What is an Institutional Review Board (IRB) and how does it work in 2026?
By Aaron Small●6 min. read●Apr 2, 2026
Quick answer: What is an IRB? An Institutional Review Board (IRB) is an independent committee required by U.S. federal law to review and approve research involving human subjects. IRBs ensure participants' rights, safety, and welfare are protected before and during a study. Any research regulated by HHS or the FDA must receive IRB approval before enrolling a single participant — no exceptions.
IRB approval can take months. Researchers who treat it as a mere formality find that out the hard way. But with a little planning and understanding, you can avoid the delays that stall otherwise solid studies.
Before diving in, check out types of studies that are not human subject research and do not require IRB approval. Some studies can skip IRB review or go through an expedited process.
Can't skip IRB approval? Read on to see how to make the process as smooth as possible.
What is an Institutional Review Board (IRB)?
Institutional Review Boards (IRBs) are administrative bodies designed to protect the rights and welfare of human subjects recruited to participate in research.
IRBs are required by U.S. law. Research studies that involve human subjects must get approval from a research oversight committee before starting research, even before enrolling participants.
Typically, IRBs review and monitor all biomedical and behavioral research. So while software companies testing their UI won't be subject to IRB scrutiny, a biotech company conducting user research on a medical device would, for example.
How did IRBs come to exist?
Research with human subjects has a long and often troubling history — in the U.S. (the Tuskegee Syphilis Study being one of the most well-known examples) and around the world, including Nazi war crimes against humanity. In both cases, people were forced to participate or did so without proper consent or knowledge of what the research involved.
Unethical research and abuses led to the creation of research ethics codes. The Belmont Report (1979) outlines three ethical principles for research: respect for persons, beneficence, and justice. These principles led to new rules in the U.S. Department of Health and Human Services (HHS) Code of Federal Regulations (45 CFR 46).
The Belmont Report laid the groundwork for what became known as “The Common Rule” — the short name for "The Federal Policy for the Protection of Human Subjects." First issued in 1991 and significantly revised in 2018, the Common Rule is the version in effect today, and it differs meaningfully from the original. If you're working from older guidance, it's worth confirming you're referencing the current version.
The Common Rule requires researchers to design studies with the following principles in mind:
Respect for persons
Obtain informed consent from subjects, communicating information about the research clearly, including its risks and benefits.
Protect the privacy of individuals.
Ensure the protection of vulnerable populations, including children, prisoners, and pregnant women, fetuses, and neonates, which require additional consent and other precautions.
Beneficence
There is minimal risk to subjects.
Risks are reasonable in relation to anticipated benefits.
Where appropriate, the research plan includes adequate provisions for monitoring data collection to ensure subject safety.
Adequate provisions are made to protect individual privacy and maintain data confidentiality.
Justice
Human subjects must be selected equitably, taking into account the purposes of the research and the setting in which it takes place.
The Common Rule also established a key protection that remains in effect today: all research involving human subjects must be reviewed and approved by an IRB.
What purpose do IRBs serve?
IRBs review both proposed and ongoing research activities to ensure they meet specific criteria for approval. Their role covers three main areas: protecting participants' welfare, providing guidance to researchers, and ensuring adherence to ethical standards.
Researchers conducting IRB-approved studies must be fully educated on the applicable rules and genuinely committed to protecting the rights and welfare of every human subject involved. It's not just a compliance checkbox — IRB approval signals that a study was designed with participant safety at the center.
Who makes up an Institutional Review Board?
IRB membership is broader than most researchers expect. Committees can include accountants, doctors, lawyers, community members, church members, and fellow researchers.
A mix of professional backgrounds and community perspectives means research protocols get scrutinized from more than just a scientific standpoint. Anyone can apply for membership and be accepted on the basis of having a genuine interest in protecting the rights and welfare of research participants.
When do you need an IRB?
Research that falls into any of the following categories requires IRB approval. How quickly your application moves depends on the complexity of your study and the potential risk to participants.
Types of research requiring IRB approval:
Social and behavioral research. Studies that investigate human behavior, attitudes, opinions, cognition, emotions, social interactions, or cultural practices including research under the umbrellas of psychology, sociology, education, and anthropology.
Biomedical research. Clinical trials, FDA-regulated products, and product development involving drugs, food supplements, or medical devices.
Research involving identifiable private information. Studies accessing or using identifiable private information, such as medical records, biological specimens, school records, or personal data, even if that data has been de-identified or anonymized.
Institutions requiring IRB oversight include:
Federal agencies and departments. Research funded by federal agencies may use either internal or external IRBs to obtain an assurance of compliance. The IRB must register with the Office for Human Research Protection (OHRP), under the Department of Health and Human Services.
Academic institutions. Universities and colleges often have in-house IRBs to oversee work conducted by faculty, staff, and students.
Medical and healthcare institutions. Research conducted within hospitals, clinics, and other healthcare settings, including clinical trials and studies involving patient data.
Nonprofit and non-governmental organizations (NGOs). IRBs govern research conducted by nonprofits when they use federal funds for studies involving human participants.
Private companies. Clinical investigations of products such as drugs, biological products, and medical devices require IRB approval and compliance with FDA regulations. Note that HHS and FDA requirements differ in one key area: researchers conducting a study supported by HHS must sign an assurance — a document verifying the study will comply with HHS regulations — while researchers conducting an FDA-supported study do not. Compare FDA and HHS Human Subject Protection Regulations.
International collaborations. Research involving participants outside the U.S. that is either federally funded or involves FDA-regulated products must also be IRB-approved.
Not all research by private companies falls under these rules. Organizations like Google and Pinterest conduct non-medical research (UX research, for example) that isn't regulated by the Common Rule and doesn't require IRB approval. That said, many organizations follow ethical guidelines and require informed consent. Some also offer incentives, and many decide to partner with Tremendous.
A note about using AI in your study
If your study involves human subjects, existing IRB rules apply regardless of whether AI is involved. AI-driven anonymization doesn't exempt you from IRB oversight, and no unified federal AI-IRB standard exists yet.
That said, the field is catching up. One study proposes a three-stage framework that adapts to the stages of AI creation (design, deployment, and post-deployment monitoring) as a starting point for thinking about oversight. It's worth familiarizing yourself with current thinking in this area, especially if your study relies heavily on AI-generated data collection or analysis.
What happens if you conduct research without IRB approval?
Skipping IRB approval is an ethical violation, and it carries serious consequences for researchers and their institutions. For starters, data collected without IRB approval risks being invalidated entirely. That means findings can't be published in peer-reviewed journals, regardless of how sound the underlying research is.
The regulatory consequences are just as serious. Under HHS regulations at 45 CFR 46.103(b) and 46.109(a), every non-exempt study must have IRB review and approval before it begins. If it doesn't, OHRP can issue a determination letter or require corrective action, which could put all ongoing human subjects research at the institution on hold, not just the study in question.
In serious cases, OHRP can restrict or suspend the institution's Federalwide Assurance (FWA) — the certification federal agencies require before awarding research grants. No active FWA means no new federal funding until compliance is restored. Learn more about compliance determinations and actions.
For FDA-regulated research, the stakes are just as high: the FDA can issue warning letters, impose clinical holds, or initiate disqualification proceedings against an IRB and your organization.
No IRB approval means no valid data, no publication, and potentially no federal funding. Don't skip it.
How IRBs are structured
As of March 2026, there are about 7,611 US-based IRBs, all set up and registered with the OHRP.
In 2011, Klitzman categorized IRBs into two main types:
Centralized or independent IRBs. For-profit organizations that function as "big box" review boards. They can offer advantages like streamlined reviews, but come with their own tradeoffs around local context and researcher relationships.
Local IRBs. Generally not-for-profit boards (think informal university review committees) that can provide local knowledge and informal guidance for research teams.
If your study involves multiple institutions, NIH typically requires a single IRB (sIRB) to review the protocol for all sites, keeping the process consistent and avoiding duplicated reviews. All participating institutions rely on that one approval rather than conducting independent reviews.
If you’ve already been taking a centralized approach, complying with sIRB requirements shouldn’t be a big change. But check with your sponsored research office about what each institution will still be responsible for and how sIRB policies will affect your approval timelines.
How to find an accredited IRB
The Association for the Accreditation of Human Research Protection Programs, Inc. (AAHRPP) is a non-profit accrediting body for IRBs. Its search engine lets you browse local and vetted IRBs. It’s a useful starting point early in your research planning process.
What's the difference between an exempt, expedited, and full IRB review?
IRB reviews fall into one of three categories based on the level of risk to participants. Knowing which category your study falls into will give you a realistic sense of your timeline before you even submit.
| Review type | Risk level | Examples |
|---|---|---|
| Exempt | Minimal | Educational testing, benign behavioral interventions, anonymous surveys |
| Expedited | Minimal, but outside exempt categories | Voice/image data collection, non-invasive procedures, group behavior studies |
| Full board | Greater than minimal | Clinical trials, studies with vulnerable populations, research with significant physical or psychological risk |
Exempt studies sit outside the full regulatory requirements because the risk to participants is negligible. They aren't subject to ongoing IRB oversight once approved and are often conducted in educational settings. That said, "exempt" doesn't mean unsupervised — an IRB still makes the determination that a study qualifies.
Expedited review covers studies that involve minimal risk but fall outside the exempt categories — think voice recordings, non-invasive physiological measures, or research on group behavior. These move faster than full board reviews but still require formal IRB sign-off.
Full board review applies to anything that doesn't qualify as exempt or expedited. This includes research that poses more than minimal risk, involves vulnerable populations (like children, prisoners, or pregnant women), or raises complex ethical questions. These studies go before the entire IRB committee and are subject to all regulatory requirements. Full board reviews take the longest, so if your study falls into this category, build extra lead time into your planning.
The IRB process
Here's a look at the IRB process at a topline level. Expect forms, documents, and back-and-forth between you and your IRB at every stage.
Research design and development
IRB application
Pre-review and revisions
IRB review
Feedback and revisions
IRB approval
Beyond IRB approval
How long does the review process take?
Submission to first response can take anywhere from a few weeks to six months. The range is wide because the timeline depends on several variables:
What type of review is being conducted?
How complete is the original application?
How complex is the research protocol?
What is the IRB’s current bandwidth, and how often do they hold committee meetings?
Does the IRB have sufficient resources and processes in place? Understaffed or poorly organized IRBs can slow approvals significantly.
Applications are typically reviewed in the order they're received, so get ahead of schedule and check upcoming deadlines before you submit.
How to successfully collaborate with an IRB
Your goal as a researcher is to push the boundaries of science and make discoveries. An IRB's job is to make sure you know what you're doing and that no one gets hurt in the process. That tension is real, but it doesn't have to slow you down.
We looked at research on IRB collaboration and spoke with two research directors for practical advice: Susan Montgomery, former professor and librarian at Rollins College, and Holly Cole, CEO of ResearchOps Community.
Tip 1: Build a relationship with your IRB
Cartwright et al. (2013) found that building personal connections with IRB staff and demonstrating expertise meaningfully improved the review experience. More recent guidance from MIT continues to emphasize clear, constructive communication as the most effective approach.
Both experts agree.
"An IRB is not a black box. Know who the players are and connect with them, so they understand your goals and game plan," said Susan.
Tip 2: Start early
Schedule meetings with IRB committee chairs, members, or administrators before you submit. They can walk you through the application process and flag potential risks early — the kind of issues that cause delays if you only discover them mid-review.
Think of it like office hours. The IRB staff are there to help you figure things out. Use them.
Tip 3: Manage the bureaucracy at the IRB
Learn the IRB's policies and preferences, and learn from other researchers' experience with them. One useful approach: spend some time within the IRB. You can:
Get involved in local research oversight
Volunteer as an ad hoc reviewer
Partner with IRB administrators to host educational sessions
Work with the IRB to find solutions to challenges researchers commonly face
Reach out to your local IRB and ask how you can get involved. The relationships you build now will save you time and headaches.
Building that rapport matters beyond the approval stage, too. Writing your proposal, securing IRB approval, and planning a participant incentive structure are all part of the same process. The smoother your IRB relationship, the smoother each step goes.
Ready to start your IRB application? Check out our guide to navigating the process.
Key takeaways
IRB approval is a legal requirement, not a formality. Any research involving human subjects and regulated by HHS or the FDA must receive IRB approval before you enroll a single participant.
Review type determines your timeline. Exempt and expedited reviews move faster; full reviews can take up to six months. The completeness and complexity of your application are the biggest factors within your control.
Treat your IRB as a collaborator, not a gatekeeper. Build relationships early, submit complete applications, and engage with IRB staff throughout the process to reduce delays and keep things moving.
