From Broad Consent to Model Cards: The Biobank Release Audit UK Research Teams Need

UK biobanks hold tissue, blood fractions and linked health data that were collected under consent frameworks designed for observational research, genomic discovery and approved clinical studies. Those frameworks were not written with foundation models in mind. A consent form may authorise research use in broad terms, but it does not automatically function as a data licence for every downstream machine-learning application. As requests to supply samples and associated records for AI training become more common, the governance question is no longer whether biobanks should support such work. It is what a defensible release decision looks like.

Why machine-learning reuse strains broad consent

Broad consent is powerful because it allows future research without recontacting every participant. It is also bounded. UK GDPR requires a lawful basis, fairness and transparency; the Human Tissue Authority expects licensed activities to respect consent and governance; and research ethics committees increasingly ask how data will be used, linked and shared. Machine learning adds three complications.

First, training data may be used to build a model rather than to answer a single research question. The model can then be applied to new populations, sold as a service or embedded in a clinical product. Second, linkage and inference can increase re-identification risk even when direct identifiers have been removed. Third, the model itself may retain information about the training set, which makes withdrawal, deletion and audit more complex than a conventional research dataset.

None of this makes AI training impossible. It means the release file must show that the proposed use sits within the consent and legal framework, and that residual risks have been identified and managed.

The release file: four questions before any sample moves

A practical release audit can be organised around four questions. Each should be answered in writing before material transfer or data access is approved.

1. Provenance and permitted purpose

Can the biobank trace each sample and dataset to the consent under which it was collected? Does that consent cover commercial research, model development, linkage to other datasets and sharing with third parties? If the consent is silent on a specific use, the default should not be permission. The release file should record the consent version, the ethics approval, the permitted purposes and any restrictions. Where the proposed use falls outside the original consent, the biobank should seek amendment, reconsent or a documented approval from the relevant research ethics committee before release.

Provenance also includes sample quality and chain of custody. A model trained on poorly annotated samples will inherit those weaknesses. The release file should state what was collected, how it was processed, what clinical data are attached and which variables are complete.

2. Commercial use and benefit-sharing

AI development often involves commercial partners, either directly or through a licensed platform. The biobank should establish whether commercial use is permitted, how intellectual property will be handled and whether any benefit-sharing or return-of-value arrangement applies. This is not only a legal question. It is a question of trust. Participants who contributed samples to a public research resource are entitled to know that commercial reuse has been considered within the governance framework, not discovered after the fact.

Material transfer agreements and data access agreements should specify permitted fields of use, sublicensing, model deployment, publication rights and termination. A vague reference to research purposes is unlikely to be sufficient.

3. Re-identification and linkage risk

De-identification is a process, not a permanent state. Machine learning can combine weak signals, and linkage to other datasets can make a previously anonymous record more identifiable. The biobank should require a re-identification risk assessment that considers the data fields released, the linkage keys permitted, the recipient's environment and the intended model use.

Controls may include aggregation, suppression of small cells, synthetic data for development, secure enclaves, output checking and contractual prohibitions on re-identification. The level of control should be proportionate to risk. A model trained on rare disease records with detailed geography and dates requires more caution than one trained on aggregated laboratory values.

4. Model documentation and downstream traceability

The release file should ask what the recipient will document about the model. A model card or datasheet should record the training data source, the population represented, known limitations, performance across subgroups and intended use. This is not bureaucratic decoration. It is how a biobank can later answer questions about how its samples contributed to a deployed tool, and how clinical users can judge whether the model applies to their patients.

Where possible, the agreement should require notification of substantial changes in use, restrictions on re-identification attempts and a route for withdrawal or deletion requests to be honoured as far as technically feasible. The biobank should also record the model's intended regulatory status. A research model that never reaches patients is different from a model intended to support diagnosis.

Turning the checklist into a release decision

The four questions should feed a short release recommendation: approve, approve with conditions, defer for further information or decline. The recommendation should identify the accountable committee, the evidence reviewed and the conditions attached. This creates an audit trail and makes consistent decisions more likely when requests arrive from different teams.

Biobanks should also review their consent materials for future collections. Where machine learning is a foreseeable use, consent language and participant information can be clearer about model development, commercial partnerships and data linkage. That will not solve every legacy case, but it reduces the governance debt passed to the next cohort.

A governance artefact, not a blockade

The purpose of the release audit is not to slow AI research. It is to make the boundary between consent and reuse visible. UK biobanks are rightly expected to support innovation, but they are also custodians of participant trust. A release file that records provenance, commercial terms, re-identification controls and model documentation gives research teams a clear path to approval and gives participants a defensible account of what their donation was used for. The consent form remains the foundation. The release audit is what turns it into a responsible data licence.