ISO 20252, ESOMAR and Synthetic Panels: What Applies

Enterprise · 11 min read

TL;DR: Buyers ask whether synthetic research is ESOMAR compliant, and the question has no yes or no answer, because compliance attaches to an organisation and not to a dataset. The ICC/ESOMAR International Code binds whoever runs the study. ISO 20252:2026, the current edition of the research service standard, is certified against a scope of services the provider declares, so a certificate held by your agency says nothing about whether the respondents existed. Removing people removes the consent duties and makes the disclosure duties heavier. What a standards reviewer asks for is a method statement, not a logo. Write the six lines before anyone asks for them.

Is synthetic research ESOMAR compliant?

Compliance belongs to the organisation running the study, not to the data it produces. The ICC/ESOMAR International Code binds members to honesty about method, to not misleading the client or the public, and to protecting data subjects. A synthetic panel has no data subjects, so the first two duties carry the whole weight instead of sharing it.

The ICC/ESOMAR International Code is the global code of practice for market, opinion and social research. National associations adopt it, and members agree to it as a condition of membership.¹

Read it as three duties. Be honest about method. Do not mislead anyone about what the evidence is. Protect the people whose data you process.

A census-grounded synthetic panel removes the third duty by construction, because no person is recruited and no personal data is processed. That is the part vendors talk about. The first two duties do not move, and with the third gone they are the whole test.

ESOMAR has already pointed buyers at the same place. Its published discussion topics for buyers of augmented synthetic data are questions about provenance, method and disclosure rather than a certification scheme.²

So the honest answer is that a synthetic study can be run compliantly or not, depending on what you record and what you claim. The method decides nothing on its own.

Does an ISO 20252 certificate cover a synthetic panel?

Not by itself. ISO 20252 sets service requirements for research providers, and certification audits the documented processes inside a scope the provider declares. A certificate tells you the provider operates those processes. It does not tell you that a given study used human respondents. Ask for the scope statement rather than the logo.

The current edition is ISO 20252:2026, covering market, opinion and social research including insights and data analytics.³ CIRQ, the certification body run by the Insights Association, welcomed the revised standard this year.⁴ In the UK, MRS maintains its own quality standards route alongside it.⁵

Certification works the way service certification always works. A provider defines which services it is certified for, an auditor checks the processes behind those services, and the certificate names that scope.

Two things follow. A certificate held by your agency does not reach work outside the declared scope. And nothing in a certificate speaks to whether the responses came from people, because that is a fact about one study rather than about a process.

This is where procurement conversations go wrong. The buyer asks whether the vendor is certified, the vendor answers a slightly different question, and nobody writes down the scope. Ask for the certificate, read the scope line, then ask separately how synthetic work is documented.

Which code duties disappear when there are no respondents?

Three of them. Consent, data subject rights and the duty of care owed to participants are never triggered, because no person answers. Four duties get heavier in exchange: transparency about method, not misleading the audience, keeping records an auditor can follow, and fitness for the specific purpose. The trade is real and it is not a discount.

A code written for human fieldwork does not fall silent when the respondents are simulated. It redistributes.

The duties that attach to a person fall away cleanly, which is the argument set out in why synthetic personas remove the GDPR trigger. The duties that attach to the claim get harder, because synthetic output arrives already formatted like survey data.

The table maps the trade. The right-hand column is what a reviewer will actually ask you to produce.

What does the published evidence say about replacing respondents?

Two independent institutions published on it in 2026 and landed in the same place. Pew Research Center tested whether AI can stand in for human survey takers and published the answer as not really. NORC argues that human data remain essential in the age of synthetic respondents. Design the study around that.

These two matter more in a standards conversation than any vendor benchmark, because they are what a sceptical reviewer reaches for first.

Pew Research Center published a test of silicon sampling, the practice of generating survey answers from a model instead of a person, and stated the conclusion in the title.⁶ NORC at the University of Chicago published its position that human data remain essential alongside synthetic respondents.⁷

Neither says do not use a synthetic panel. Both say do not file its output in place of a measurement, which is the same line drawn in where synthetic data stops in a claims file.

PersonaHive takes the same position in its own material. Personas are grounded in national census data for each country covered, built from aggregated public statistics, and validated against real surveys, with the validation benchmark published so a reviewer can read the comparison rather than accept a number. A vendor that answers a standards question with a single accuracy figure and no published benchmark is answering the wrong question.

How do you document a synthetic study for a standards review?

Six lines, written while you run it rather than when someone asks. The grounding source and country, the model and version, the run settings and sample size, the instrument as fielded, whether each figure is a rank or a level, and the validation status of anything quoted as a level.

1. Grounding source and country. Name the statistical basis and the market. A panel built from one country's census is not evidence about a different country.

2. Model and version. Named models change behaviour between releases, so the version is part of the method rather than a footnote.

3. Run settings and sample size. Record them even though the sample size was yours to choose. On PersonaHive a survey question costs one credit per persona, so the number in that field reflects a decision, not a budget ceiling.

4. The instrument as fielded. Keep the questionnaire and the prompts in the form they ran, not as summarised afterwards.

5. Rank or level, marked on every figure. A rank order survives a methods review on its own. A percentage does not.

6. Validation status. For anything quoted as a level, record whether human respondents stand behind it and from which study.

That list is the audit trail, and it is the same list that makes a run repeatable, set out in the six fields to record for a reproducible synthetic run.

The smallest useful next step is to write those six lines for the last synthetic study your team ran. It takes ten minutes, and it tells you straight away whether that study would survive a client's standards review.

When should the work stay with a certified human provider?

Four cases. Anything that will enter an advertising claims file, anything your client contract defines as in-scope certified work, regulated sectors carrying a standing audit duty, and any figure published as a statistic about a population. In those cases the certificate is part of the deliverable, and no synthetic panel can produce one.

The first case is the hard boundary. A claims file is a record of people being asked, and a certified provider is often what makes that record admissible to a regulator.

The second is contractual rather than scientific. Large buyers write ISO 20252 scope into the master agreement. If your contract does that, the question is not whether synthetic work is sound, it is whether the contract allows it, and that is a conversation to have before the study rather than after.

The third is sectoral. Pharmaceutical, financial and public sector buyers often carry audit duties that assume a human chain of custody, on top of the duties covered in what the EU AI Act actually reaches.

The fourth is publication. A number released as a statistic about a population is read as a measurement, whatever the footnote says. Keep those with people.

Everywhere else, the certified provider and the synthetic panel are not competing. The panel sharpens the instrument, and the certified study measures what the sharpened instrument asks.

Frequently asked questions about research standards and synthetic panels

Short answers to five questions that come up when a synthetic study meets a research code: whether any vendor can be certified for this, how to describe the method in a deck, whether the ICC/ESOMAR Code bans synthetic data, whether an agency certificate stretches to cover it, and what removing personal data really saves.

**Is any synthetic research platform ISO 20252 certified?** Ask each vendor for the certificate and read the scope it names. A certificate covers declared services, so the useful question is which services, not whether a logo exists. PersonaHive asks to be judged on its grounding source, country coverage and published validation benchmark instead.

**Can I call a synthetic study market research in a client deck?** Describe it accurately and the label stops mattering. Name the method in the same sentence as the finding, every time the finding appears. The code duty is about not misleading, not about vocabulary.

**Does the ICC/ESOMAR Code ban synthetic data?** No. It governs conduct, and its disclosure duties apply to whatever method you use.¹ ESOMAR's buyer material treats synthetic data as something to interrogate rather than something to prohibit.²

**Our agency holds ISO 20252. Can they run the synthetic work under that certificate?** Only if the declared scope covers it. Ask to see the scope statement, and if it does not cover the work, ask how the study will be documented instead.

**We removed personal data, so is there less compliance work?** Less privacy work and more disclosure work. The duties under the MRS Code and the ICC/ESOMAR Code that survive are the ones about method transparency and record keeping, and those get heavier when nothing is externally verifiable.⁸

Sources

• ICC/ESOMAR International Code on Market, Opinion and Social Research and Data Analytics — International Chamber of Commerce and ESOMAR
• 5 Topics of Discussion to Help Buyers of Augmented Synthetic Data — ESOMAR
• ISO 20252:2026 Market, opinion and social research, including insights and data analytics, vocabulary and service requirements — International Organization for Standardization
• CIRQ Welcomes Newly Revised ISO 20252:2026 Standard for Market, Opinion and Social Research — Insights Association
• Quality standards, ISO 20252 — Market Research Society
• Silicon Samples and Synthetic Surveys: Can AI Stand In for Human Respondents? — Pew Research Center
• Human Data Remain Essential in the Age of Synthetic Respondents — NORC at the University of Chicago
• MRS Code of Conduct — Market Research Society