An IRB approves, changes or rejects human-subjects studies. Federal funding and FDA rules make review mandatory in many cases. Here is what triggers it and what is exempt.
An institutional review board, or IRB, is a committee that reviews planned human-subjects research and can approve it, demand changes or reject it. Federal law requires human-subjects review for research the government conducts, funds or regulates, and for clinical investigations of products the Food and Drug Administration oversees. It does not require review for every question asked of a person. This article covers US federal rules, checked on October 10, 2026.
Two questions decide whether review applies: is the activity “research,” and does it involve a “human subject”? Those words have narrow regulatory meanings, and getting them wrong is the most common mistake on campus.
What an IRB does
The IRB’s job is to protect the people who take part in a study, before and during the study. Under the Common Rule, found in 45 CFR Part 46, Subpart A, the board can approve research, require modifications to secure approval, or disapprove it. If it says no, it must give reasons and let the investigator respond.
It also keeps watching after approval. Continuing review happens at least once a year, with listed exceptions such as expedited studies. The board can suspend or terminate approval if research is not conducted as required or is linked to unexpected serious harm, and it has to report that action to institutional officials and the agency head.
The membership rules are specific. A board needs at least five members with varied backgrounds, at least one scientist and one nonscientist, and at least one member not affiliated with the institution. People with a conflict of interest on a given project cannot take part in reviewing it, apart from supplying information the board asks for.
When review is legally required
Three routes lead to mandatory review. They overlap, so a study can fall under more than one.
| Route | What triggers it | Where the rule sits |
|---|---|---|
| Federal funding or conduct | Non-exempt human-subjects research supported by an agency that follows the Common Rule; the institution certifies IRB approval and the research cannot start before that | 45 CFR 46.101 and 46.103 |
| FDA-regulated products | Clinical investigations that must be submitted to FDA cannot begin until an IRB approves them, and FDA may decline to consider data from investigations that lacked approval and continuing review | 21 CFR 56.103 |
| Institutional policy | Many universities apply the same review to all human-subjects work, whatever the funding | Local policy; read yours |
The FDA’s version is in 21 CFR Part 56. It covers studies of drugs, devices, biologics, foods and other regulated products, and it has a few narrow exceptions, including emergency uses (reported to the IRB within five working days).
The third row is a practice, not a federal mandate on its own. A graduate student surveying classmates with no federal money may not be covered by federal law at all, yet still be required by the university to apply. Some states also have their own rules on human research, which this article does not survey.
The two gates: “research” and “human subject”
The Common Rule defines research as a systematic activity designed to develop or contribute to generalizable knowledge. The definition lists activities that are not research, including journalism, scholarly work of certain kinds, public health surveillance, criminal justice activities and national security operations.
A human subject, in the regulation’s language, is a living individual about whom an investigator obtains information or biospecimens through intervention or interaction, or obtains identifiable private information or identifiable biospecimens. Private information counts as identifiable when the person’s identity is, or may readily be, ascertained by the investigator or linked to the information.
- A quality-improvement project that only improves local practice and is not designed to produce generalizable knowledge may fall outside the definition. Institutions often make that call through a formal determination, not a hunch.
- A dataset stripped of identifiers so that the investigator cannot readily identify anyone may involve no human subject.
- A blood draw for a study of a new assay involves a human subject and is research, so review applies.
Whether a given project passes these gates is a determination that most institutions reserve for the IRB office. Researchers should not decide for themselves that their own project is not research.
Exempt does not mean ignored
The Common Rule lists eight exempt categories in section 46.104. They include normal educational practices in educational settings, educational tests, surveys, interviews or observation of public behavior (with identifiability conditions), benign behavioral interventions with adults, certain secondary research with identifiable information, public benefit or service program studies, taste and food quality evaluations, and two categories tied to broad consent for storing and reusing identifiable information.
Two points get lost. First, exempt research is exempt from the policy’s requirements, not from ethics, and each category carries conditions that the study must actually meet. Second, some exemptions require limited IRB review, a narrower check of privacy and confidentiality safeguards, including those for the broad-consent categories. And at many institutions the exemption determination itself is made by the IRB office, not the investigator.
What an IRB looks for before it says yes
Section 46.111 lists the approval criteria. Risks are minimized, and reasonable in relation to the anticipated benefits and the knowledge gained. The selection of subjects is equitable. Informed consent is sought and documented, or appropriately waived. Where appropriate, the plan includes data safety monitoring and protections for privacy and confidentiality. Additional safeguards apply for people vulnerable to coercion or undue influence, such as children, prisoners and people with impaired decision-making capacity.
Consent has its own rule in section 46.116. It must be legally effective, sought in a way that minimizes the chance of coercion, and presented in understandable language. It cannot include exculpatory language that waives legal rights or releases anyone from liability for negligence. The basic elements include the purpose and procedures, risks, benefits, alternatives, confidentiality, contacts, and a statement that participation is voluntary.
Multi-site studies and what happens when rules are broken
Under section 46.114, institutions in the United States doing cooperative research generally must rely on a single IRB for the US portion, with exceptions where law requires more than one review or the supporting agency documents that a single IRB is inappropriate. OHRP, the HHS office that oversees the Common Rule, maintains a list of such exception determinations on its Common Rule page.
If a board finds noncompliance, it can suspend or terminate approval. IRBs themselves are regulated, too. The FDA can require a board to withhold approval of new studies and stop adding subjects until problems are fixed, and in the worst cases the agency can disqualify the board or institution after a regulatory hearing. IRB records must be kept at least three years and made available for inspection.
What a good submission looks like
Investigators who get quick approvals tend to write for a reader who does not know their field. The application explains who will be recruited and how, what they will be asked to do, how long it takes, what could go wrong and how the team will respond. It says where data are stored, who can see them and when they are destroyed. It includes the consent script or form in language a layperson can follow.
The board’s nonscientist and unaffiliated members exist for this reason. If a community member on the committee cannot tell what a participant is agreeing to, the form has failed its purpose, however polished the science. Changes after approval also go back to the board. Adding a new survey question, a new site or a new recruitment method is a modification, and under the written procedures section 46.108 requires, the board decides whether it can proceed.
Timing deserves planning, too. Full-board review happens at convened meetings, so a project needing it waits for the calendar, while minimal-risk studies may be handled faster through expedited or exempt routes. Build that wait into a grant or thesis schedule.
A quick decision path
- Is the activity designed to produce generalizable knowledge? If not, it may not be research, but ask the IRB office to confirm.
- Does it involve living individuals through interaction, or identifiable private information or biospecimens? If not, it may not involve human subjects.
- Is there federal funding, or an FDA-regulated product? If so, federal review rules apply unless an exemption fits.
- Does an exemption category fit, and does it need limited review? Let the IRB office decide.
- If review is required, submit before enrolling anyone, because approval before start is a condition of federal support.
Related questions
Do surveys need IRB approval?
Often yes at universities, though many are classified as exempt. The answer depends on whether the project is research with human subjects and on the institution’s policy.
Can I use existing data without review?
If the data are publicly available or the investigator cannot readily identify individuals, there may be no human subject. If identifiable private information is involved, a secondary-research exemption or a review may apply.
What happens if I start before approval?
For federally supported research, the rule says the study cannot begin before IRB approval is certified. Starting early is noncompliance, and for FDA-regulated studies the agency may decline to consider the data.
This is general information, not legal advice.
Sources
