How to pass an AI moderated interviews compliance review

Your team just got the go-ahead to interview customers who left the phone company where you work. An AI moderator will ask the questions. Then the privacy team emails you a list of its own. What do they need to hear before they say yes?

That list starts your AI moderated interviews compliance review. It's the check that a study follows the rules before it begins.

The answer is one pack, sent to every team on the same day. It says what people are told and where the data lives. It says who sees the data, whether it trains AI and where people come from.

To build that pack, start with who reads it. Each team looks for something different.

The short version

• Send one pack to every team on the same day, with one date to reply by.
• Tell people plainly that an AI asks the questions and that the call is recorded.
• Know where recordings are kept, who can open them and when they are deleted.
• Get it in writing whether interview data trains any AI model.
• If a study reads feelings from video of staff or students, ask the legal team first.
• Cover participant sourcing and fraud checks: where people come from and how each one is checked.

Who checks the study, and what goes in the pack?

At the phone company, the privacy team wrote first. But other teams will follow, and each one has its own form. So it helps to know who they are.

Five people or teams usually review the study: the legal team, the privacy team, information security, the buying team and the research lead.

• The legal team is the company's lawyers. They check the contract and the words people agree to.
• The privacy team protects people's personal details. Personal details point to one person, like a name or a phone number.
• Information security keeps the company's computers and files safe. They ask who can open the recordings.
• The buying team buys tools from outside companies. A company that sells you a tool is called a vendor. Think of the shop where you buy a phone. The buying team also asks where participants, the people you interview, come from.
• The research lead runs the study. They check that an AI moderator suits the question.

You can fit every answer on one page. Your one-page approval pack can be a single table. Each row is one reviewer, what they ask and what you send them.

Two words in that table need a plain sentence each. A data processing agreement is a contract. It says what the vendor may do with people's personal details. Think of it as the house rules you leave for a house sitter.

A screener is a short quiz people answer before the interview. It makes sure you only talk to the right people.

These worries are common, and researchers share them too. A preprint is a study shared before other experts have checked it. In a 2026 preprint accepted to the CHIWORK '26 conference, 17 interviewers tried AI-written follow-up questions. One of the five worries they raised was privacy, disclosure and compliance risk "when AI listens, records, or transcribes sensitive content".

So send the pack to everyone at once. If you answer one team at a time, the last team starts long after the first.

What are people told, and where do they come from?

Say a former phone customer opens the interview link. Before the first question, they should know who is asking and what happens to their words. Then they choose whether to say yes. That yes is called consent. It's like asking before you take someone's photo.

The consent screen should cover eight things. They are the AI moderator, recording, transcription, use, access, retention, withdrawal and payment. Retention means how long the answers are kept. In plain words, the screen says:

• An AI moderator asks the questions.
• The interview is recorded.
• The interview is typed up as a transcript, like subtitles on a film.
• What the company will use the answers for.
• Who will see the recording and the transcript.
• How long the company keeps them.
• How to stop now, or withdraw later and have their answers taken out.
• Whether they are paid, and how.

The phone company wants to invite its own former customers. So the privacy team will ask about consent to contact. Did those customers agree to be contacted for research? It's like checking that a friend is happy to be called before you pass on their number. So write down who checks the company's own customer list, and when.

Teams in Europe will also hear about GDPR. GDPR is the EU's law on how companies handle personal details. This post explains what reviewers ask, and it isn't legal advice.

Your legal team decides what the law requires in each country where you run the study.

The buying team then asks about participant sourcing and fraud checks. Participant sourcing means where the people you interview come from. Fraud checks are how the vendor makes sure each participant is real.

If the phone company doesn't give you a list, participants often come from a panel. A panel is a group of people who signed up to join studies for pay.

That pay is why fraud checks matter. Some people join studies with false details just to get paid. It's like someone with a fake ticket at a concert. So ask the vendor, in writing, how it checks that each participant is real and fits the study.

Reviewers also want to know who reads the transcripts. A researcher can judge interview quality in one transcript, which is good practice for any study.

Where does the data live, and who sees it?

Information security wants to know where the phone company's recordings will sit. They also ask who at the vendor can open them. And they ask whether the data trains AI. So ask every vendor the same six questions in writing. Then each answer can go straight into the reviewer's file.

1. Where are recordings and transcripts stored?

Data residency means the country or region where your data is stored. It's like choosing which city your storage locker is in. A good answer names the region, such as the EU. It also says whether you can choose it.

2. Which other companies handle the data?

A subprocessor is another company the vendor uses to handle your data, such as a cloud company. It's like a builder who brings in a plumber. You want to know who else is in your house. A good answer is a published list, and a promise to tell you when it changes.

3. How do staff log in, and who sees what?

Single sign-on lets staff log in with their work account. It's like one key that opens every door at the office. When someone leaves the company, that one key stops working. Roles decide who can see what. Think of a school. A teacher sees every student's grades, but each student sees only their own.

4. Are names taken out of transcripts?

Redaction means removing personal details, such as names and phone numbers, from the transcript. It's like covering an address with a black marker before you share a letter. Ask whether it happens on its own, every time.

5. When is the data deleted?

Deletion means the recordings and transcripts are wiped for good. Ask how long the vendor keeps them, and how you delete them when the study ends. It's like asking a shop when it shreds your old receipts.

6. Is interview data used to train any AI model?

Training means using data to teach an AI model. It's like a student learning from old exam papers. You want to know whether your customers' words become someone's study notes. Ask about the vendor's own models and any AI company it works with.

Then put the answer in writing and in the contract. A sentence on a website can change overnight, but a contract can't change without you.

What if the interview uses video?

Say the research lead at the phone company wants video. They want to see faces as well as hear voices. The legal team may then ask whether reading feelings from faces is allowed. In the EU, one part of a law called the AI Act bans some uses of this.

A March 2026 analysis by the Future of Privacy Forum explains Article 5(1)(f) of the EU AI Act. This rule is about emotion recognition, which means AI guessing how someone feels. It prohibits AI systems that infer a person's emotions from biometric data in the workplace and in education institutions. Biometric data is data about a person's body, such as their face. There are exceptions for medical and safety reasons.

The same analysis says emotion recognition outside those settings isn't covered by this ban. Instead, it counts as high risk under Annex III of the Act. High risk brings its own duties, and your legal team will want to read them.

In plain words, the ban names two places: work and school. So interviews with the company's own staff, or with students, go to the legal team first. For customer studies, the legal team still decides. Bring them what the study is for and how the video will be used.

If your study is a voice interview with customers, send the full pack to every team on the same day. If it records video of staff or students, go to the legal team first. Send the rest once they answer.

Where Pulse fits

Pulse states its answers to the core questions above plainly, which keeps the pack short. It is GDPR compliant and offers data residency options on the enterprise plan. It supports SAML and OIDC single sign-on on request, with Owner, Admin and Member roles. Personal data is redacted from transcripts, and customer data is never used to train AI models.

Participants take the interview on a phone or laptop by opening a link, which is how Pulse runs AI-moderated interviews. Every interview arrives as a full transcript alongside its recording. Fraud checks run on every participant. The privacy notice for interview participants is public, so the privacy team can read it before the first call.

Your legal team still decides what each study needs, and these facts give them something concrete to work from. To walk your reviewers through a study, book a demo.

Questions readers ask

1. Do people have to be told the interviewer is an AI?

Tell them plainly, before the first question. One line can do it: "An AI will ask you the questions, and this call is recorded." People are agreeing to share their views. Who is asking is part of that. Your legal team decides what the law requires where you run the study. That one line on the consent screen answers this for every reviewer.

2. Can someone say no to an AI-moderated interview?

Yes. Taking part is always the participant's choice, and they should be able to stop at any point. The consent screen should say how to stop and how to withdraw later. Some topics suit a person better. The guide to when a human moderator is the better fit shows how to choose.

3. How do you keep the findings honest?

Research integrity means the findings are honest and can be checked. It comes from the same steps as any study. You need a clear guide, a screener and checked participants. Then a researcher reads the transcripts before trusting a theme. You can audit themes back to the exact quote to test any finding.

4. What is an AI-moderated interview?

An AI-moderated interview is a one-to-one research interview led by an AI moderator. It asks questions from a guide and listens to each answer. When a reply is vague, it asks a follow-up. A researcher still writes the guide and reads the results. To learn more, see the guide to AI-moderated research.