AI in research: the AI Act, a lab charter and a toolbox for researchers

Generative AI now writes code, drafts papers and reviews data in every laboratory. The European AI Act sets rules for what we build and what we transfer. Here is what changes for researchers, the timeline in Europe and in France, how the rest of the world compares, who is responsible when research code becomes a product, and a toolbox a lab can adopt in a few hours per project.

Cyril Voyant, Mines Paris – PSL, Centre O.I.E. · status on 23 October 2026 · not legal advice: check with your institution's legal service

What AI changes in research

AI speeds up what used to take days: writing code, summarizing literature, cleaning data, drafting text. It also creates new risks for science itself: invented references, fluent but wrong code, papers produced at industrial scale, models nobody can reproduce, and results that depend on a tool whose version changes without notice. The answer is the same as for any scientific tool: say what was used, check it, document it, and make it reproducible. Trust is not claimed, it is demonstrated (see questioning how we do research).

The AI Act in plain words

• One logic: the risk of the use. Some uses are banned (manipulation, social scoring), some are high-risk and strictly regulated (critical infrastructure such as energy, medical devices, education, employment), some carry transparency duties (chatbots, synthetic content), and the rest is free.
• Two main roles. The provider develops a system and places it on the market or puts it into service under its own name (art. 3(3), 16). The deployer uses it under its authority (art. 26). Anyone who puts their name on a system, substantially modifies it or changes its purpose can become the provider (art. 25).
• Research is exempt, under conditions. Systems and models developed and put into service for the sole purpose of scientific research are outside the Act (art. 2(6)), and so are research, testing and development before placing on the market, except tests in real-world conditions (art. 2(8)). Free and open-source components are largely exempt unless they are high-risk, banned, or subject to transparency duties (art. 2(12)).
• Generative AI. The obligations of August 2025 bind the providers of general-purpose models (OpenAI, Mistral, Google...), not the researchers who use them. Labeling synthetic content (art. 50) mainly binds providers and, for published deepfakes or texts informing the public without human editorial control, deployers. Declaring AI use in a paper or a thesis is required by publishers, funders and research-integrity rules (no AI as an author, disclosure of use), more than by the Act itself.
• AI literacy (art. 4). Organizations that provide or deploy AI systems take measures so that their staff understand them; the 2026 amendment softened this into a duty of means, with support from the Commission and Member States.

The timeline in Europe and in France

In France, a bill adapting national law to EU law (adopted by the Senate on 18 February 2026, examined by the National Assembly in autumn 2026) organizes supervision: the DGCCRF as coordinator and single point of contact, the CNIL for banned practices and part of the high-risk uses, Arcom for synthetic content, the ACPR for finance, with technical support from ANSSI and PEReN. Until the law is passed, the European rules apply directly; the designation of authorities is what remains to be settled.

Elsewhere: no equivalent of the AI Act, but rules everywhere

What it means for a European lab: partners abroad work under different, often lighter rules, but the AI Act reaches any system whose output is used in the EU (art. 2(1)). A shared framework is what makes collaboration safe: without it, nobody knows who answers for a model once it leaves the lab.

Who is responsible when research code becomes a product?

A typical case: a forecasting model written in part by three laboratories, one in France, one elsewhere in the EU and one at an Asian partner, within a joint project. An industrial company reuses the code in an energy management system sold in Europe.

• While the code serves research, the three labs are outside the AI Act. They remain answerable for scientific integrity, for the documentation they deliver and for the terms of the license and the consortium agreement.
• When the company puts the system into service under its name, it becomes the provider: risk management, technical file, conformity assessment and CE marking, since energy management is high-risk (Annex III, from 2 December 2027). The grid operator that uses it is the deployer: human oversight, monitoring, logs.
• If the partner deploys the model in its own country, local law applies (for example the Korean Basic Act or the Chinese labeling rules); the AI Act applies only if the output is used in the EU.
• Civil liability follows the new Product Liability Directive from 9 December 2026: software counts as a product, but free and open-source software supplied outside a commercial activity is excluded. Everything else is settled by contracts: who may reuse the code, for what purpose, with which warranties and which duty to inform.

The practical lesson: write the transfer into the contract before the code leaves the lab, and hand over a documented, tested model. A model without documentation leaves its new owner with a risk nobody can measure.

What a lab can do: the example of the O.I.E. framework

At the Centre O.I.E. (Mines Paris – PSL, about 30 people), a FAIR + AI framework has been drafted since 2025 and is being finalized, for deployment from 2027. Its main lines:

• A one-page charter signed by every member: generative AI allowed as an assistant for writing, code and figures, with explicit mention of its use; human review of everything it produces; minimal documentation (data card, model card, versioned Git repository with README); every AI project in a register, reassessed when it moves from research to industry; a data management plan with six AI fields.
• Light roles, about 0.3 full-time equivalent in total: an AI compliance lead (register, regulatory watch, partners), a FAIR data steward (data management plans, data cards, licences, GDPR) and an MLOps and quality referent (model cards, test plans, drift), plus an ethics committee of four people meeting each quarter for sensitive projects.
• Six steps per project: register (5 minutes); data management plan with AI fields (1 hour); data card and model card (2 hours); minimal test plan (2 to 3 hours); README with the AI-use statement (30 minutes); for a transfer, an audit-ready file (one day).
• Indicators: at least 95 % of projects documented, less than five days between project start and an enriched plan, partner satisfaction above 8/10.

At the institution level, Mines Paris – PSL's legal service has built, with the research centers, a self-assessment decision tree: who is the actor and in which role, the essential questions, the impacts, the qualification of the AI system in the risk pyramid, the conditions of use and of making it available. Its purpose is to find the tipping point where a project enters the scope of the AI Act, and to adapt the contract and its technical annex in time. It is a good example of what an institution can offer its researchers.

The toolbox

Each tool opens on a filled example, taken from the O.I.E. templates (values marked illustrative are not results).

1. Situate the project. Research only, transfer, or deployment? Who will be provider and deployer? Which risk class? Real-world tests are not covered by the research exemption.

2. State the use of AI. In a paper, a thesis, a report or a README: which tool, which version, for what, checked by whom and when. Example: "Parts of the data-loading code were drafted with GitHub Copilot (2026); all functions were reviewed and unit-tested by A. Author on 12 March 2026."

3. Keep a human in charge. No AI as an author; every reference, equation and line of code checked by a named person.

4. Document the data (data card). Origin, period, volume, variables and units, preprocessing, quality, known biases, license or legal basis, transfers outside the EU, conditions of reuse.

5. Document the model (model card). Name and version, architecture, training and test data with the split, intended use, metrics against an explicit reference (persistence, for example with NICE metrics), limits, human oversight, link to the code version.

6. Test before sharing. Reproducibility (fixed seed, same results), robustness (cross-validation, subsamples), stress tests (extreme or missing values), drift on recent data.

7. Add six fields to the data management plan. Legal basis; human oversight; AI transparency; conditions of reuse; international transfers; impact assessment (DPIA if personal data, FRIA for some high-risk deployments).

8. Keep a register of AI projects, uses and partners, and reassess when a project changes purpose.

9. Before any transfer, write the contract and prepare the file. Who becomes provider; license and intellectual property; warranties and liability; duty to report incidents; data transfers; the technical file (README, data card, model card, test plan and results, change log, monitoring plan).

10. Train everyone. A short session for PhD students and staff each year covers AI literacy and the lab's charter.

Glossary

GDPR

General Data Protection Regulation, Regulation (EU) 2016/679: the European law on personal data. See the CNIL guide.

DPIA

Data Protection Impact Assessment (art. 35 GDPR): required when processing personal data is likely to result in a high risk for people. CNIL method and tool.

FRIA

Fundamental Rights Impact Assessment (art. 27 AI Act): required from some deployers of high-risk AI systems, mainly public bodies and private entities providing public services, before first use.

MLOps

Machine-learning operations: the practices that keep a model reproducible and reliable once in use: versioning of data and code, automated tests, monitoring of performance and drift, controlled retraining.

Data management plan (DMP)

A document describing how a project collects, documents, stores, shares and archives its data, required by ANR and Horizon Europe; written in France with DMP OPIDoR.

Data card, model card

One- to two-page sheets that describe a dataset or a trained model: origin, content, intended use, metrics, limits. The format follows the "model cards" and "datasheets for datasets" proposals of the machine-learning community.

Official resources

• AI Act: Regulation (EU) 2024/1689 on EUR-Lex and the European Commission's AI policy page
• European Commission: living guidelines on the responsible use of generative AI in research
• CNIL: AI and personal data and the DPIA guide
• Data management plans: DMP OPIDoR
• Standards: ISO/IEC 42001:2023 (AI management system) and ISO/IEC 23894:2023 (AI risk management)
• Publishing ethics: COPE position on authorship and AI tools

Limits

This page summarizes public texts and the work of one laboratory; it is not legal advice. National laws, guidance and standards are still moving: dates are given as checked on 23 October 2026. For a real project, ask your institution's legal service.

Go further

• Questioning how we do research: influence, integrity, excellence
• Let the language model read, let the validated code compute: WebSemantic
• The approach: AI in its place, trust demonstrated