Do You Need IRB Approval for User Research? A 2026 Decision Guide

The short answer

Most commercial product and UX research does not need IRB approval. Most academic research does. The dividing line is not the method you use — interviews, surveys, and usability tests all sit on both sides of it. The line is drawn by federal regulation (the Common Rule, 45 CFR 46) and turns on one hinge question: is your study designed to produce generalizable knowledge?

Discovery interviews, usability tests, NPS programs, and churn research run to improve your own product are almost never "human subjects research" in the regulatory sense. They are business operations that happen to involve talking to people.

Four situations flip the answer to yes:

1. You intend to publish in a peer-reviewed venue
2. The work supports an FDA or other regulatory submission
3. The study is federally funded under an agency that applies the Common Rule
4. Your institution's own policy requires review — common with universities, health systems, school districts, and studies involving vulnerable populations

This guide is written for research and product teams, not lawyers, and it is not legal advice. Critically: only an IRB can determine that a study is exempt. You cannot self-certify exemption.

What an IRB actually is

An Institutional Review Board is a committee, registered and operating under 45 CFR 46, that reviews research involving human subjects before it begins. Its job is participant protection, not research quality policing.

The approval criteria are spelled out in 45 CFR 46.111. A board must find that:

• Risks to participants are minimized
• Risks are reasonable relative to anticipated benefits
• Participant selection is equitable
• Informed consent is obtained and properly documented
• There are adequate provisions for monitoring data
• There are adequate protections for privacy and confidentiality

Read that list again with a research-ops eye: five of the six are documentation problems. That is why teams with clean consent flows and data-management plans clear review quickly, and teams without them stall.

The two-part regulatory test

Under the Common Rule, you need review only if the activity is research and involves human subjects. Both must be true.

Is it "research"? The regulation defines it as "a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge."

The operative phrase is generalizable knowledge. A study designed to tell you whether your onboarding flow confuses your users is not designed to contribute generalizable knowledge — it is designed to improve a specific product. That is the single most important distinction in this entire guide.

Does it involve "human subjects"? A living individual about whom an investigator obtains information through intervention or interaction, or obtains identifiable private information.

There is also a threshold question that trips people up: is your organization even covered? A private company with no federal funding and no Federalwide Assurance is generally not subject to the Common Rule at all. That does not mean ethics are optional — it means the regulatory mechanism of IRB review does not apply, and your obligations run through privacy law, contracts, and professional ethics instead.

Decision table

The pattern: audience and purpose decide, not method. The same 30-minute interview guide can be exempt business research on Monday and reviewable human subjects research on Tuesday, purely because you decided to publish.

The exempt categories worth knowing

The 2018 revised Common Rule (45 CFR 46.104) defines eight exempt categories. Two matter most for research teams:

• Category 1 — research conducted in established educational settings involving normal educational practices
• Category 2 — research involving educational tests, survey procedures, interview procedures, or observation of public behavior

Category 2 covers a great deal of ordinary UX work. But two caveats matter enormously:

Exempt is a determination, not a self-declaration. You submit; the IRB decides. Skipping this step and later claiming exemption is the most common way teams lose the ability to publish.

Exempt does not mean paperwork-free. Many institutions require registration, and some exempt categories trigger a "limited IRB review" focused specifically on privacy and confidentiality protections.

The four triggers, in detail

1. Publication intent. Journals and academic conferences routinely require an IRB approval statement. Retroactive approval is generally not available — a board cannot approve a study that already happened. Decide whether you might publish before you collect a single response. This is the mistake that cannot be fixed later.

2. Regulated submissions. FDA-regulated human factors and usability work for medical devices, and labeling comprehension studies for drugs, sit under their own regulatory regime with its own review expectations.

3. Federal funding. If an agency applying the Common Rule funds the work, review follows the money.

4. Vulnerable populations and institutional policy. Children, prisoners, pregnant people, and individuals with cognitive impairments attract additional scrutiny and, often, additional subparts of the regulation. Schools and health systems layer their own gatekeepers on top — a school district's approval is a separate hurdle from the IRB's, and neither substitutes for the other. If you are researching minors, start with user research with children and teens.

If you do need review: how to move faster

Pick the right track. Exempt determination, expedited review (minimal-risk studies reviewable by a single member), or full board review. Full board review is tied to a meeting calendar, which is usually what makes timelines feel unpredictable — expect turnaround to vary substantially by institution, and ask for the submission calendar up front rather than guessing.

Assemble the packet before you start writing prose:

• Protocol and research questions
• Recruitment materials and screener questions
• Informed consent document
• The full question list or interview guide
• A data-management plan: where data lives, who can access it, how long you keep it, how you de-identify
• Incentive structure and amounts

In practice the biggest source of delay is not the science — it is an incomplete consent document or a missing data-management plan. Those are exactly the artifacts a disciplined research operation already produces.

Why AI-moderated interviews produce cleaner IRB submissions

An AI interviewer does not change whether you need review. It does change how good your documentation is — and documentation is what review actually examines.

• The protocol is delivered identically to every participant. A board reviewing a human-moderated study has to trust that eight different moderators asked questions consistently. With AI moderation, the protocol is the instrument, and every participant receives it the same way. See AI vs human moderators for where each approach wins.
• Consent is captured before the conversation starts, as a structured step rather than a verbal aside — see intake forms and consent.
• Verbatim transcripts give reviewers and auditors the complete record, rather than a moderator's notes.
• Structured questions make your instrument reviewable. Koji supports six question types — open_ended, scale, single_choice, multiple_choice, ranking, and yes_no — so the exact instrument an IRB wants to see is the same object you configured. The structured questions guide walks through building one.
• De-identification is a design choice you make up front. Scope studies to avoid collecting identifiers at all; see anonymizing customer interview data.

Two honest caveats. First, AI moderation does not reduce the regulatory need for review — it improves the quality of what you submit. Second, disclose in your protocol that the interviewer is an AI system. Reviewers will ask, participants deserve to know, and in the EU the AI Act imposes its own transparency duty on AI interactions independent of anything an IRB requires.

A worked example

A healthtech team runs 40 AI-moderated interviews about how patients describe medication side effects. Purpose: improve their symptom-logging feature. No federal funding, no publication plan, no PHI collected. No IRB review needed — this is product research.

Six months later, a clinician advisor wants to co-author a paper on the findings with a university affiliation. Now the calculus inverts: the university is engaged, the intent is generalizable knowledge, and the data was collected without approval. The paper is likely unpublishable from that dataset. The fix would have been a 30-minute conversation with the university's IRB office before fieldwork — and, if needed, a fresh round of consented interviews under an approved protocol.

Common mistakes

1. Assuming "it's just interviews" means exempt. Category 2 often applies, but only the IRB can say so.
2. Deciding to publish after collecting data. The most expensive and least fixable error in this guide.
3. Treating "exempt" as "no process." Registration and limited review are common.
4. Forgetting the second gatekeeper. Schools, employers, and health systems approve separately from the IRB.
5. Submitting a consent form with no data-management plan. The fastest route to a revise-and-resubmit.
6. Confusing ethics with regulation. No IRB requirement does not mean no obligations — see the research ethics guide.

Related Resources

• Research Ethics and Informed Consent — the ethical foundation that applies whether or not an IRB does
• Structured Questions Guide — build the reviewable instrument behind your protocol
• Research Consent Form Templates — starting points for your consent documentation
• Anonymizing Customer Interview Data — de-identification as a design choice
• Research Data Retention and Deletion — the data-management plan reviewers ask for
• User Research With Children and Teens — when vulnerable-population rules apply
• Trauma-Informed User Research — minimizing risk on sensitive topics