AI GOVERNANCE & RESPONSIBLE USE

MMR ANSWERS: ESOMAR 20 QUESTIONS ABOUT AI BASED RESEARCH SERVICES

1. What experience and know-how do your company have in providing AI-based solutions for research?

MMR has extensive experience in providing AI-based solutions for research. Our AI Toolkit includes a diverse range of AI tools and applications that drive innovation and efficiency across our business operations. We have developed internal AI tools tailored to MMR’s unique market research methodologies and client needs, as well as curated external AI tools vetted for quality and effectiveness. Our team comprises experts in data science, deep learning, natural language processing, market research (across qualitative, quantitative and sensory disciplines) and consultancy, ensuring a robust mix of research skills and AI-relevant skills.

2. Where do you think AI-based services can have a positive impact for research? What features and benefits does AI bring, and what problems does it address?

AI-based services can significantly enhance consumer research by integrating quantitative and qualitative methodologies, leading to deeper human understanding and addressing key pain points such as increased engagement, deeper insights, and greater inclusivity and accessibility in research. AI tools can fast-track repetitive and time-consuming tasks, deliver insights in more innovative ways, and provide researchers with new opportunities to address key research challenges. We are particularly excited by the new capabilities that leverage MMR’s unique Sensory and Product expertise to support our clients across the innovation cycle.

3. What practical problems and issues have you encountered in the use and deployment of AI? What has worked well and how, and what has worked less well and why?

In deploying AI, we have encountered challenges related to data quality, bias, and the need for human oversight. What has worked well includes the integration of human-in-the-loop controls and quality assurance systems to ensure ethical behaviour. We have also found that it is important to stay close to supplier updates, especially their terms and conditions related to how they use our data. Shifts in this have led us to remove external AI tools from our toolkit. Continuous updates and regular reviews have been essential in managing these challenges.

4. Can you explain the role of AI in your service offer in simple, non-technical terms in a way that can be easily understood by researchers and stakeholders? What are the key functionalities?

We routinely use AI to help us:

Connect	Synthesise	Create
e.g. Conversational AI to deepen guided consumer engagement or social listening to access your consumer’s unprompted views and preferences	e.g. Unstructured data analysis techniques to quickly make sense of transcripts or open ends	e.g. Image generation to bring ideas to life for reporting or co-creation with consumers

By combining AI with both quantitative and qualitative research methods, we deepen human understanding and tackle key challenges such as boosting participant engagement, uncovering deeper insights, and making research more inclusive and accessible.

AI also improves efficiency by automating repetitive tasks, handling large datasets, and generating insights faster than manual methods—freeing researchers to focus on what matters most.

5. What is the AI model used? Are your company’s AI solutions primarily developed internally or do they integrate an existing AI system and/or involve a third party and if so, which?

MMR's AI solutions are a mix of internally developed tools and curated external tools. Only suppliers that pass our AI Governance team’s extensive checks are integrated into our portfolio of solutions.

Our decision-making process includes the following considerations: 

• Use Case Definition and Impact: We assess the specific use cases for the new technology and its potential to create meaningful improvements within MMR’s workflows.
•  Minimizing Redundancy: Our goal is to streamline our technological ecosystem by avoiding unnecessary overlap. We strive to utilize the smallest number of platforms required to achieve our objectives effectively.
• Buy or Build Analysis: We weigh the options of developing a solution in-house against purchasing an existing product. This decision is based on our internal development capabilities, the urgency of the need, and the financial implications of both building and maintaining or investing in an external solution. 
• Security and Authentication: Any new technology must meet our stringent security standards, including the ability to integrate with single sign-on systems or multi-factor authentication to ensure the protection of our data and user identities. 
• Deployment Considerations: We consider whether the technology is web-based or requires installation on individual devices, with a preference for web-based solutions that offer greater accessibility and ease of maintenance. 
• Data Hosting Location: The location where data is hosted is critical. We prioritize solutions that store data within Europe or the United States, adhering to GDPR regulations to ensure data privacy and compliance. 
• Provision of Private Instances: We require the ability to have private instances of the technology, with individual user accounts that can be managed under an enterprise licensing agreement, providing us with control and governance over our data. 
• Data Removal and Opt-Out Policies: It is essential that the technology provides an option for data removal and allows us to opt out of any features that might involve training algorithms with our competitive, sensitive, or proprietary information. 
• Data protection: Supplier is GDRP compliant or with ISO27001 or SOC2 certified and can share Security architecture details if required

When building and developing our own AI-fuelled capabilities, we will typically select the optimal model or combination of models for the specific task at hand. This also ensures a degree of flexibility to be able to upgrade models as the technology continues to advance.

6. How do the algorithms deployed deliver the desired results? Can you summarise the underlying data and the way in which it interacts with the model to train your AI service?

Our AI services leverage a combination of client-specific data and carefully curated market research knowledge bases, which provide rich, domain-relevant context to enhance model accuracy and relevance. Through these models, we use a wide range of AI methodologies, from traditional and foundational approaches such as machine learning (ML) and natural language processing (NLP) to generative AI and advanced AI reasoning techniques (such as Chain of Thought prompting) to address the unique needs of consumer and sensory research.

Throughout the training and deployment process, strict data privacy and confidentiality protocols are followed to protect client information. Data used for training is fully anonymized and we remove all sensitive or proprietary information.

To ensure robustness, we regularly update and validate training datasets to prevent model drift and overfitting. Human-in-the-loop controls further enable researchers to actively guide AI behaviour, ensuring outputs remain aligned with project-specific objectives and ethical standards.

This combination of curated data, rigorous training, ongoing updates, and human oversight allows MMR to deliver AI-powered insights that are accurate, domain-specific and tailored to our clients’ needs.

7. What are the processes to verify and validate the output for accuracy, and are they documented? How do you measure and assess validity? Is there a process to identify and handle cases where the system yields unreliable, skewed or biased results? Do you use any specific techniques to fine-tune the output? How do you ensure that the results generated are ‘fit for purpose’?

MMR employs a comprehensive quality assurance framework combining real-time and offline review processes to verify AI outputs. Outputs are evaluated using a blend of quantitative metrics (such as accuracy, precision, and recall) along with qualitative human review. Our training datasets are screened to reduce any potential bias. Human-in-the-loop oversight allows researchers to assess outputs before use.

We document all validation procedures and maintain audit trails for transparency and continuous improvement. Techniques such as fine-tuning models with domain-specific data and iterative feedback loops help tailor outputs to be accurate and relevant to the needs of each project.

Ultimately, outputs are cross-checked with expert human insight and project requirements to confirm they are fit for purpose before being used in reporting or recommendation development.

8. What are the limitations of your AI models and how do you mitigate them?

While our AI models significantly enhance our research capabilities, they have inherent limitations. These include potential biases in training data, sensitivity to outdated or unrepresentative data, and occasional errors in understanding nuanced context. To mitigate these, we implement human-in-the-loop controls to oversee and guide AI outputs, conduct regular dataset updates, and perform ongoing quality assurance reviews. We maintain transparency about these limitations and provide sufficient technical information to enable informed assessment of AI-generated results.

We also emphasise that AI is a tool to augment – not replace – human judgment, ensuring that final decisions incorporate expert insight and contextual understanding.

9. What considerations, if any, have you taken into account, to design your service with a duty of care to humans in mind?

At MMR, our AI solutions are designed with a strong duty of care, grounded in core ethical principles, including fairness, transparency, accountability, privacy, and safety. This is made possible through the following mechanisms:

• Human-in-the-loop controls are embedded at every stage to guide AI behaviour, preventing inappropriate or intrusive probing and ensuring output remains relevant and respectful.

• We encourage and promote ongoing training and dialogue across all teams in the business to foster ethical awareness and responsibility.

• Quality assurance systems (both real-time and offline) continuously monitor AI outputs to detect and mitigate any unintended harm or ethical concerns.

• We actively involve diverse stakeholders in refining our ethical frameworks to ensure cultural sensitivity and inclusivity, helping us anticipate and address potential biases or harms before deployment.

10. Transparency: How do you ensure that it is clear when AI technologies are being used in any part of the service?

Transparency is a cornerstone of MMR’s AI governance. We clearly communicate the use of AI technologies to all relevant parties, including clients, researchers, and participants. This includes explicitly flagging AI-generated images, text, or insights wherever they appear in reports or interactions.

We maintain openness about the ethical principles guiding our AI solutions and regularly engage stakeholders to review and refine these principles. Our transparency extends to decision-making processes involving AI, ensuring that users understand how and why AI contributes to research outcomes.

To make transparency accessible, we provide clear, non-technical disclosures and maintain documentation that explains AI use and limitations. We also update these communications proactively as AI tools evolve, ensuring ongoing clarity throughout the AI lifecycle.

Regular audits and reviews further reinforce transparency by verifying that AI systems operate as intended and adhere to ethical standards.

11. Do you have ethical principles explicitly defined for your AI-driven solution, and how in practice does that help to determine the AI’s behaviour? How do you ensure that human-defined ethical principles are the governing force behind AI-driven solutions?

Yes, MMR has explicitly defined ethical principles: fairness, transparency, accountability, privacy, and safety: These principles guide every AI-driven solution we develop and deploy and are operationalised through a combination of technical and procedural controls.

For example, training environments are set up to ensure relevant data partitioning and security, while human-in-the-loop controls ensures that researchers can steer AI behaviour to align with research objectives and ethical standards, together promoting transparency, privacy, and safety.

12. Responsible Innovation: How does your AI solution integrate human oversight to ensure ethical compliance?

MMR integrates human oversight into AI solutions through multiple layers of control and governance:

• Human-in-the-loop mechanisms empower researchers to actively guide AI probing and outputs, aligning these with research objectives and ethical standards.

• Human-guided data curation and human-engineered ontologies ground our AI models in domain-specific knowledge relevant to market research.

• Participatory design promotes cultural sensitivity, inclusivity, and respect for diverse perspectives.

The AI Governance Team, supported by a dedicated compliance officer, oversees these processes and maintains a feedback loop that incorporates user and stakeholder input to continuously refine AI behaviour and uphold ethical compliance.

13. Data quality: How do you assess if the training data used for AI models is accurate, complete, and relevant to the research objectives in the interests of reliable results and as required by some data privacy laws?

At MMR, ensuring the quality of training data is fundamental to delivering reliable AI-driven insights aligned with research objectives. We assess data quality through a combination of automated and manual processes:

• Screening and validation: Training datasets undergo rigorous screening for accuracy, completeness, and relevance to the specific research context

• Benchmarking and model evaluation: We benchmark AI model performance on internal test sets and conduct model-based evaluations to ensure it is fit for purpose and to identify potential data-related issues affecting output quality.

• Regular updates and monitoring: Training datasets are regularly refreshed and reviewed to maintain relevance, completeness, and accuracy, and to prevent model drift.

• Data privacy compliance: All data used for training complies with GDPR and other applicable data privacy laws. Consent is verified, and data handling procedures protect participant privacy throughout the data lifecycle.

Our AI Governance Team oversees these processes, ensuring data quality aligns with both ethical standards and research goals.

14. Data lineage: Do you document the origin and processing of training or input data, and are these sources made available?

Yes, MMR maintains comprehensive documentation of the origin, processing, and transformation of all training and input data used in our AI models. This includes detailed metadata such as data source, collection date, preprocessing steps, and version history.

This documentation enables us to verify that data is ethically sourced and processed responsibly, reinforcing trust in the integrity of our AI-driven insights.

While sensitive data details are protected to maintain confidentiality, aggregated lineage information is available to relevant stakeholders and auditors upon request.

15. Please provide the link to your privacy notice (sometimes referred to as a privacy policy). If your company uses different privacy notices for different products or services, please provide an example relevant to the products or services covered in your response to this question.

MMR is fully committed to protecting the privacy of participants and clients in accordance with GDPR and other global data protection regulations. We collect personal data only with informed consent and handle it with the highest security standards, encrypting data both in transit and at rest, and storing it securely with strict access controls.

Our privacy notice, available on our website (link), explains in detail how personal data is collected, processed, stored, and managed. At the project level, we collaborate closely with our vetted data collection partners to provide clear guidance to participants on how they can exercise their data rights, including requests for access, correction, or deletion of their personal information.

Throughout all processes, MMR treats personal data as strictly confidential and ensures it is processed in full compliance with applicable data protection laws.

16. What steps do you take to comply with data protection laws and implement measures to protect the privacy of research participants? Have you evaluated any risks to the individual as required by privacy legislation and ensured you have obtained consent for data processing where necessary or have another legal basis?

MMR rigorously complies with data protection laws, including GDPR and other applicable global regulations. We obtain informed consent from all research participants and collect personal data solely for clearly defined research purposes.

To safeguard privacy, we implement robust technical and organizational measures: data is encrypted both in transit and at rest, access is strictly controlled, and personal information is consistently treated as confidential. We adhere to data minimization principles, collecting only the data necessary for research, and apply anonymization or pseudonymization wherever possible to further reduce privacy risks. Importantly, personal data – including voice and video recordings – is never used for AI model training.

We conduct Data Protection Impact Assessments (DPIAs) to proactively identify and mitigate privacy risks, ensuring full compliance with relevant laws. Additionally, ongoing monitoring and periodic reviews of our privacy and security practices support continuous compliance and improvement.

17. What steps do you follow to ensure AI systems are resilient to adversarial attacks, noise and other potential disruptions? Which information security frameworks and standards do you use?

MMR’s AI systems are protected by a multi-layered security framework aligned with leading standards. We deploy technical controls including firewalls, intrusion detection and prevention systems, regular vulnerability scanning, and encryption to safeguard data and systems from cyber threats.

Security protocols are regularly reviewed and updated, with comprehensive staff training to maintain awareness and compliance. Security audits are performed at scheduled intervals to assess effectiveness and incorporate lessons learned into our ongoing security strategy.

18. Data ownership: Do you clearly define and communicate the ownership of data, including intellectual property rights and usage permissions?

Yes, data ownership, intellectual property rights, and usage permissions are contractually agreed either within the proposal or client agreement.

All terms regarding data use, sharing, and retention are transparently outlined in contracts, terms (available on our website link), and project deliverables.

19. Data sovereignty: Do you restrict what can be done with the data?

MMR is committed to respecting data sovereignty by strictly adhering to data owners’ preferences and all relevant legal requirements concerning data processing and storage. We enforce data residency through both technical controls and contractual agreements, ensuring that data is stored within specified locations, as required.

As detailed in our privacy notice (available on our website), MMR may use information and data derived from client projects for purposes such as industry analysis, benchmarking, and analytics to enhance our services and solutions. Importantly, any such derived data, which is processed and cannot be linked to any individual client, excludes all sensitive or proprietary information and is fully anonymized, securely stored, and never shared with other clients. MMR retains all rights to such non-identifiable data. We do not use client data for training any publicly accessible AI models or platforms.

Clients retain full control over their data preferences and can specify or update their choices regarding data handling at any time. This includes the ability to opt out of the use of their data for analytics or benchmarking at the project level.

20. Ownership: Are you clear about who owns the output?

We provide explicit clarity on the ownership of AI-generated outputs, including intellectual property rights, in all written client agreements and related project documentation. Where relevant, MMR would communicate any restrictions on the use of outputs, particularly for commercial purposes.

All contractors and suppliers are required to sign NDAs, privacy, and data protection agreements to safeguard client interests.

For additional details on data use and ownership, please refer to our response to Question 19.