What the funder and the data agreement already decided
Lesson 7 of 7 · The working week
By the end you can name the rules that bind AI use at your bench, the three uses that are plainly fine, the pattern that ends careers, and the one sentence to keep.
1 · Learn the move · Red-team audit
Most of the rules were decided before you opened the chat window, by your funder and by the agreement you signed for the data. The funding agency caps the number of applications one investigator may submit in a cycle, and treats an application substantially developed by AI as not the applicant's own work [P]. Controlled-access genomic data never goes into a public generative tool, under the agency's own notice [P]. Reviewers never upload the applications they review [P]. Human data goes nowhere until every one of the eighteen identifiers is gone, and the research rules on consent apply on top [P for the identifiers, S for the consent rules]. A hallucinated citation in your paper is fabrication, and an undisclosed AI paraphrase of someone else's text is plagiarism, in the agency's own words [P], under the federal misconduct rule [S]. Export-controlled data in a cloud tool is an open question your institution answers, not you [M]. Regulated manufacturing records need a human reviewer, and only a natural person can be an inventor [S]. Three uses are plainly fine: polishing language within the journal's and funder's stated policy; summarizing published literature and then checking every claim against the source; and help with a script, with no data attached. The pattern that ends careers is unchecked output entering the record; a published book was pulled when most of its references could not be found [S]. The sentence to keep: nothing that identifies a person, belongs to someone else, or sits under a data-use agreement goes into an AI tool unless your institution has named that exact tool for that exact data in writing. Draft copy, not legal or research-integrity advice. Sources tagged [P] primary, [S] secondary, [M] unverified. Reviewed by: nobody yet.
Here are the rules I work under: [paste the rules above in your own words, plus the lines from my data-use agreement]. Here is what I am about to paste into a model, and the output I am about to use: [paste]. Act as the integrity officer trying to find the line that ends in a finding. For every item that breaks a rule, quote it, name the rule, and say what to do instead. Flag any identifier, accession, subject ID or sponsor-marked text in the paste. Flag any reference in the output I have not opened. Do not soften it; only flag it. End with the three checks I run before anything enters the record.
The facts this lesson rests on, dated
Each line names the source grade the lesson shows, [P] primary, [S] secondary, [M] unverified, and the day it comes due. Past that day, treat it as a question. Draft copy, not legal advice.
- NIH NOT-OD-25-132, effective for receipts from 2025-09-25, treats an application substantially developed by AI as not original and caps new, renewal, resubmission and revision applications at six per investigator per calendar year. [P] (researched Oct 6, 2026, not yet confirmed by a person, recheck by Dec 15, 2026). source
- NIH NOT-OD-25-081, effective 2025-03-28, bars giving controlled-access human genomic data to public generative AI tools and treats models trained on it as data derivatives needing NIH approval. [P] (researched Oct 6, 2026, not yet confirmed by a person, recheck by Dec 15, 2026). source
- NIH NOT-OD-23-149 bars peer reviewers and council members from using generative AI on applications, and uploading application text or critiques to an online AI breaches confidentiality. [P] (researched Oct 6, 2026, not yet confirmed by a person, recheck by Dec 15, 2026). source
- HIPAA de-identification under 45 CFR 164.514(b)(2)(i) lists eighteen identifier categories that must be removed, from names and dates to device identifiers and full-face photos [P]; the Common Rule's consent and IRB requirements apply on top [S] (researched Oct 6, 2026, not yet confirmed by a person, recheck by Dec 15, 2026). source
- NIH's Extramural Nexus notice of 2026-05-14 states that a hallucinated citation is fabrication and an undisclosed AI paraphrase is plagiarism [P], under the research misconduct rule at 42 CFR Part 93 as revised for allegations from 2026-01-01 [S] (researched Oct 6, 2026, not yet confirmed by a person, recheck by Dec 15, 2026). source
- Under 15 CFR 734.18(a)(5) encrypted technical data is not an export only while end-to-end encrypted; a cloud model decrypts plaintext, so whether the carve-out shelters it is an open question for the institution's export office. [M] (researched Oct 6, 2026, not yet confirmed by a person, recheck by Dec 15, 2026). source
- An FDA warning letter of 2026-04-02 cited 21 CFR 211.22(c) and 211.100 against AI-generated manufacturing records that lacked qualified human review. [S] (researched Oct 6, 2026, not yet confirmed by a person, recheck by Dec 15, 2026). source
- USPTO inventorship guidance revised 2025-11-26 holds that only a natural person can be an inventor and treats an AI tool like lab equipment, with conception as the test. [S] (researched Oct 6, 2026, not yet confirmed by a person, recheck by Dec 15, 2026). source
- Springer Nature retracted a 2025 machine-learning book after 25 of its 46 references could not be verified. [S] (researched Oct 6, 2026, not yet confirmed by a person, recheck by Dec 15, 2026). source
2 · Your turn. You write the prompt
A rotation student wants to paste the lab's dbGaP download, subject IDs and all, into a free chatbot to 'find patterns', and then use the chatbot's suggested references in the grant draft due next week. The PI is at a conference. You are the senior postdoc, and you have ten minutes before the student hits enter.
Write the prompt for this scenario as given, or swap in a real one from your own work. The score works the same either way.
Remember: the AI sees only your prompt, not this page. If the situation isn't in your prompt, it doesn't exist.
Optional. These shape the output when you run your prompt below, not your score.