Under US regulations known as the “Common Rule,” federally-supported human-subject research must be reviewed by an Institutional Review Board (IRB). The Common Rule system from a distance looks like an innovative instantiation of prescriptions for constitutive regulation and soft law, but in practice has grown into a self-referential, unresponsive, and legalistic bureaucracy. This article reviews criticism of the Common Rule. It also discusses why the system fails to regulate in an efficient and effective way, pointing in particular to the poor fit between the IRB and its assigned tasks. Turning to reforms, the article uses the heuristic of “regulatory space” to describe the range of actual and potential regulators with the capacity to set standards, monitor compliance, and discipline violators. Regulatory reform is framed by three conceptual changes: recognizing the limitations of the IRB as an oversight body; narrowing the range of risks the system is tasked to control; and disentangling the conflicting regulatory logics of behavioral standard-setting and virtue promotion. The article concludes with a roster of possible changes that would make the IRB a more responsive regulator, enroll a wider range of actors in the promotion of virtue, focus resources on more serious risks, and address the structural causes of researcher misconduct.