- What changed: the Final Rule and the 2026 effective date
- Who must file an assurance renewal, and via which form
- The 2026 assurance renewal checklist
- Frequently asked questions
- Implications for research administrators
- Looking ahead
The ORI research misconduct policy that governs Public Health Service (PHS)-funded research changed materially for 2026, and the annual paperwork cycle that keeps an institution’s assurance active has not paused to accommodate the transition. Every institution that holds a PHS assurance under 42 CFR Part 93 — whether or not it has an open case — must file its Annual Report on Possible Research Misconduct between 1 January and 30 April 2026, and for the first time that filing sits alongside a revised regulatory framework institutions are expected to have already adopted.
This is a mechanics piece, not a restatement of the Final Rule’s substance. It sets out exactly what the U.S. Department of Health and Human Services’ Office of Research Integrity (ORI) expects institutions to submit for the 2026 assurance renewal cycle, which form to use, and where the transition from the 2005 regulation creates procedural traps for research integrity officers (RIOs) and sponsored-programs staff.
What changed: the Final Rule and the 2026 effective date
ORI’s revised Public Health Service Policies on Research Misconduct — published in the Federal Register on 17 September 2024 and codified at 42 CFR Part 93 — took effect on 1 January 2026. It is the first substantive rewrite of the misconduct regulation since 2005, and it introduces more than twenty-five newly defined terms, including “institutional record,” “administrative record,” “intentionally,” and “recklessly,” aimed at tightening consistency across institutional proceedings.
The core three-part definition of research misconduct is unchanged: fabrication, falsification, or plagiarism (FFP) that represents a significant departure from accepted practices of the relevant research community, committed intentionally, knowingly, or recklessly, and proven by a preponderance of the evidence. What has changed is procedural detail — respondent comment rights on draft investigation reports, record-retention protocols, and interim-action notification triggers are now spelled out in greater depth.
Critically, the Final Rule is not retroactive. Allegations received before 1 January 2026 continue to be handled under the 2005 version of Part 93 unless the institution and the respondent agree in writing to proceed under the new rule. Institutions running dual-track proceedings across the transition need to document, case by case, which regulatory version applies.
Who must file an assurance renewal, and via which form
Any institution that receives PHS-supported research funds — including awards from NIH, CDC, FDA, HRSA, and other PHS agencies — must maintain an active research misconduct assurance with ORI. Once an assurance is established, the institution is obligated to file annually, regardless of whether it received any misconduct allegations that year.
- Form: Annual Report on Possible Research Misconduct, Form PHS-6349, submitted through ORI’s online Annual Report system (ARPRM).
- Filing window: 1 January through 30 April each calendar year, covering the prior calendar year’s activity.
- 2026 deadline: 30 April 2026, covering the reporting period 1 January–31 December 2025.
- No-activity institutions: institutions with no PHS-supported research or no allegations in the reporting period may still owe a report; small or inactive institutions should confirm with ORI’s Assurance Program whether a Small Institution or no-activity statement applies to their circumstances.
- Access: ORI’s Annual Report system now requires two-factor authentication (2FA) — institutions should confirm their registered email with the Assurance Program ([email protected]) well before the deadline to avoid last-minute access issues.
The 2026 assurance renewal checklist
Beyond the Form PHS-6349 filing itself, 2026 is unusual because institutions are also expected to have brought their internal policies and procedures into alignment with the new 42 CFR Part 93 requirements. ORI published a Sample Policies and Procedures document in June 2025 specifically to help research integrity officers, compliance staff, and institutional counsel update their templates ahead of the 1 January 2026 effective date.
| Item | 2005 rule (pre-2026 cases) | 2026 Final Rule |
|---|---|---|
| Effective date | 16 June 2005 | 1 January 2026 |
| Defined terms in 42 CFR Part 93 | Baseline set | 25+ additional defined terms |
| Applies to allegations received | Before 1 Jan 2026 (default) | From 1 Jan 2026 onward, or earlier by written agreement |
| Annual Report on Possible Research Misconduct | Form PHS-6349, Jan–Apr window | Unchanged: Form PHS-6349, Jan–Apr window |
| Institutional policy alignment | N/A | Sample Policies and Procedures released June 2025 |
Institutions preparing their 2026 renewal should treat the filing as a two-part exercise: (1) submit Form PHS-6349 through ARPRM by 30 April 2026 for the 2025 reporting year, and (2) confirm that the policies and procedures referenced in that assurance actually reflect the post-1-January-2026 regulatory text, not the 2005 language many institutional websites still carry. ORI’s own research administration compliance guidance and case-summary archive remain useful references for RIOs benchmarking their inquiry and investigation timelines against the 60-day inquiry and 120-day investigation targets that persist in the revised rule.
Frequently asked questions
What is the deadline for the ORI 2026 annual assurance renewal?
Institutions holding a PHS research misconduct assurance must file the Annual Report on Possible Research Misconduct (Form PHS-6349) between 1 January and 30 April 2026, covering research misconduct activity from the 2025 calendar year, via ORI’s online ARPRM system.
Which institutions must maintain an ORI research misconduct assurance?
Any institution receiving Public Health Service-supported research funds — from NIH, CDC, FDA, or other PHS agencies — must hold an active assurance under 42 CFR Part 93 and file annually, even in years with no reported allegations.
Does the new ORI Final Rule apply retroactively to open cases?
No. Allegations received before 1 January 2026 are handled under the 2005 version of 42 CFR Part 93 by default, unless the institution and respondent agree in writing to proceed under the revised rule instead.
What form and system do institutions use to submit their annual report?
Institutions submit Form PHS-6349 through ORI’s Annual Report on Possible Research Misconduct system (ARPRM), which now requires two-factor authentication tied to the institution’s registered email address.
Implications for research administrators
The overlap between the Final Rule’s 1 January 2026 effective date and the routine 30 April annual report deadline compresses an already tight compliance calendar. Research integrity officers now need to reconcile three separate obligations in the same window: filing the standard annual report, confirming that institutional policies match the revised regulatory text, and correctly classifying any pending allegation as either a 2005-rule case or a 2026-rule case for procedural purposes.
ORI’s most recent published Annual Report, covering 2024 activity, recorded 713 allegations of possible research misconduct and 117 new cases opened that year, with 38 cases carried over from prior years — a caseload that gives some sense of scale for institutions weighing how much internal capacity to dedicate to inquiry and investigation infrastructure under the tightened procedural clock.
- Audit institutional policy language against ORI’s June 2025 Sample Policies and Procedures document before certifying compliance in the 2026 assurance filing.
- Tag open cases by intake date to determine which regulatory version (2005 or 2026) governs each proceeding.
- Confirm ARPRM account access and two-factor authentication setup well ahead of the 30 April deadline — do not wait for filing week.
- Brief institutional review boards and legal counsel on the expanded defined terms, particularly “recklessly” and “intentionally,” which affect how misconduct findings are documented.
Looking ahead
The 2026 cycle is likely to be the messiest transition year institutions face under 42 CFR Part 93 for some time: two regulatory regimes running in parallel, a compressed policy-update timeline, and an unchanged annual filing deadline that does not care which rule applies to a given case. Institutions that treat the 30 April 2026 Form PHS-6349 submission purely as a data return — rather than as an opportunity to verify their underlying policies actually match the current regulation — risk finding gaps only when ORI reviews a proceeding. Research administrators tracking related standards work, including contributor-role and authorship frameworks referenced in misconduct findings, can cross-reference CASRAI’s CRediT contributor role and authorship resources when documenting responsibility in a research record.