How to Conduct an Ethics Review for AI-Driven Drug Discovery
By Dr. Zubair Khalid, DVM, MS, PhD ·
Quick Answer
- Prepare a structured protocol that addresses algorithmic bias, data provenance, and explainability before you contact your ethics board for an AI-driven drug discovery project.
- Use the fillable template in this article to document your data sources, model validation plan, and human oversight procedures for institutional review.
- Your ethics board may require additional documentation beyond this template, so confirm local institutional requirements before submission.
Understanding Ethics Review for AI-Driven Drug Discovery
Research ethics review exists to protect human participants, animal subjects, and the integrity of the scientific record. When artificial intelligence enters drug discovery, the review process must account for new dimensions that traditional protocols do not cover. These include the provenance of training data, the potential for algorithmic bias to affect which patient populations benefit from a drug, and the ability to explain how the model reached its predictions.
The National Library of Medicine provides access to authoritative biomedical books and research method references that can help you frame your protocol within established research practices. The EQUATOR Network offers reporting guidelines that help you plan transparent research reporting from the start of your project. Both resources support the core expectation that research should be designed, conducted, and reported in ways that allow others to assess its validity.
For AI-driven drug discovery, the ethics review process must address three distinct layers. The first layer is the scientific validity of the computational approach. The second layer is the ethical use of data, including consent, privacy, and provenance. The third layer is the downstream impact of the model on patients, including bias and explainability. Your ethics board submission should demonstrate that you have considered all three layers and that you have a plan to manage the risks associated with each.
Core Principles of Research Ethics in AI Drug Discovery
The Committee on Publication Ethics Core Practices establish the foundation for responsible research conduct. These practices cover authorship, peer review, data handling, conflicts of interest, and misconduct. For AI-driven drug discovery, these principles translate into specific obligations.
Authorship requires that everyone who makes a substantial intellectual contribution to the research is credited appropriately. In AI projects, this includes the researchers who designed the model, the domain experts who validated the outputs, and the laboratory scientists who generated the training data. The Core Practices emphasize that all authors must take responsibility for the work. This means that every author should be able to explain the AI methodology and its limitations.
Data handling in AI drug discovery requires particular attention. The Core Practices state that researchers should share data in ways that are accurate and transparent. For AI models, this means documenting the source of every dataset, the preprocessing steps applied, and the version of the data used for training and validation. The NIH Data Management and Sharing Policy provides a framework for planning how data will be preserved and shared. Your ethics review submission should include a data management plan that addresses these expectations.
Conflicts of interest in AI drug discovery can be subtle. A researcher who has a financial interest in a company that sells the AI platform may have a conflict that is not immediately obvious. The Core Practices require that conflicts be disclosed and managed. Your ethics review submission should include a conflict of interest statement for every member of the research team.
The Ethics Review Submission Process
The NIH Grants and Funding portal describes the official process for grant application, review, and award management. While your ethics board may not be part of NIH, the principles of structured review apply. Your submission should be organized, complete, and responsive to the specific questions your board asks.
Before you begin writing your protocol, contact your ethics board to learn about their specific submission requirements. Some boards have templates they require you to use. Others accept a narrative protocol. Some boards require a separate data protection impact assessment. Knowing these requirements in advance will save you time and prevent a rejected submission.
Your submission should include the following components:
- A project summary that explains the scientific question and the role of AI in answering it
- A detailed description of the AI model, including its architecture, training data, and validation approach
- A data provenance statement that documents where each dataset came from and how it was processed
- An algorithmic bias assessment that identifies potential sources of bias and how you will mitigate them
- An explainability plan that describes how you will interpret the model's predictions
- A human oversight plan that identifies who will review the model's outputs and how they will do so
- A data management plan that addresses storage, security, sharing, and retention
- A conflict of interest disclosure for all team members
- A timeline that shows when each phase of the project will occur
At a Glance: Ethics Review Submission Components
| Component | Purpose | Key Question to Answer |
|---|---|---|
| Project Overview | Frame the scientific question and AI role | What drug discovery problem does this AI address? |
| Model Description | Document architecture and validation | How was the model trained and how will it be validated? |
| Data Provenance | Establish data origin and processing | Where did each dataset come from and who processed it? |
| Bias Analysis | Identify and mitigate algorithmic bias | Which populations could be disadvantaged and how will you prevent that? |
| Explainability Plan | Describe interpretation methods | How will you explain the model's predictions to reviewers and regulators? |
| Human Oversight | Define human review of AI outputs | Who reviews the model's predictions and what authority do they have? |
| Data Management Plan | Address storage and sharing | How will data be stored, shared, and retained? |
| Conflict of Interest | Disclose team interests | Does any team member have a financial or professional conflict? |
| Timeline | Show project phases | When will each phase occur and when will you report progress? |
Building the Fillable Protocol Template
The following template is designed for you to copy into your own document and complete with your project details. Each section includes prompts that guide you to provide the information your ethics board needs.
Section 1: Project Identification
Project title, principal investigator name and contact information, co-investigators and their roles, funding source and grant number, and the institution where the research will be conducted. Include the ORCID identifiers for each investigator to ensure accurate attribution of research contributions.
Section 2: Scientific Rationale
Describe the disease or condition the drug targets. Explain why AI is the appropriate tool for this discovery effort. Describe the current state of the art and how your approach differs. Explain what new knowledge the project will produce.
Section 3: AI Model Description
Describe the model architecture, the training data and its source, the validation data and its source, the performance metrics you will use, and the threshold for acceptable performance. Explain how you will detect and address overfitting. Describe the computational environment and how you will ensure reproducibility.
Section 4: Data Provenance
For each dataset, provide the source, the date of acquisition, the license or permission for use, the preprocessing steps applied, and the version control identifier. Explain how you verified the quality of the data. Explain how you handled missing data, duplicate records, and inconsistent formatting.
Section 5: Algorithmic Bias Assessment
Identify the demographic and clinical variables that could introduce bias into the model. Explain how you will test the model for bias across these variables. Describe the mitigation strategies you will apply if bias is detected. Explain how you will document the bias assessment for the ethics board.
Section 6: Explainability Plan
Describe the methods you will use to interpret the model's predictions. These may include feature importance analysis, attention visualization, or other techniques appropriate to your model type. Explain how you will communicate the model's reasoning to clinicians and regulators. Explain how you will handle cases where the model cannot explain its prediction.
Section 7: Human Oversight
Identify the qualified individuals who will review the model's outputs. Describe the authority they have to override the model. Describe the frequency of review and the criteria for escalation. Explain how you will document the oversight decisions.
Section 8: Data Management and Sharing
Describe the storage location and security measures for the data. Describe the retention period and the deletion process. Describe the sharing plan and the conditions for sharing. Explain how you will comply with the NIH Data Management and Sharing Policy if your project is NIH funded.
Section 9: Conflicts of Interest
List every investigator and their financial interests. Describe any relationships with companies that sell AI tools or that could benefit from the research. Explain how the conflicts will be managed.
Section 10: Timeline and Milestones
List the project phases, the expected duration of each phase, and the milestones that mark completion. Include the dates for the ethics board review and any required progress reports.
Practical Implementation Steps
The following steps will help you complete the template and submit it to your ethics board.
Step 1: Assemble Your Team
Identify the principal investigator, the AI researchers, the domain experts, and the data stewards. Confirm that each person understands their role in the ethics review process. Assign responsibility for each section of the protocol.
Step 2: Inventory Your Data
Create a complete inventory of every dataset you plan to use. For each dataset, record the source, the date of acquisition, the license, and the processing steps. Verify that you have the right to use each dataset for the intended purpose.
Step 3: Conduct a Preliminary Bias Assessment
Review the datasets for demographic variables that could affect the model. Identify the populations that are underrepresented. Document the potential impact of the underrepresentation on the model's predictions.
Step 4: Draft the Protocol
Complete each section of the template. Use the specific language that your ethics board uses in its guidance. Avoid vague statements and provide concrete details about your methods.
Step 5: Internal Review
Have a colleague who is not on the research team review the protocol. Ask them to identify any gaps or unclear statements. Revise the protocol based on their feedback.
Step 6: Submit to the Ethics Board
Submit the protocol through the official channel. Keep a copy of the submission and the confirmation of receipt. Track the status of the review.
Step 7: Respond to Board Feedback
The board may request changes or additional information. Respond to each request in writing. Document the changes you made and the rationale for each change.
Records and Measurements
The ethics review process requires you to maintain records that demonstrate your compliance with the approved protocol. These records serve as evidence that you conducted the research as described.
Data Provenance Log
Maintain a log that records every dataset used in the project. For each dataset, record the source, the acquisition date, the processing steps, and the version. Update the log whenever you add a new dataset or change the processing steps.
Model Version Log
Maintain a log that records every version of the model. For each version, record the training data, the validation data, the performance metrics, and the date. This log allows you to reproduce the model and to explain the changes between versions.
Bias Assessment Records
Maintain the results of every bias assessment you conduct. Record the demographic variables tested, the metrics used, the results, and the mitigation actions taken. These records demonstrate that you have addressed the bias requirements.
Oversight Decision Log
Maintain a log of every decision made by the human oversight team. Record the date, the decision, the rationale, and the person who made the decision. This log demonstrates that the human oversight was active and effective.
Common Failure Patterns in Ethics Review Submissions
Understanding the common reasons for ethics board rejection can help you avoid the same problems.
Vague Data Descriptions
A protocol that says "we will use public datasets" without naming the datasets or describing their contents will be rejected. The board needs to know exactly what data you will use and how you will verify its quality.
Missing Bias Analysis
A protocol that does not address algorithmic bias will be rejected. The board expects you to identify the populations that could be affected and to explain how you will mitigate the risk.
No Explainability Plan
A protocol that does not explain how the model predictions will be interpreted will be rejected. The board needs to know how you will explain the model to the users and the regulators.
Inadequate Human Oversight
A protocol that does not describe the human oversight will be rejected. The board needs to know who will review the model outputs and what authority they have.
Unclear Data Management
A protocol that does not describe the data storage, sharing, and retention will be rejected. The board needs to know how the data will be protected and how it will be shared.
Limitations and Professional Escalation
The ethics review process has limitations that you should understand before you submit your protocol.
The Board May Not Have AI Expertise
Your ethics board may not have members with expertise in AI or machine learning. This means you may need to explain the technical aspects of your model in plain language. You may also need to provide additional documentation that helps the board understand the model.
The Board May Not Have Drug Discovery Expertise
Your ethics board may not have members with expertise in drug discovery. This means you may need to explain the scientific rationale for the project in terms that are accessible to a general scientific audience.
The Board May Require Additional Approvals
Your ethics board may require additional approvals beyond the ethics review. These may include institutional biosafety approval, data protection approval, or other institutional approvals. You should confirm these requirements before you submit your protocol.
Escalation Criteria
If the ethics board rejects your protocol, you should escalate the issue to the institutional research office. The research office can help you understand the reasons for the rejection and can guide you through the revision process. If the board requests changes that you believe are scientifically inappropriate, you should escalate the issue to the institutional research integrity officer.
Safety and Regulatory Context
AI-driven drug discovery operates within a regulatory framework that is still evolving. The ethics review is one part of the broader regulatory context. The NIH Grants and Funding portal provides information about the official grant policy and the review process. The Data Management and Sharing Policy describes the expectations for data sharing.
The regulatory context for AI in drug discovery is not fully established. The FDA has issued guidance on the use of AI in drug development, but the guidance is not a binding regulation. Your ethics review should address the regulatory uncertainty by describing how you will adapt to the changing requirements.
The safety context for AI-driven drug discovery is the same as for any drug discovery project. The AI model is a tool that generates hypotheses. The hypotheses must be validated through the standard drug development process. The ethics review should confirm that the AI is being used appropriately and that the model outputs are being validated through the established scientific methods.
Building a Risk Register for AI Model Outputs
An ethics review protocol describes what you plan to do, but it does not by itself prepare your team for the failures that can occur after approval. A risk register is a working document that lists the specific ways your AI model could produce a harmful or misleading output, the likelihood of that event, the severity of the consequence, and the action you will take if it occurs. Your ethics board will see that you have moved beyond general statements about safety and have identified the concrete failure modes that matter for your project.
How to Structure the Risk Register
Create a table with one row for each identified risk. Use the following columns: risk identifier, risk description, likelihood rating, impact rating, overall risk score, detection method, mitigation action, and escalation trigger. Assign each risk a unique identifier such as R01, R02, and so on. This identifier lets you reference the risk in your protocol, in your oversight logs, and in your progress reports to the ethics board.
The likelihood rating uses a simple three-level scale: low, medium, or high. The impact rating also uses a three-level scale: minor, moderate, or severe. The overall risk score is the combination of likelihood and impact. A risk that is high likelihood and high impact requires immediate mitigation. A risk that is low likelihood and minor impact may require only monitoring. Document the rationale for each rating so that a reviewer can understand why you assigned the score.
Risk Categories Specific to AI Drug Discovery
The first category is data-related risk. This includes the presence of duplicate records in the training set, the inclusion of data from an unverified source, and the use of a dataset that does not match the target patient population. For each data risk, describe how you will detect the problem. For example, you can run a duplicate detection script before training and you can compare the demographic distribution of the training data against the target population.
The second category is model-related risk. This includes overfitting to the training data, a performance drop when the model is applied to new data, and a model that produces a confident prediction for an input that is outside the range of the training data. For each model risk, describe the validation metric that will trigger a review. For example, you can set a threshold for the difference between training and validation performance and you can flag any prediction where the input features fall outside the range observed in the training set.
The third category is interpretation-related risk. This includes a feature importance analysis that is unstable across runs, an explanation that is misleading, and a clinician who overtrusts the model output. For each interpretation risk, describe the check you will perform. For example, you can run the feature importance analysis multiple times with different random seeds and you can require that the human oversight team document their confidence in each model output.
The fourth category is downstream risk. This includes the selection of a compound that is later found to be toxic, the prioritization of a target that is not druggable, and the waste of laboratory resources on a false positive. For each downstream risk, describe the laboratory validation step that will catch the error. For example, you can require that every model prediction be confirmed by a secondary assay before it is advanced to the next stage.
How to Use the Register During the Project
The risk register is not a static document. You should review it at every project milestone and update it when you learn something new about the model or the data. The review should be a standing item on the agenda of your project meetings. The person responsible for the risk register should be named in the protocol and should have the authority to escalate a risk to the principal investigator.
When a risk materializes, the detection method should produce a clear signal. The signal should trigger the mitigation action that you described in the register. The mitigation action should be specific and should name the person who will carry it out. The escalation trigger should describe the condition under which the oversight team must be notified. For example, if the model produces a prediction that is outside the training range for a compound that is being advanced to laboratory testing, the oversight team must be notified within 24 hours.
Records and Measurements for the Risk Register
Maintain a risk register log that records every change to the register. For each change, record the date, the person who made the change, the risk identifier, and the reason for the change. This log demonstrates to the ethics board that you are actively managing the risks and that you have a process for updating the register.
Maintain a risk event log that records every time a risk materializes. For each event, record the date, the risk identifier, the detection method, the action taken, and the outcome. This log provides the evidence that your mitigation actions are effective and that you are learning from the failures.
Common Failure Patterns in Risk Management
The first failure pattern is a risk register that lists only generic risks. A register that says "the model may be biased" without identifying the specific variable, the specific dataset, and the specific consequence is not useful. The register must be specific to your project.
The second failure pattern is a risk register that is never updated. A register that is written at the start of the project and then ignored will not protect the project. The register must be a living document that reflects the current state of the project.
The third failure pattern is a risk register that has no escalation trigger. A register that describes a risk but does not say when the oversight team must be notified will not protect the project. The escalation trigger must be clear and measurable.
The fourth failure pattern is a risk register that is not connected to the oversight decision log. The risk register and the oversight log must be linked. When a risk materializes, the oversight decision must be recorded in the oversight log and the risk register must be updated to reflect the outcome.
Limitations and Professional Escalation
The risk register is a planning tool, not a guarantee. It cannot predict every failure mode, and it cannot prevent every error. The register is only as good as the information that goes into it. If your team does not have the expertise to identify the risks, you should consult with a colleague who has experience with AI in drug discovery before you submit the register to the ethics board.
If the ethics board identifies a risk that you did not include in the register, you should add the risk and update the register. If the board requests a mitigation action that you believe is scientifically inappropriate, you should escalate the issue to the institutional research integrity officer. The escalation should be documented in writing and should include the board request, your rationale, and the response from the research integrity officer.
The risk register should be included as an appendix to your ethics review submission. The register should be referenced in the main protocol and the board should be able to see that the register is a working document that will be updated throughout the project. The register is a practical tool that demonstrates to the board that you have thought through the specific ways your model can fail and that you have a plan to detect and respond to those failures.
Frequently Asked Questions
What is the purpose of an ethics review for AI-driven drug discovery?
The ethics review protects the research participants, the data subjects, and the integrity of the scientific process. For AI-driven drug discovery, the review also addresses the risks of algorithmic bias, data provenance, and explainability. The review ensures that the research is designed and conducted in a way that is ethically sound.
How long does an ethics review take?
The duration of an ethics review varies by institution. Some boards review protocols within a few weeks, while others may take several months. You should contact your ethics board to determine the expected timeline. You should also factor the review timeline into your project plan.
What happens if my ethics review is rejected?
If your ethics review is rejected, you will receive feedback from the board. You should revise the protocol to address the feedback and resubmit it. If the board rejects the protocol again, you should escalate the issue to the institutional research office.
Do I need an ethics review for a project that uses only public data?
Yes, you need an ethics review for any research project that involves human data, even if the data is public. The ethics review addresses the use of the data, the potential for bias, and the impact of the research. The review also ensures that the research is conducted in a way that is consistent with the research ethics.
How do I address algorithmic bias in my ethics review submission?
You should identify the demographic variables that could affect the model, describe how you will test for bias, and explain the mitigation strategies you will apply. The bias assessment should be documented in the protocol and the records.
What is the role of the human oversight in AI-driven drug discovery?
The human oversight is responsible for reviewing the model outputs and making decisions about the model predictions. The oversight team should have the authority to override the model and should document their decisions. The oversight is a key component of the ethics review.
How do I handle data provenance in my ethics review submission?
You should describe the source of every dataset, the license or permission for use, and the processing steps. You should also describe how you verified the quality of the data. The data provenance statement should be included in the protocol.
What is the relationship between the ethics review and the NIH grant process?
The NIH grant process includes a review of the scientific merit of the proposal. The ethics review is a separate process that addresses the ethical and regulatory aspects of the research. The NIH grant process may require you to describe the ethics review in your application. The NIH Data Management and Sharing Policy also requires a data management plan.
Using the Evidence
| Source | Best use in this topic | Important limitation |
|---|---|---|
| Research Methods Resources | official guidance | Check the linked page for current local requirements |
| EQUATOR Network | official guidance | Check the linked page for current local requirements |
| Core Practices | official guidance | Check the linked page for current local requirements |
Related Articles
- Peer Review Metrics: What They Are and How to Use Them
- Academic Research Career Path: From PhD to Principal Investigator
- Scoping Review vs Meta-Analysis: Clarifying Their Distinct Roles in Evidence Synthesis
- Lentivirus Protocol
- Bacterial Transformation Protocol
References and Further Reading
- Research Methods Resources. National Library of Medicine.
- EQUATOR Network. EQUATOR Network.
- Core Practices. Committee on Publication Ethics.
- NIH Grants and Funding. National Institutes of Health.
- ORCID for Researchers. ORCID.
- Data Management and Sharing Policy. National Institutes of Health.
- NCBI Literature Resources. National Center for Biotechnology Information.
- PubMed. National Library of Medicine.
This article is educational and does not replace institutional policy, professional advice, or applicable safety and regulatory requirements.