Artificial intelligence (AI) has become both a tool of innovation and a potential liability for companies. Improper or negligent deployment of AI can open doors to severe legal, financial, and reputational damage. As companies embrace AI to streamline operations and improve decision-making, the U.S. Department of Justice (DOJ) and other regulatory bodies are heightening scrutiny of corporate compliance programs to ensure AI is used responsibly.
In September, the DOJ announced updates to its “Evaluation of Corporate Compliance Programs” (ECCP), a critical guide for prosecutors assessing a company’s compliance effectiveness. These updates focus on three main areas: emerging technologies like AI, whistleblower protections, and data access, including third-party vendor data. Notably, this revision highlights AI risks, indicating that the DOJ views AI as both a powerful tool and a source of vulnerabilities requiring stringent oversight.
DOJ’s Emphasis on AI and Emerging Technologies
Nine days following the ECCP updates, Principal Deputy Assistant Attorney General Nicole Argentieri spoke on AI’s “promises and perils,” reflecting its priority within the Criminal Division and the DOJ at large. Argentieri underscored the need for companies to assess AI’s risks, especially those involving potential bias and discrimination, and announced that the DOJ would revise its 2017 vulnerability disclosure framework. The update aims to encourage AI-related issue reporting, aligning with the Computer Fraud and Abuse Act and intellectual property laws.
The DOJ’s focus on AI is not isolated. Earlier this year, Attorney General Merrick Garland introduced the department’s first Chief AI Officer, signaling a structured approach to AI governance. Alongside, Deputy Attorney General Lisa Monaco launched “Justice AI,” a collaboration among industry, academia, and civil society to examine AI’s impact on justice and ethics. This initiative brings together corporate compliance experts to offer insights into AI’s risks, guiding the DOJ in refining the ECCP to address the nuanced challenges AI introduces to compliance.
New ECCP Guidelines: Questions Every Corporation Must Answer
The latest ECCP revisions direct prosecutors to pose critical questions on a corporation’s use of AI and emerging technologies to determine whether its compliance program is effective and well-designed. The guidance is comprehensive, covering risk assessment, governance, and accountability frameworks for AI within commercial operations and compliance programs. Key questions include:
- Risk Management: Has the company conducted a risk assessment for its AI systems? How does it manage and mitigate potential compliance risks associated with AI?
- Integration with ERM: Is AI risk management integrated into the company’s broader enterprise risk management (ERM) framework?
- Governance Structure: What is the company’s approach to governance regarding the deployment of new technologies, particularly AI?
- Transparency and Accountability: Does the company ensure that AI is used solely for its intended purposes, and how is human oversight applied to AI-based decisions?
- Policy and Training Updates: Are employees trained on responsible AI use? How frequently are policies reviewed to adapt to evolving legal and regulatory landscapes?
These questions reflect the DOJ’s broader objective: ensuring that companies have not only assessed AI risks but also embedded comprehensive controls to safeguard against unintended consequences and misuse.
Learn more about Future Jobs & Manager Programs: DELTA Data Protection & Compliance Academy & Consulting
The Legal and Financial Fallout of AI Mismanagement
The repercussions of AI missteps are tangible. Misuse of AI—such as creating false approvals or deceptive documentation—can have significant consequences. DOJ leadership has warned that misconduct amplified by AI misuse could lead to harsher sentences. Deputy Attorney General Monaco also suggested that if current sentencing guidelines prove insufficient to capture AI-related harms, the DOJ will push for legislative reforms to strengthen accountability.
The DOJ’s enforcement on AI misuse has already led to legal action. Recently, the U.S. Attorney’s Office for the Southern District of New York secured a guilty plea from a former CEO and board chairman of a digital advertising tech company. The executive admitted to securities fraud, having misrepresented the efficacy of the company’s AI-driven fraud detection tool. This scheme involved creating fake documents to deceive auditors, and sentencing is scheduled for December 2024.
Expanding Regulatory Oversight Beyond Federal Action
The scrutiny of AI misuse isn’t limited to federal authorities. State-level actions emphasize the need for responsible AI practices across various sectors. In Texas, the attorney general reached a voluntary compliance settlement with an AI healthcare company, while in California, the attorney general issued warnings to social media and AI companies regarding AI’s role in generating deceptive election content. The Securities and Exchange Commission (SEC) has also issued charges against investment advisers accused of “AI washing”—falsely advertising AI capabilities to attract clients.
These actions underline that regulatory bodies at all levels are attuned to the risks AI presents, compelling companies to conduct rigorous due diligence on their AI systems and providers. With growing state and federal vigilance, the necessity of careful, ethical AI implementation has become clear.
Building a Resilient, Responsible AI Framework: Best Practices for Companies
As AI continues reshaping business landscapes, companies must establish robust frameworks for AI governance to mitigate legal and reputational risks. Effective practices include:
- Comprehensive AI Risk Assessments: Regular evaluations of AI systems to identify potential biases, vulnerabilities, and compliance risks.
- Ongoing Monitoring and Accountability: Clear accountability mechanisms, ensuring AI use aligns with company policies and legal standards.
- Cross-Functional Training Programs: Equipping employees with knowledge on ethical AI use and the legal implications of AI.
- Transparent Reporting Mechanisms: Encouraging disclosure of AI-related vulnerabilities and establishing secure reporting channels.
- Partnerships with Legal and Industry Experts: Collaborating with external AI and compliance experts to remain updated on best practices and evolving regulations.
Learn more about Future Jobs & Manager Programs: DELTA Data Protection & Compliance Academy & Consulting
Looking Ahead: AI and the Future of Corporate Compliance
As AI technology continues to evolve, so does its legal and regulatory landscape. The DOJ’s ECCP revisions mark a significant step in addressing AI’s dual role as both a transformative and potentially dangerous tool. Companies that proactively assess and manage AI risks will be better positioned to avoid costly legal pitfalls and maintain public trust.
In a world where AI is a staple of corporate operations, aligning compliance programs with regulatory expectations is no longer optional; it’s essential. Companies should view these DOJ updates not just as guidelines but as an invitation to create ethical, resilient AI governance structures that protect their interests and uphold public confidence. As the DOJ’s guidance and enforcement actions demonstrate, AI’s future in corporate America will be shaped by a blend of innovation, vigilance, and accountability.
DELTA Data Protection & Compliance, Inc. Academy & Consulting – The DELTA NEWS – Visit: delta-compliance.com
