ORI's Guidance on AI Misconduct: Disclose, Verify, and Preserve, or Face Consequences 

The U.S. Department of Health and Human Services’ (HHS) Office of Research Integrity (ORI) published its long-anticipated Guidance on Generative Artificial Intelligence in August. The guidance explains how generative AI (GenAI) use is evaluated under the revised research misconduct regulations (42 CFR Part 93), which took effect January 1, 2025, and became applicable to new allegations on January 1, 2026. The new guidance builds on prior guidance documents regarding the definitions of fabrication, falsification, and plagiarism, as well as revised evidentiary standards. As of April 30, 2026, institutions were required to have compliant policies on file with ORI as part of their annual report covering 2025. 

The August 2026 guidance builds on that framework and applies it specifically to GenAI in U.S. Public Health Service (PHS)-funded research. A research misconduct violation requires that:  

• There is a significant departure from the accepted practices of the relevant research community. 
• The misconduct was committed intentionally, knowingly, or recklessly. 
• The allegation is proven by a preponderance of the evidence. 

Disclosure Is Not a Get-Out-of-Jail-Free Card 

ORI requires researchers to identify all GenAI tools used in research, manuscripts, and grant preparation, and explain how those tools were used. Clear documentation of AI use and verification steps may help defend against misconduct allegations and support research reproducibility. While such disclosure of AI use is required, it is not enough. Specifically: 

• Disclosing the use of a GenAI tool does not preclude a misconduct finding if that use was inconsistent with accepted practices in the relevant research community. 
• Undisclosed or inaccurately described AI use in data generation or processing may itself be evidence of fabrication or falsification. 
• Researchers must verify all results, including those derived from AI-assisted processes. 

Practice point: Disclosure policies should require more than a tool name. They should explain how the tool was used, what type of data was used, and what verification steps were taken. 

Accepted Practices — Who Decides and How? 

The threshold question in any misconduct proceeding is whether the conduct is significantly different from accepted practices in the researcher's field. ORI acknowledges that communities vary in their perspectives, and it places the determination squarely on institutions. 

An important feature of the revised research misconduct framework is that accepted practices are informed not only by general scientific norms, but also by PHS funding-component policies. This matters because the National Institutes of Health (NIH) has already established significant AI expectations. For example, grant applications that are substantially developed by AI cannot be considered as an applicant's original ideas and may be referred to ORI if identified after award. NIH also prohibits scientific peer reviewers from using GenAI to analyze applications or prepare critiques. Doing so could compromise peer-review confidentiality obligations, according to the guidance.  

ORI also recommends that institutions consider including subject-matter experts in AI on inquiry and investigation committees — in addition to the required experts in the respondent's research field — to help evaluate the role and functionality of specific AI tools. 

Practice point: Institutions should inventory all applicable PHS funding-agency AI policies and incorporate those requirements into training programs and acceptable-use guidance. Those policies directly inform the "accepted practices" standard that governs any misconduct determination. 

AI-Detection Tools Are a Starting Point, Not a Verdict 

All research misconduct allegations must be proven by a preponderance of the evidence, according to the guidance. In a misconduct proceeding, AI detection tools, such as automated plagiarism or data-manipulation detectors, should not be relied upon as the sole source of evidence. Such tools may have limited ability to detect plagiarized text in AI-generated scientific content, including proposals, reports, and manuscripts. 

ORI notes that AI-detection tools may be used as a starting point for inquiry but are not a substitute for analysis. The strength of a case will depend on the institution's ability to corroborate detection findings through research records and source materials, witness testimony, forensic analysis, and other objective evidence. GenAI creates unique documentation creation and destruction issues, which may hinder investigations. Although not required, institutions are encouraged to address GenAI use in institutional policies, especially around data creation and preservation. 

Practice point: The preservation of evidence could create an operational challenge. Data could reside across personal devices, third-party AI platforms, browser sessions, transient chat histories, and cloud environments that can be difficult to recover after an allegation emerges. Evidence preservation protocols should be developed now — before allegations arise. 

Record Retention and the Consequences of Destruction 

The full institutional record — including research records and all sequestered evidence — must be retained for seven years after the completion of a research misconduct proceeding. This applies to AI-generated outputs, prompt histories, and related materials. A respondent who claims to possess records but refuses to provide them could be accused of misconduct. Destruction of records after being informed of an allegation could also been seen as evidence of misconduct. 

Some AI tools might automatically delete records — including conversation logs and session histories — based on their terms of service. Whether such deletion constitutes "intentional or knowing" destruction is not settled, but institutions that do not understand their vendors' data retention practices are exposed. 

Practice point: Data-retention policies should explicitly cover AI-generated outputs, logs, and prompt histories. Institutions should understand and document the retention and deletion practices of every AI tool used in research. 

 AI-Generated Hallucinations and Plagiarism 

The guidance addresses one of the most widely discussed AI integrity risks: hallucinated citations. A hallucinated citation in a grant application's background section may not, by itself, constitute fabricated data under 42 CFR Part 93. References in publications and grant applications are generally not "data or results" because they do not arise from a publication’s scientific inquiry. However, in some cases, such as literature reviews, references are data because they arise from scientific inquiry. In this case, fabricated citations could be the subject of research misconduct allegations. 

GenAI also creates a plagiarism risk because the tools are trained on publicly available content. The guidance’s definition of plagiarism covers “the appropriation of another person's ideas, processes, results, or words, without giving appropriate credit." Researchers must have a mechanism to determine whether text or ideas drawn from AI tools originated with another person's work, and to cite those works appropriately. Standard plagiarism detection tools might not catch AI-generated plagiarism reliably. 

In addition, a researcher might not realize that certain tools, such as smartphone cameras used to capture research data, incorporate AI that automatically alters images. The “honest error” defense is available in such situations, but the respondent bears the burden of proving it. Researchers who fail to investigate or verify AI tool outputs before relying on them will have a much harder time making that showing. 

ORI does not require institutions to adopt standalone AI policies. However, it strongly recommends doing so to help researchers understand expectations and to support committee members conducting misconduct investigations. Given NIH's expanding AI policy framework, institutions without coordinated guidance on acceptable AI use, disclosure, verification, data protection, and evidence preservation are increasingly exposed. 

Practice point: All citations, regardless of purpose, should be verified. Submitting a hallucinated citation knowingly or recklessly may still constitute misconduct or violate sponsor and journal policies, even where it falls short of the Part 93 fabrication standard. Researchers bear responsibility for ensuring that AI-generated text does not incorporate hallucinated or unattributed material.  

Parallel Enforcement: The Dual-Track Risk 

The ORI Guidance does not exist in isolation. If AI-related misconduct is identified after an award is made, NIH may simultaneously refer the matter to ORI for a formal misconduct determination and pursue independent grants-management enforcement actions. This could include disallowing costs, withholding future awards, suspending the grant, or terminating the award.  

In light of the guidance and NIH's broader AI policy framework, PHS-funded institutions should take the following steps: 

1. Update AI disclosure policies. Require researchers to disclose not just which tools were used, but also how they were used, what was input, and what verification steps were taken. Policies should cover grant applications and progress reports, manuscripts and abstracts, data collection and analysis, and literature review and citation generation. 
2. Integrate AI-specific content into research integrity training. Training should cover hallucinated citations and when they constitute misconduct; plagiarism risks in AI-generated text; the limits of AI detection tools; and researchers' personal verification obligations. 
3. Develop an AI evidence preservation protocol. Establish institution-wide guidance for preserving AI tool prompts and outputs, model version information, intermediate processing files, uploaded datasets, and session logs. This is critical given that AI-related evidence may reside across personal devices, third-party platforms, and cloud-based environments. Records should comply with the seven-year retention requirement under 42 CFR § 93.318.  
4. Build AI expertise into investigation committee pools. Proactively identify individuals with AI subject-matter expertise who can serve on inquiry and investigation committees when AI-related allegations arise.   
5. Inventory and track applicable funding-agency AI policies. Institutions must maintain a current inventory of all relevant agency AI guidance, including applicable NIH notices on application integrity and peer review. They also need to ensure researchers are trained on those requirements. 
6. Develop a triage framework for AI-related concerns. Not every AI concern is a research misconduct matter. Distinguish potential fabrication, falsification, and plagiarism allegations from concerns involving publication standards, confidentiality, data governance, privacy, or sponsor requirements. Research integrity officers should have a clear process for routing AI-related concerns to the appropriate institutional process. 

Guidance Is More Than an AI Policy Update 

ORI’s August 2026 guidance should be viewed as more than an AI policy update. It is a reminder that research integrity oversight increasingly depends on an institution’s ability to apply longstanding principles in unfamiliar technological environments. The organizations best positioned to manage AI-related integrity risks will not necessarily be those with the most restrictive AI policies. They will be the institutions that can clearly articulate acceptable practices, preserve relevant evidence, distinguish misconduct from other forms of noncompliance, and support defensible decisions when questions arise. 

ORI has continued to issue guidance documents regarding the revised research misconduct regulations since the regs were finalized in 2025. Institutions should continue to monitor the ORI website for additional guidance documents, which represent ORI’s views on compliance with the revised research misconduct regulations. Please reach out to Crowell if you have questions about the revised regulations or ORI guidance documents, or if you need assistance in updating your institutional policies regarding the GenAI guidance.