{"site":{"name":"Koji","description":"AI-native customer research platform that helps teams conduct, analyze, and synthesize customer interviews at scale.","url":"https://www.koji.so","contentTypes":["blog","documentation"],"lastUpdated":"2026-07-28T13:23:50.163Z"},"content":[{"type":"documentation","id":"a41f650d-ff03-4fe7-96c2-176b70de4f97","slug":"irb-approval-user-research","title":"Do You Need IRB Approval for User Research? A 2026 Decision Guide","url":"https://www.koji.so/docs/irb-approval-user-research","summary":"Most commercial product and UX research does not require IRB approval because it is not designed to produce generalizable knowledge - the hinge test under the Common Rule (45 CFR 46). Four situations require review: peer-reviewed publication intent, FDA or regulatory submissions, federal funding, and institutional policy including vulnerable populations. Exempt status (45 CFR 46.104, especially Category 2 for surveys and interviews) must be determined by an IRB and cannot be self-declared. Publication intent must be decided before data collection because retroactive approval is generally unavailable.","content":"## The short answer\n\n**Most commercial product and UX research does not need IRB approval. Most academic research does.** The dividing line is not the method you use — interviews, surveys, and usability tests all sit on both sides of it. The line is drawn by federal regulation (the Common Rule, 45 CFR 46) and turns on one hinge question: **is your study designed to produce generalizable knowledge?**\n\nDiscovery interviews, usability tests, NPS programs, and churn research run to improve your own product are almost never \"human subjects research\" in the regulatory sense. They are business operations that happen to involve talking to people.\n\nFour situations flip the answer to yes:\n\n1. You intend to **publish in a peer-reviewed venue**\n2. The work supports an **FDA or other regulatory submission**\n3. The study is **federally funded** under an agency that applies the Common Rule\n4. Your **institution's own policy** requires review — common with universities, health systems, school districts, and studies involving vulnerable populations\n\n> This guide is written for research and product teams, not lawyers, and it is not legal advice. Critically: **only an IRB can determine that a study is exempt.** You cannot self-certify exemption.\n\n## What an IRB actually is\n\nAn Institutional Review Board is a committee, registered and operating under 45 CFR 46, that reviews research involving human subjects before it begins. Its job is participant protection, not research quality policing.\n\nThe approval criteria are spelled out in [45 CFR 46.111](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-A/part-46/subpart-A/section-46.111). A board must find that:\n\n- Risks to participants are minimized\n- Risks are reasonable relative to anticipated benefits\n- Participant selection is equitable\n- Informed consent is obtained and properly documented\n- There are adequate provisions for monitoring data\n- There are adequate protections for privacy and confidentiality\n\nRead that list again with a research-ops eye: five of the six are documentation problems. That is why teams with clean consent flows and data-management plans clear review quickly, and teams without them stall.\n\n## The two-part regulatory test\n\nUnder the Common Rule, you need review only if the activity is **research** *and* involves **human subjects**. Both must be true.\n\n**Is it \"research\"?** The regulation defines it as \"a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge.\"\n\nThe operative phrase is *generalizable knowledge*. A study designed to tell you whether **your** onboarding flow confuses **your** users is not designed to contribute generalizable knowledge — it is designed to improve a specific product. That is the single most important distinction in this entire guide.\n\n**Does it involve \"human subjects\"?** A living individual about whom an investigator obtains information through intervention or interaction, or obtains identifiable private information.\n\nThere is also a threshold question that trips people up: **is your organization even covered?** A private company with no federal funding and no Federalwide Assurance is generally not subject to the Common Rule at all. That does not mean ethics are optional — it means the *regulatory* mechanism of IRB review does not apply, and your obligations run through privacy law, contracts, and professional ethics instead.\n\n## Decision table\n\n| Your scenario | IRB review typically needed? |\n|---|---|\n| Discovery interviews to shape your roadmap | No |\n| Usability test of your own checkout flow | No |\n| Ongoing NPS, CSAT, or churn interview program | No |\n| Blog post or conference talk about what you learned | Usually no — but confirm the venue's policy |\n| Peer-reviewed journal or academic conference paper | **Yes** |\n| FDA submission (device human factors, labeling comprehension) | **Yes** |\n| NIH, NSF, or other federally funded study | **Yes** |\n| Collaboration with a university co-author | **Yes — through their institution** |\n| Research with children recruited through a school | **Often, plus district and school approval** |\n| Study of your own employees intended for publication | **Yes** |\n\nThe pattern: **audience and purpose decide, not method.** The same 30-minute interview guide can be exempt business research on Monday and reviewable human subjects research on Tuesday, purely because you decided to publish.\n\n## The exempt categories worth knowing\n\nThe 2018 revised Common Rule (45 CFR 46.104) defines eight exempt categories. Two matter most for research teams:\n\n- **Category 1** — research conducted in established educational settings involving normal educational practices\n- **Category 2** — research involving educational tests, **survey procedures, interview procedures**, or observation of public behavior\n\nCategory 2 covers a great deal of ordinary UX work. But two caveats matter enormously:\n\n**Exempt is a determination, not a self-declaration.** You submit; the IRB decides. Skipping this step and later claiming exemption is the most common way teams lose the ability to publish.\n\n**Exempt does not mean paperwork-free.** Many institutions require registration, and some exempt categories trigger a \"limited IRB review\" focused specifically on privacy and confidentiality protections.\n\n## The four triggers, in detail\n\n**1. Publication intent.** Journals and academic conferences routinely require an IRB approval statement. Retroactive approval is generally **not** available — a board cannot approve a study that already happened. Decide whether you might publish *before* you collect a single response. This is the mistake that cannot be fixed later.\n\n**2. Regulated submissions.** FDA-regulated human factors and usability work for medical devices, and labeling comprehension studies for drugs, sit under their own regulatory regime with its own review expectations.\n\n**3. Federal funding.** If an agency applying the Common Rule funds the work, review follows the money.\n\n**4. Vulnerable populations and institutional policy.** Children, prisoners, pregnant people, and individuals with cognitive impairments attract additional scrutiny and, often, additional subparts of the regulation. Schools and health systems layer their own gatekeepers on top — a school district's approval is a separate hurdle from the IRB's, and neither substitutes for the other. If you are researching minors, start with [user research with children and teens](/docs/user-research-with-children-teens).\n\n## If you do need review: how to move faster\n\n**Pick the right track.** Exempt determination, expedited review (minimal-risk studies reviewable by a single member), or full board review. Full board review is tied to a meeting calendar, which is usually what makes timelines feel unpredictable — expect turnaround to vary substantially by institution, and ask for the submission calendar up front rather than guessing.\n\n**Assemble the packet before you start writing prose:**\n\n- Protocol and research questions\n- Recruitment materials and [screener questions](/docs/screener-questions-guide)\n- Informed consent document\n- The full question list or interview guide\n- A data-management plan: where data lives, who can access it, how long you keep it, how you de-identify\n- Incentive structure and amounts\n\nIn practice the biggest source of delay is not the science — it is an incomplete consent document or a missing data-management plan. Those are exactly the artifacts a disciplined research operation already produces.\n\n## Why AI-moderated interviews produce cleaner IRB submissions\n\nAn AI interviewer does not change whether you need review. It does change how good your documentation is — and documentation is what review actually examines.\n\n- **The protocol is delivered identically to every participant.** A board reviewing a human-moderated study has to trust that eight different moderators asked questions consistently. With AI moderation, the protocol *is* the instrument, and every participant receives it the same way. See [AI vs human moderators](/docs/ai-vs-human-moderators) for where each approach wins.\n- **Consent is captured before the conversation starts**, as a structured step rather than a verbal aside — see [intake forms and consent](/docs/intake-forms-and-consent).\n- **Verbatim transcripts** give reviewers and auditors the complete record, rather than a moderator's notes.\n- **Structured questions make your instrument reviewable.** Koji supports six question types — `open_ended`, `scale`, `single_choice`, `multiple_choice`, `ranking`, and `yes_no` — so the exact instrument an IRB wants to see is the same object you configured. The [structured questions guide](/docs/structured-questions-guide) walks through building one.\n- **De-identification is a design choice you make up front.** Scope studies to avoid collecting identifiers at all; see [anonymizing customer interview data](/docs/anonymizing-customer-interview-data).\n\nTwo honest caveats. First, AI moderation does not reduce the regulatory need for review — it improves the quality of what you submit. Second, **disclose in your protocol that the interviewer is an AI system.** Reviewers will ask, participants deserve to know, and in the EU the AI Act imposes its own transparency duty on AI interactions independent of anything an IRB requires.\n\n## A worked example\n\nA healthtech team runs 40 AI-moderated interviews about how patients describe medication side effects. Purpose: improve their symptom-logging feature. No federal funding, no publication plan, no PHI collected. **No IRB review needed** — this is product research.\n\nSix months later, a clinician advisor wants to co-author a paper on the findings with a university affiliation. Now the calculus inverts: the university is engaged, the intent is generalizable knowledge, and the data was collected without approval. The paper is likely unpublishable from that dataset. The fix would have been a 30-minute conversation with the university's IRB office *before* fieldwork — and, if needed, a fresh round of consented interviews under an approved protocol.\n\n## Common mistakes\n\n1. **Assuming \"it's just interviews\" means exempt.** Category 2 often applies, but only the IRB can say so.\n2. **Deciding to publish after collecting data.** The most expensive and least fixable error in this guide.\n3. **Treating \"exempt\" as \"no process.\"** Registration and limited review are common.\n4. **Forgetting the second gatekeeper.** Schools, employers, and health systems approve separately from the IRB.\n5. **Submitting a consent form with no data-management plan.** The fastest route to a revise-and-resubmit.\n6. **Confusing ethics with regulation.** No IRB requirement does not mean no obligations — see the [research ethics guide](/docs/research-ethics-guide).\n\n## Related Resources\n\n- [Research Ethics and Informed Consent](/docs/research-ethics-guide) — the ethical foundation that applies whether or not an IRB does\n- [Structured Questions Guide](/docs/structured-questions-guide) — build the reviewable instrument behind your protocol\n- [Research Consent Form Templates](/docs/research-consent-form-templates) — starting points for your consent documentation\n- [Anonymizing Customer Interview Data](/docs/anonymizing-customer-interview-data) — de-identification as a design choice\n- [Research Data Retention and Deletion](/docs/research-data-retention-deletion) — the data-management plan reviewers ask for\n- [User Research With Children and Teens](/docs/user-research-with-children-teens) — when vulnerable-population rules apply\n- [Trauma-Informed User Research](/docs/trauma-informed-user-research) — minimizing risk on sensitive topics","category":"Research Operations","lastModified":"2026-07-27T03:19:42.141406+00:00","metaTitle":"Do You Need IRB Approval for User Research? (2026 Guide)","metaDescription":"Most commercial UX research does not need IRB approval - most academic research does. Learn the Common Rule test, the exempt categories, the four triggers that require review, and how to prepare a fast-clearing submission.","keywords":["irb approval user research","do i need irb approval","irb ux research","common rule 45 cfr 46","human subjects research","irb exempt category 2","irb user experience research","institutional review board product research","irb submission checklist","generalizable knowledge test"],"aiSummary":"Most commercial product and UX research does not require IRB approval because it is not designed to produce generalizable knowledge - the hinge test under the Common Rule (45 CFR 46). Four situations require review: peer-reviewed publication intent, FDA or regulatory submissions, federal funding, and institutional policy including vulnerable populations. Exempt status (45 CFR 46.104, especially Category 2 for surveys and interviews) must be determined by an IRB and cannot be self-declared. Publication intent must be decided before data collection because retroactive approval is generally unavailable.","aiPrerequisites":["Basic familiarity with running user interviews or surveys","An understanding of your organization funding sources and publication plans"],"aiLearningOutcomes":["Apply the two-part Common Rule test to decide whether your study needs IRB review","Identify the four situations that require review regardless of method","Understand why exempt status must be determined by an IRB rather than self-declared","Assemble an IRB submission packet that clears review without revise-and-resubmit","Design AI-moderated studies whose documentation satisfies reviewer expectations"],"aiDifficulty":"intermediate","aiEstimatedTime":"14 min read"}],"pagination":{"total":1,"returned":1,"offset":0}}