Multi-country fieldwork under tightening AI rules: how to cut the risk

Multi-country fieldwork has always meant multiple privacy regimes. What is new is that the rules now reach the tooling as well as the data: how respondents are screened, how their responses are scored, and whether they were told that a system rather than a person made a decision about their participation.

The practical effect for a research agency is that a market can no longer be treated as a line item on a field schedule. It is a compliance context, and the supplier operating in it has to be able to evidence what they did.

Map the tooling, not just the data

Most compliance reviews start with data flows: what is collected, where it is stored, who can see it. That is necessary and no longer sufficient. The newer obligations attach to automated decisions, which means the screening and quality tooling is in scope even when it never stores a personal identifier.

Build the inventory once, per study: which automated systems touch a respondent, what each one decides, and what disclosure each market requires for that decision.

Disclosure that a respondent can actually use

A disclosure buried in a privacy policy satisfies nobody, including the regulator. Where a respondent is screened out by an automated check, the clean approach is to say so at the point it happens, in the language of the survey, with a route to a human.

This is less disruptive than it sounds. The screen-out page is already a page. Adding a sentence and a contact route costs nothing and removes an entire category of risk.

Retention that matches the obligation

Several of the new obligations are evidentiary: you may be asked to show how a decision was made, months after the study closed. That is incompatible with a retention policy that deletes screening records at the end of fieldwork.

The resolution is to separate the decision record from the personal data. Keep what the system decided and why, for as long as the obligation runs. Delete the identifiers on the original schedule.

Where the risk usually sits

• Local partners using their own screening tools that were never disclosed to the end client
• Translated consent language that materially changes what the respondent agreed to
• Fraud models validated in one language and deployed in eight
• Incentive platforms in third countries with their own data-sharing terms
• Retention policies written for the data and silent on the decisions

Each of those is discoverable by asking a supplier one direct question before the study starts. All of them are expensive to discover afterwards.