Common Rule (45 CFR 46)

The Common Rule establishes mandatory minimum standards for IRB review, informed consent, and assurance of compliance for federally funded human-subjects research in the United States. The 2018 revised Common Rule introduced new exempt categories, eliminated continuing review for many minimal-risk studies, mandated single-IRB review for cooperative research, required a new concise summary at the beginning of consent forms, and introduced broad consent as an option for the storage and secondary research use of identifiable private information and biospecimens. Additional protections apply under Subparts B (pregnant women, fetuses, neonates), C (prisoners), and D (children).

This entry defines the Common Rule itself. For a subpart-by-subpart map of the whole regulation — Subparts A through E, who each one protects, and how the Common Rule differs from FDA’s 21 CFR 50/56 — see 45 CFR 46 and the Common Rule: What Each Subpart Covers.

The 2018 revision organises exempt research into eight categories at §46.104(d) — spanning normal educational-practice research, benign behavioural interventions, secondary research use of already-collected identifiable information under specified conditions, and others — two of which (categories 7 and 8) require limited IRB privacy/confidentiality review rather than a purely administrative determination. Institutions conducting non-exempt federally supported human-subjects research must hold a Federalwide Assurance (FWA), a written institutional commitment filed with HHS’s Office for Human Research Protections (OHRP) to apply the Common Rule to the research it covers.

References

• Common Rule 45 CFR 46 (2018 revision), Subparts A-E
• Federal Register notice 82 FR 7149 (19 January 2017) and 83 FR 28497 (19 June 2018) effective and general compliance date
• OHRP Human Subject Regulations Decision Charts

The regulatory line runs back to the National Research Act of 1974, which created the commission that produced the Belmont Report.

Who Administers Common Rule Compliance

The Common Rule’s requirements do not enforce themselves; every covered institution designates a specific set of people and one specific piece of paperwork to carry them:

• The Federalwide Assurance (FWA). An institution’s Institutional Official signs the FWA with OHRP, a written, institution-wide commitment to apply the Common Rule to specified human-subjects research. Registration is not indefinite — each FWA has an expiration date and requires periodic renewal, and lapsing it (through an unrenewed expiration or an administrative error) can suspend an institution’s ability to conduct or receive funding for covered research until it’s restored.
• The Institutional Review Board (IRB) itself. Every IRB an institution relies on must be separately registered with OHRP, whether the institution operates its own board or relies on an external one (a central/commercial IRB, or another institution’s board through a reliance agreement).
• The Human Research Protection Program (HRPP) office. Day-to-day administration — protocol intake, continuing-review scheduling, reportable-events processing — typically sits with a dedicated HRPP or research-compliance office, distinct from the IRB’s own review function, often reporting to a Human Protections Administrator or directly to the Institutional Official.

None of these roles substitutes for another: an expired FWA doesn’t get cured by an active IRB registration, and an active IRB doesn’t relieve the HRPP office of tracking reportable events and continuing-review deadlines across every open protocol.

What the 2018 Revision Actually Changed, in Practice

The summary above compresses five distinct 2018 changes that are each worth a sentence of what they mean operationally:

• Eight new/expanded exempt categories (§46.104(d)). More minimal-risk research — certain secondary research using already-collected identifiable data, benign behavioral interventions with adult subjects who consent to the recording — now qualifies for an administrative exempt determination rather than full IRB review, though categories 7 and 8 still require a limited privacy/confidentiality review rather than a purely clerical sign-off.
• Continuing review eliminated for most minimal-risk research. Studies that qualify for expedited review, and certain exempt-adjacent categories, no longer need an annual re-approval meeting — a real administrative-burden reduction, but one that shifted more responsibility onto the initial review getting the risk determination right, since there’s no automatic annual check-in to catch drift.
• Mandatory single-IRB (sIRB) review for cooperative, multi-site research. A qualifying multi-site study conducted under one federal award now designates one IRB of record for the whole study rather than each site convening its own separate review — a major operational shift for institutions used to independently reviewing every incoming multi-site protocol.
• A mandatory concise summary at the start of consent forms. Long-form consent documents must now open with the key information a reasonable person would want in deciding whether to participate, before the fuller regulatory detail that follows — a direct response to consent forms that had grown long enough to bury the decision-relevant facts.
• Broad consent as an optional alternative pathway. Institutions may (but are not required to) offer broad consent — a single, one-time consent covering future, not-yet-specified secondary research use of a person’s stored identifiable information or biospecimens — instead of seeking new consent, or an IRB waiver of consent, for each future secondary use.

Checking this against the current guidance

Whether the single-IRB mandate extends to a foreign site named in a domestic cooperative award is exactly the kind of edge case the Common Rule text does not spell out directly, and the answer turns on the award’s specific funding structure and which sites are formally engaged in the research.

Ask CASRAI: Our multi-site NIH cooperative agreement includes one foreign collaborating site alongside several U.S. institutions — does the Common Rule’s mandatory single-IRB requirement extend to that foreign site’s participation, or can it undergo its own separate ethics review outside the sIRB arrangement?

It searches CASRAI’s indexed corpus of research-administration guidance and cites the passage behind each claim, so you can open the source and check it rather than take its word — and it says so when the corpus does not cover something instead of guessing. Two questions a day are free while you are signed out, no account and no card. Everything CASRAI publishes stays free to read.

Frequently Asked Questions

Does every institution that receives federal funding need a Federalwide Assurance?

Only if it conducts non-exempt, federally supported human-subjects research. An institution that receives federal research funding but never engages human subjects, or whose human-subjects work is entirely exempt, does not need an FWA on that basis alone — but most research-active universities and medical centers hold one because the range of research they conduct makes it necessary.

What is the difference between exempt research and expedited review under the Common Rule?

Exempt research falls into one of eight defined categories at §46.104(d) and, for most categories, receives an administrative determination rather than ongoing IRB oversight. Expedited review is a full Common Rule review pathway — the research is not exempt, but it qualifies as no-more-than-minimal-risk in a way that lets the IRB Chair or a designated experienced reviewer approve it without convening the full board, while retaining the same substantive review standard a convened meeting would apply.

Does the single-IRB mandate apply to every multi-site study?

No. It applies specifically to non-exempt human-subjects research conducted under a cooperative agreement or grant involving more than one U.S. domestic institution, funded or supported by a Common Rule department or agency. Multi-site studies falling outside that specific funding-and-structure description may still use a single IRB voluntarily, but aren’t required to.

Is an institution required to offer broad consent?

No. The 2018 revision made broad consent an optional pathway institutions may choose to implement, not a mandatory replacement for study-specific consent or IRB waiver of consent for secondary research use. An institution that has not implemented broad consent must continue to rely on those other mechanisms.