private and restricted data may not be used with public GenAI tools.
National Institute of Health (NIH) Genomic Data Sharing Policy and Data Use Certification Agreement prohibit the use of controlled-access human genomic data in the sharing, retaining or training of GenAI tools without prior approval. Sharing of controlled-access data with public GenAI tools is prohibited. GenAI models using the controlled-access data under NIH approved use may not share the model, including model parameters, except with collaborators who are also Approved Users and may not retain the GenAI model, including model parameters, upon project completion.
Technical Consultation
Depending on the nature of the research, the IRB may enlist a technical consultant to assess risks, the data safety and monitoring plan, and risk mitigation strategies applicable to the use of AI in the protocol.
PittPRO Instructions
The PittPRO submission should provide sufficient information for the IRB to assess the risk and benefits of the research and ensure appropriate protections of research subjects and their data.
Study Scope
AI may meet the definition of a medical device if it is intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment, or prevention of disease. Please see the guidance on medical devices.
If research involves the development of an AI medical device or testing the safety or effectiveness of an AI medical device, select “Yes” to #8 on the Study Scope page and complete the Devices page that generates.
Site Permissions
When AI is being deployed in an information system or interface, the institution administering the system should be listed as a site on the Local Research Locations page.
If it is not a Pitt or UPMC site, select “External Sites/Other” under #1 on the page, and upload either the IRB approval letter from the external site or a site permission letter. The permission must be from a system administrator or other appropriate administrator at the external site. A template that includes the necessary information can be found in A-Z Guidance: Requirements for Permission Letter to Deploy AI. Required permission letters can be combined into a single letter if all necessary information is provided and is from an individual with authority to provide all required permissions.
For UPMC information systems, upload the permission letter on the Local Supporting Documents page from the appropriate authority. If you plan to deploy AI in the UPMC Electronic Medical Record system, provide a letter from the UPMC Chief Medical Information Officer.
Study Aims
As appropriate, the Study Aims page in PittPRO should identify clear AI related outcomes under study, including for exploratory projects.
Research Activities
The Research Activities page in PittPRO should provide sufficient information on prior and proposed training and validation methods to assess the stage of the proposed AI’s development. This includes at minimum
- Identifying the prior and proposed datasets used for training and validation,
- Explaining in lay terms the prior and proposed methods for training and validation, including whether validation has or will occur by the use of hold-out datasets or external datasets, and
- Justifying why the dataset(s) being proposed for training and for validation are appropriate for targeted AI outcomes.
Electronic Data Management
AI technologies used in human subject research and the associated storage plan may require an Ancillary Review by Data Security to ensure appropriate privacy and confidentiality protections, as well as compliance with University policy. To facilitate this review, the AI technologies should be identified on the Electronic Data and Management page in PittPRO.
Users will provide the following information on the EDM page:
- Choose “Artificial Intelligence (AI, GenAI) under #4 and provide the name of the program and/or service, version, and website
- The host of the AI Program or Service: Pitt servers, Vendor hosted or other third-party
- If it is vendor hosted, study teams will need to attest to the vendor security assessment through upload of approval or initiate the Vendor Security Risk Assessment
Data and Safety Monitoring
Under #1, all non-exempt research should include a data safety and monitoring plan commensurate with the risks of AI use. In some cases, the IRB may require a data safety and monitoring plan for exempt research.
Sharing AI models may require University to put in place an agreement. Under #2, state “The AI model may be shared upon consultation with the Office of Sponsored Programs.”
Similarly, the consent form, or introductory script for exempt research, should also include the language addressing sharing for future research and possible commercialization found under “Confidentiality” in the Building Your Consent Document guidance.
As noted above, when sharing data from NIH-funded research NIH policies prohibit the use of controlled access data with public AI tools. Other uses require prior approval.
Risks and Benefits
Privacy and confidentiality protections are addressed on the Electronic Data Management page. Additional risks and associated risk mitigation strategies should be included on the Risk and Benefits page.
Under #1, list implementation of the AI as a research activity and identify any risks beyond breach of confidentiality. These risks should also be included in the consent form or introductory script.
Under #2, describe the safeguards and mitigation strategies for those risks.
7/8/2025