The Department of Health and Human Services is preparing a significant change to the federal rules governing research involving human subjects.
The plan is real. HHS intends to revise Subpart A of 45 CFR Part 46, better known as the Common Rule, and has formally classified the action as deregulatory. Among the changes under consideration are broader exemptions for certain “low-risk” research, greater flexibility for very small protocol changes, and clarification of terms including “undue influence.”
What is not yet public is arguably more important.
As of September 21, 2026, HHS’s regulatory agenda still lists the action, RIN 0937-AA16, at the “Proposed Rule Stage.” The agenda had projected a Notice of Proposed Rulemaking for July 2026, but it still shows no Federal Register citation for that NPRM. A search of the current Federal Register record likewise finds the action listed as a proposed-rule-stage agenda item rather than a published proposed rule.
That means the government has announced what kinds of regulatory changes it wants to make, but not yet the language that would tell researchers and the public exactly which studies would become exempt or what protections would cease to apply.
That distinction matters.
HHS says the goal is to reduce unnecessary administrative burdens and allow institutional review boards, or IRBs, to concentrate resources on research presenting greater risks. The same agenda entry acknowledges the other side of the equation: broader exemptions could reduce oversight for some research or lead institutions to apply the rules inconsistently.
The central question, therefore, is not simply whether HHS is “changing human-research protections.”
It is where HHS will draw the line between research that needs ordinary IRB oversight and research it considers safe enough to exempt.
What HHS has actually proposed to do
The regulatory initiative is titled “Human Research Protections: Exemptions and Clarifying Provisions Related to Institutional Review Board Oversight.”
According to the official Unified Agenda entry, HHS intends to “modernize and simplify” Subpart A of 45 CFR Part 46.
The department identifies three areas in particular.
It wants to expand exemptions for additional types of research it describes as low risk. It wants more flexibility for regulatory review of what it calls “de minimis” changes to research protocols. And it wants to clarify ambiguous terminology, specifically mentioning the concept of undue influence.
HHS’s stated argument is straightforward: the current system sometimes requires too much administrative work for research presenting little danger to participants.
The department specifically points to research embedded within healthcare systems and studies intended to improve the quality or safety of medical care. HHS argues that unclear or unnecessarily burdensome requirements can slow research while consuming IRB resources that could instead be focused on higher-risk studies.
That argument is not new.
The last major Common Rule overhaul, finalized in 2017 and generally implemented beginning in 2019, was also designed both to strengthen participant protections and to reduce unnecessary burden, delay and ambiguity. The revision expanded the number and scope of exemption categories and introduced a new concept called limited IRB review.
The current debate is therefore better understood as another round in a longstanding question:
How much regulatory oversight is appropriate for research presenting relatively little risk?
We do not have the proposed rule yet
This is the most important procedural fact surrounding the current story.
A Unified Agenda entry is not the same thing as a proposed regulation.
The Unified Agenda tells the public what regulatory actions an agency expects to pursue. The Notice of Proposed Rulemaking, or NPRM, is the document that ordinarily contains the proposed regulatory language and explains what the agency actually wants to change.
The Federal Register describes the NPRM as the official document announcing and explaining an agency’s proposed solution and providing the public an opportunity to comment before a final rule is adopted.
As of September 21, the status looks like this:
| AA16 rulemaking status | Current information |
|---|---|
| Regulatory action | Human Research Protections: Exemptions and Clarifying Provisions Related to Institutional Review Board Oversight |
| RIN | 0937-AA16 |
| Current stage | Proposed Rule Stage |
| Target listed for NPRM | July 2026 |
| Federal Register citation for NPRM | None listed |
| Proposed regulatory text located | Not as of Sept. 21, 2026 |
| Final rule | No |
| Formal notice-and-comment process | Expected by HHS, but NPRM not located |
| HHS classification | Deregulatory |
That leaves some of the most consequential questions unanswered.
We do not yet know which additional research activities HHS wants to exempt.
We do not know whether those exemptions will require limited IRB review.
We do not know whether HHS will impose an explicit risk threshold.
We do not know how the new exemptions might apply to identifiable data, biospecimens, artificial intelligence or secondary research using medical records.
And we do not know precisely what HHS means by a “de minimis” protocol change.
Those answers should be in the proposed rule.
What does the Common Rule actually protect?
The federal human-subject protection system is more complicated than a single regulation.
HHS’s rules at 45 CFR Part 46 contain five subparts. Subpart A is the Common Rule and contains the broad framework governing matters including IRBs and informed consent.
Subpart B contains additional protections involving pregnant women, human fetuses and neonates. Subpart C adds protections for prisoners. Subpart D covers research involving children. Subpart E establishes IRB registration requirements.
The current AA16 regulatory agenda specifically identifies Subpart A as the provision HHS intends to modernize.
Nothing currently published in AA16 says HHS intends to repeal or rewrite Subparts B, C or D.
But that does not make those populations irrelevant.
The exemption rules within Subpart A determine when some of the Common Rule’s requirements apply in the first place, and those exemptions interact differently with the additional protections in B, C and D.
Under the current framework, all of the Common Rule exemptions can potentially apply to research under Subpart B when their conditions are met. Research involving prisoners is much more restricted: exemptions generally cannot be used for research directed at prisoners, although prisoners can sometimes be incidentally included in research aimed at a broader population. Different limitations apply to research involving children.
That is why the eventual regulatory language matters even if HHS leaves the text of B, C and D untouched.
Changing the scope of Subpart A exemptions can still affect the regulatory pathway through which some research involving protected populations is evaluated.
“Exempt” does not simply mean “no ethics rules”
The word exempt can make this debate unnecessarily confusing.
Readers could reasonably hear that a study is “exempt from the Common Rule” and conclude that researchers can simply do whatever they want.
That is not how the system works.
Research institutions frequently maintain their own policies. Other laws can apply. Research involving FDA-regulated products can fall under separate FDA regulations. And some Common Rule exemptions themselves require a narrower form of oversight called limited IRB review. FDA, for example, separately regulates human-subject protection and IRBs for covered clinical investigations under 21 CFR Parts 50 and 56.
The Common Rule itself is primarily tied to research conducted or supported by participating federal departments and agencies, although institutions can voluntarily apply the requirements more broadly. It is therefore an important part of the American research-ethics system, but it is not the only rule standing between researchers and human participants.
At the same time, an exemption is not meaningless.
Ordinary IRB approval involves a series of findings about risks, benefits, selection of subjects, informed consent, privacy and other protections.
Exempt research can avoid some of that process.
Under the current Common Rule, four exemption pathways require limited IRB review rather than ordinary IRB review. In some of those cases, the IRB’s required determination focuses primarily on privacy and confidentiality rather than applying every criterion normally required under 45 CFR 46.111.
A useful way to visualize the system is:
Not covered by the Common Rule → Exempt → Exempt with limited IRB review → Expedited IRB review → Convened/full IRB review
Those categories are not interchangeable.
So when HHS says it wants to expand exemptions, the important follow-up question is:
What exactly will the newly exempt research be exempt from?
The pivotal issue is what HHS means by “low risk”
This is where the forthcoming rule could become consequential.
The regulatory agenda repeatedly describes the proposed expansion as applying to “low-risk research.”
The Common Rule, however, already contains a specific regulatory concept called “minimal risk.”
Under Subpart A, minimal risk generally means that the probability and magnitude of expected harm or discomfort are no greater than what people ordinarily encounter in daily life or during routine physical or psychological examinations or tests.
Whether HHS’s use of “low risk” in the agenda is simply descriptive language or foreshadows a different regulatory test cannot be determined until the proposed text appears.
There is another complication.
In 2023, HHS’s own Secretary’s Advisory Committee on Human Research Protections, or SACHRP, examined the relatively new system of exempt research requiring limited IRB review.
The committee highlighted an unusual feature of the current framework: according to an OHRP draft interpretation, research qualifying for certain exempt pathways could potentially be more than minimal risk, because the exemption categories themselves do not universally require research to satisfy the regulatory definition of minimal risk.
SACHRP expressed concern that this could result in some research receiving limited review without consideration of all of the ethical requirements ordinarily applied by an IRB.
That does not establish that the forthcoming HHS rule will create such a problem.
It establishes why the wording matters.
If HHS intends to move additional research into exempt categories, the proposed rule should allow researchers and the public to answer several concrete questions:
Who decides that a study qualifies?
What risk threshold applies?
Does an IRB still review privacy and confidentiality?
Is informed consent required?
What happens when investigators change the protocol later?
And which ordinary IRB findings no longer have to be made?
Those questions are much more useful than treating every exemption as inherently benign or inherently dangerous.
AI and medical data show why “low risk” can be harder to define than it sounds
Consider a modern research project that never injects anyone with a drug, draws blood or asks anyone to enter a laboratory.
Researchers receive millions of medical records collected during ordinary healthcare and use them to train an artificial-intelligence system.
At first glance, this can look far less risky than an experimental medical procedure.
But modern data research creates its own problems.
In 2022, SACHRP examined exactly this issue. The committee noted that AI researchers frequently use information originally collected for some other purpose, including medical records or social-media data. Secondary research using those records may qualify for an exemption under the current Common Rule.
SACHRP identified several concerns.
Information considered de-identified today may become identifiable when combined with other datasets. AI systems can infer sensitive information that an individual never knowingly disclosed. Social-media information may technically be publicly available even though the person who posted it never expected it to become research material.
The committee concluded that many existing research exemptions were developed before Big Data and modern AI became commonplace.
Its warning was carefully framed but important: some AI research can comply with the existing regulatory framework while still failing to adequately protect participants’ rights and welfare.
That observation makes the forthcoming exemption proposal particularly worth examining.
The question is not whether AI research should automatically receive more oversight.
The question is whether 20th-century concepts of identifiability and research risk still work cleanly when enormous datasets can be combined, analyzed and used to infer information about people who may never know they became part of a study.
Any modernization of the Common Rule has an opportunity to address that problem.
It also has the potential to make it more important.
There is a legitimate case for reducing unnecessary IRB burden
Human-subject protection is not improved simply by maximizing the number of forms, meetings and administrative steps researchers must complete.
That principle has been part of Common Rule reform for years.
When the federal government completed the previous major revision in 2017, HHS described its goal as strengthening protections while also reducing burden, delay and ambiguity. The revised rule created additional exemptions partly because regulators concluded that the intensity of oversight should better reflect actual research risk.
Researchers and institutions have also long reported inconsistent interpretations of “minimal risk.”
SACHRP itself previously noted that institutional reluctance to use regulatory flexibility could create unnecessary requirements even in minimal-risk research and that inconsistent interpretations among IRBs could complicate the system.
The strongest case for the current HHS initiative is therefore easy to understand.
If a genuinely low-risk study requires nearly the same bureaucratic machinery as considerably riskier research, researchers lose time, institutions spend money, and IRBs devote attention to studies that may not need intensive review.
HHS says broader exemptions could allow those resources to be redirected toward research posing greater risks to participants.
That is a coherent regulatory objective.
The hard part is deciding which research belongs on which side of the line.
What could a “de minimis protocol change” mean?
HHS also wants more flexibility for what it calls de minimis protocol changes.
Again, the actual definition has not been published.
Existing federal rules already recognize that not every amendment to an approved research project requires the same level of scrutiny. Expedited procedures can be used for certain minor changes in previously approved research. FDA’s existing guidance similarly recognizes expedited review for qualifying minimal-risk research and minor changes.
The forthcoming proposal should reveal what HHS thinks the current system still handles unnecessarily.
A correction to an administrative document or other change that cannot meaningfully affect a participant is intuitively different from altering recruitment criteria, adding a new source of identifiable information or modifying an intervention.
The important question is where HHS defines that boundary.
“Undue influence” is another deceptively complicated issue
HHS also specifically says it intends to clarify the meaning of undue influence.
That term matters because informed consent must be voluntary.
But influence and undue influence are not the same thing.
Paying someone to participate in research, for example, obviously influences the decision. That does not automatically make the decision involuntary.
SACHRP studied this problem extensively in 2019 and concluded that ordinary reimbursement, compensation for time and modest appreciation payments generally should not automatically be treated as undue influence. Its concern was instead whether an incentive interferes with someone’s ability to adequately consider a study’s risks, burdens and other important characteristics.
Clarification can therefore cut in several possible directions.
It could provide researchers with clearer permission to compensate participants appropriately. It could clarify when incentives become ethically problematic. Or it could change how IRBs evaluate other circumstances that might influence consent.
The proposed language will determine which.
The expert committee that studied these problems no longer exists
There is also an institutional change surrounding this rulemaking.
SACHRP, the Secretary’s Advisory Committee on Human Research Protections, provided outside expert advice and recommendations to HHS on human-subject research policy.
HHS’s own website states that the committee was terminated effective March 31, 2025.
That is notable because the committee had been working on many of the same technical questions now implicated by the proposed Common Rule revision.
It examined limited IRB review.
It analyzed whether exemption pathways adequately accounted for research risk.
It considered artificial intelligence, privacy and re-identification.
And it studied difficult informed-consent questions such as participant payment and undue influence.
The committee’s termination does not establish whether the forthcoming rule will strengthen or weaken participant protections.
It does mean that HHS is undertaking this revision without the same standing advisory body that previously generated public expert recommendations on these subjects.
The existing IRB system has problems of its own
The status quo should not be romanticized either.
A 2023 Government Accountability Office review found shortcomings in federal oversight of IRBs.
GAO reported that HHS oversees roughly 2,300 U.S.-based IRBs, but relatively few undergo federal inspections. The watchdog recommended that HHS and FDA better assess inspection needs and develop improved ways to evaluate IRB effectiveness.
That finding complicates any simple argument that more IRB involvement necessarily produces better participant protection.
The policy challenge is to build an oversight system proportional to actual risk while ensuring that research escaping intensive review is genuinely appropriate for lighter treatment.
Broader exemptions could help an overloaded system concentrate on consequential risks.
Poorly designed exemptions could simply move consequential risks outside the system’s field of view.
Both possibilities depend on the details.
What about protections for children, prisoners and pregnant research participants?
The added protections for these populations remain significant, but it helps to distinguish changing Subpart A from directly rewriting the special subparts.
AA16 currently identifies Subpart A as the target of the rulemaking.
The current Common Rule already provides different rules for how exemptions interact with B, C and D.
For research involving pregnancy under Subpart B, Common Rule exemptions can generally apply when their requirements are satisfied.
For research subject to the prisoner protections in Subpart C, exemptions generally cannot be used when the research is directed at prisoners, with a narrow allowance where prisoners are merely incidentally included in a broader population.
Children under Subpart D fall under a more complicated structure in which some exemptions are available and others are restricted.
HHS updated the wording in these special subparts in 2024 partly to align them technically with the exemption structure created by the 2018 Requirements.
So the right question when the new proposal appears is not simply:
Did HHS amend Subpart D?
It is also:
Did HHS create a new Subpart A exemption that can apply to research governed by Subpart D?
That is the kind of interaction that can change real-world oversight without rewriting the special-protection section itself.
Can the public comment on the proposal?
The formal public-comment process appears not to have begun because sherafy.com could not locate the AA16 NPRM as of September 21, 2026.
That is different from public comments having been removed.
The current Unified Agenda entry itself states that HHS expects risks associated with the proposal to be addressed partly through public engagement in the notice-and-comment process.
Under normal federal rulemaking, the NPRM is published in the Federal Register and provides the public an opportunity to submit comments. Those comments then become part of the administrative record considered before the agency issues a final rule.
The AA16 agenda entry does provide contact information for the Office for Human Research Protections, but contacting an agency while a regulation is being developed is not the same thing as submitting a formal comment on an NPRM.
As of publication, we found no evidence that a public AA16 comment docket existed and was subsequently erased.
The simpler explanation is that the formal proposed rule and its associated comment period have not yet appeared.
What to watch when the proposed rule is published
The eventual NPRM should make it possible to evaluate this policy on its actual language rather than on broad descriptions from either supporters or critics.
The most important questions will be:
- Which additional research activities become exempt?
- Does each new exemption expressly require minimal risk, or some other standard?
- Who determines whether a study qualifies for the exemption?
- Which exemptions still require limited IRB review?
- Which ordinary IRB approval criteria no longer apply?
- What happens to informed-consent requirements?
- How do the exemptions interact with protections for children, prisoners, pregnancy and fetuses?
- How does the rule address identifiable data, medical records, biospecimens and AI research?
- What protections address re-identification and the combination of datasets?
- How does HHS define a “de minimis” protocol change?
- How does it clarify undue influence?
- What mechanisms limit inconsistent exemption decisions between institutions?
- What participant protections does HHS identify as remaining after a study becomes exempt?
- What evidence does HHS provide that the affected research presents sufficiently low risk to justify reduced oversight?
Those answers will tell us far more about the significance of the rule than the word “deregulatory” by itself.
Why the history of human-research protections still matters
Modern human-subject protections did not appear accidentally.
The regulatory system developed over decades in response to recognition that scientific value does not automatically protect the interests of the people being studied.
The Belmont Report, published in 1979, established the ethical principles of respect for persons, beneficence and justice that continue to shape American research ethics. HHS and FDA subsequently revised their regulations, and the Common Rule was formally adopted in 1991.
Historical abuses explain why changes to this system deserve scrutiny.
But history cannot by itself answer whether a particular survey study, medical-record analysis, behavioral experiment or AI research project requires a full IRB.
That judgment depends on the research involved, the risks to participants and the protections that remain.
The purpose of risk-based regulation is to recognize those differences.
The danger is getting the risk calculation wrong.
The most important document has not arrived yet
For now, the government’s direction is clear but the boundaries are not.
HHS wants to expand exemptions for certain research it considers low risk. It wants greater flexibility for small protocol changes. It wants to clarify rules involving undue influence. And it wants IRBs to devote more attention to higher-risk studies.
Those objectives can be evaluated fairly only when HHS shows exactly how it intends to accomplish them.
The forthcoming NPRM should reveal whether this is primarily a targeted effort to remove paperwork from genuinely low-risk research, a broader reduction in federal oversight, or some combination depending on the research category.
Until then, the most consequential question remains unanswered:
What research involving real people will HHS decide no longer needs the level of review it receives today?
That is the provision worth watching.
References and Further Reading
Primary Regulatory Sources
HHS/OASH — Human Research Protections: Exemptions and Clarifying Provisions Related to Institutional Review Board Oversight, RIN 0937-AA16 — The official Unified Agenda entry describing the planned Common Rule revision, its rationale, proposed exemption expansion, de minimis protocol changes, undue-influence clarification and acknowledged regulatory risks.
HHS Unified Agenda entry for RIN 0937-AA16
HHS Office for Human Research Protections — 45 CFR Part 46 — HHS’s overview of Subparts A through E and the populations covered by the additional protections.
HHS overview of 45 CFR Part 46
HHS Office for Human Research Protections — Federal Policy for the Protection of Human Subjects, or Common Rule — Background on the Belmont Report, development of the Common Rule and the scope of participating federal agencies.
HHS Common Rule overview
HHS Office for Human Research Protections — Excerpts from the 2017 Revised Common Rule Preamble — Detailed explanation of the modern exemption structure and how exemptions interact with Subparts B, C and D.
HHS Revised Common Rule preamble excerpts
HHS Office for Human Research Protections — Revised Common Rule — Regulatory history of the major 2017 revision and its implementation.
HHS Revised Common Rule history
Federal Register — The Rulemaking Process — Federal Register explanation of how NPRMs, public comments and final rules normally work.
Federal Register guide to the rulemaking process
Research-Ethics Guidance and Expert Recommendations
SACHRP — Recommendations on Limited IRB Review and Related Exemptions — Important 2023 discussion of exempt research, limited IRB review, risk thresholds, privacy and the possibility that some exempt research could exceed minimal risk.
SACHRP recommendations on limited IRB review
SACHRP — IRB Considerations on the Use of Artificial Intelligence in Human Subjects Research — Detailed examination of AI, Big Data, secondary research, identifiability, privacy and limitations of exemptions developed before modern data science.
SACHRP recommendations on AI and human-subject research
SACHRP — Addressing Ethical Concerns Regarding Offers of Payment to Research Participants — Useful background on undue influence, compensation, incentives and voluntary informed consent.
SACHRP recommendations on payment and undue influence
HHS — Secretary’s Advisory Committee on Human Research Protections — HHS’s archived page documenting SACHRP’s role and its termination effective March 31, 2025.
HHS SACHRP archive
Oversight and Related Federal Protections
U.S. Government Accountability Office — Institutional Review Boards: Actions Needed to Improve Federal Oversight and Examine Effectiveness — Independent 2023 evaluation of HHS and FDA oversight of IRBs, including inspection practices and recommendations for improving oversight.
GAO report on federal IRB oversight
FDA — Comparison of FDA and HHS Human Subject Protection Regulations — Explains the overlapping but distinct scopes of FDA human-subject regulations and the HHS Common Rule.
FDA comparison of FDA and HHS human-subject protections
Editorial currency note: This article reflects the public rulemaking record available on September 21, 2026. RIN 0937-AA16 remains an active rulemaking. The analysis should be updated when HHS publishes a Notice of Proposed Rulemaking, a Regulations.gov docket, a public-comment deadline or subsequent final rule.
