Research governance: Who defines that?¶
Lawmakers
National: German Bundestag and Bundesrat (e.g., BDSG, Urheberrechtsgesetz)
European: European Parliament and Council (e.g, GDPR, EU AI Act, CDSM directive)
Regulator and government agencies (e.g., European Medicines Agency, European Chemicals Agency, and Data Protection Authorities)
Courts interpret how the law applies
International Treaties and Conventions (e.g., UNESCO conventions)
Institutional Governance Structures (policies, support structures, and processes)
Contracts (grant agreements, consortium agreements, NDAs, licenses, DSAs, etc.)
Mechanisms to ensure compliance (procedures and checklists)
Main research governance documents for using AI in research projects¶
Data protection and privacy: GDPR (General Data Protection Regulation), BDSG (Bundesdatenschutzgesetz); see also Talus, Anu. Opinion 28/2024 on Certain Data Protection Aspects Related to the Processing of Personal Data in the Context of AI Models. The European Data Protection Board, 2024. https://
www .edpb .europa .eu /system /files /2024 -12 /edpb _opinion _202428 _ai -models _en .pdf] Copyright law: EU copyright law consists of 13 directives and 2 regulations including InfoSoc Directive, CDSM or just DSM (Copyright in the Single Market) directive, Software directive, Database directive, etc.; see also European Union Intellectual Property Office, The development of generative artificial intelligence from a copyright perspective, European Union Intellectual Property Office, 2025, https://
data .europa .eu /doi /10 .2814 /3893780 AI-specific: EU AI Act https://
artificialintelligenceact .eu Dual use and security-relevant research: Regulation (EU) 2021/821 (EU Dual-Use Regulation), “Manual Export Control and Academia” by BAFA and “Recommendations for Handling Security-Relevant Research” by DFG and Leopoldina
Contract law: software, data, and model licenses, consortium agreements, grant agreements, industry collaborations, cloud service terms, NDAs, data processing agreements (DPAs), etc.