AI, Research Integrity and Data Safety

by Sergueï Spetschinsky · October 2026

This note sets out the research-integrity guidelines that govern AI use, and how I approach them.

The core rules of responsible AI use

The major bodies^[1] converge on a short list of essentials:

• You bear full responsibility: the AI is never the author. You remain fully responsible for everything in your work, whatever helped you produce it.
• Keep confidential material out: no unpublished work by others, no personal data.
• Disclose and cite your AI use: which tool, what for, and how much.
• Stay traceable: keep a record of the model, its version, and the prompts that mattered, so an AI-assisted method can be followed like any other.

Safety of Research Data

Keeping sensitive and personal data out of commercial AI tools is a safe default. However, there is a path to it, although complex. For researchers whose material is personal data, such as interviews, field notes or survey answers, European data-protection law (the GDPR) allows such data to be processed with AI, under conditions. Where an institution forbids personal data in AI tools altogether, its rule comes first.

Research data about people can go into an AI system only when three things are true:

• The consent form to the study's participants names the AI use concretely. The consent text must tell participants which of their data goes to which service, where it is processed and stored, for how long, and that it is never used to train models.
• The technical setup must keep that promise. The contract excludes training, a data-processing agreement is in place, and any transfer of the data abroad has a lawful basis. That rules out personal AI plans such as personal Claude or ChatGPT plans.
• The safeguards are documented: pseudonymisation, who has access, when the data is deleted, and a record of what was processed where.

Participants can also withdraw their consent at any time, but withdrawal only stops future processing.

This is extremely cumbersome and difficult to apply. The alternative is a safer, completely different setup, based on local and/or sovereign AI providers, which does not require the same level of consent. This includes systems run locally on a university's computers or on your own machine (local open source AI models), or cloud services operated by the universities themselves. If these solutions are very promising, and likely are the future of AI in research, they are also only in their infancy: complex to set up and far less performant than the commercial providers.

Compliance Through Competence

My own view is that compliance with the highest research standards comes through true AI competence, and not from just knowing the rules. Advanced AI skills, adapted to scientific research, are what make compliance not only adequate but much easier.

The idea is not to use AI without getting oneself into trouble. It is to be able to expertly produce great research with AI, and as a consequence, to comply with guidelines of the highest standard with minimal effort. This happens through two means.

The first is automatic recording and flagging. A researcher who can set up their own agentic AI system, that is, their personalised AI assistant, can also set it up so that:

• Every interaction with the LLM is logged (tool, use case, time, prompts, model, version, and so on), which renders the whole of the research done with the LLM traceable, queryable, and describable, down to the individual prompt or session.
• Any confidential material that might be entered into the LLM by accident is flagged and triggers an automatic stop.

This greatly facilitates disclosure, making it highly accurate and partly automatic, needing only the researcher's review.

The second means is knowledge and judgment. Most of my teaching is about exactly that: training the judgment to use AI critically, while staying fully in control. It is about knowing when to trust AI outputs, when to distrust them, and how to push back and course-correct when they stray. It is also about having the technical knowledge to be able to self-design the appropriate systems for one's own research, including those concerning research integrity and data safety. With that in hand, a researcher can see the quality, speed, and enjoyment of their work improve.