R&D Compliance

Compliance covers the ethical and regulatory obligations that apply to R&D projects. This includes, for example, data protection (e.g. GDPR), regulation governing clinical research (such as the CTR and MDR), and adherence to ethical standards.

Research agreements are a key practical tool for ensuring regulatory compliance. In some cases, a written agreement is mandatory under applicable legislation or funding conditions.

The General Data Protection Regulation (GDPR) provides certain flexibilities for processing personal data in scientific research, often referred to as the research exemption.

In practice, this allows existing data to be reused for scientific research without necessarily obtaining new consent, as scientific research is considered compatible with the original purpose of collection. In specific circumstances, certain data subject rights (such as the right to erasure) may also be restricted for research purposes.

However, these exemptions can only be relied upon when:

• appropriate safeguards are implemented, such as pseudonymisation; and

• the activity qualifies as genuine scientific research (based on a research plan and not merely market research).

National legislation may also impose additional requirements on the processing of personal data in research.

The EU Artificial Intelligence Act includes a specific research exemption. The AI Act does not apply to AI systems or models (or their outputs) that are developed and used solely for the purposes of scientific research and development.

This exemption may apply, for example, to academic prototype development or the training of a model intended solely for research use. However, the exemption no longer applies once an AI system is placed on the market or when it is no longer used exclusively for research or development purposes. Real-world testing is also subject to additional requirements.

The AI Act further supports innovation through mechanisms such as national regulatory sandboxes.

Importantly, even when the AI Act does not apply, other legislation continues to apply. For example, data protection requirements and clinical research safety obligations must still be observed.

In research projects, it is essential to document key terms in a written agreement. Core areas to address include the project implementation, data protection, confidentiality, intellectual property rights and liability.

The appropriate agreement depends on the scope of the collaboration, the parties involved and the applicable legislation. Some funders also require the use of their own contract templates.

Common types of research agreements include:

• Non-Disclosure Agreement (NDA): used before initiating collaboration, unless confidentiality is covered elsewhere

• Consortium Agreement: particularly common in academic and EU-funded collaborative research

• Material Transfer Agreement (MTA): required when biological materials or other samples are transferred between parties

• Clinical Trial Agreement (CTA): required for clinical drug or medical device studies

• Data Transfer Agreement (DTA): used when datasets are transferred as part of the collaboration