DoJ Updates Corporate Compliance Guidelines: Emphasis on AI, Whistleblowers, and Data Analytics
Washington, D.C., September 23, 2024 — The U.S. Department of Justice's (DOJ) Criminal Division has announced significant updates to its Evaluation of Corporate Compliance Programs (ECCP) guidance. These updates, reflecting advancements in technology and evolving risk landscapes, place a notable focus on emerging technology, particularly artificial intelligence (AI), whistleblower protections, and the use of data analytics.
Overview of ECCP
The ECCP serves as a key resource for DOJ prosecutors assessing corporate compliance programs in the context of criminal investigations. The guidance does not employ a rigid formula but instead poses "common questions" that prosecutors may ask to determine the effectiveness of a company’s compliance initiative. These questions fall into three broad categories:
- Design: Is the compliance program well-designed?
- Application: Is the program earnestly applied and resourced to function effectively?
- Effectiveness: Does the program work in practice?
Since its inception in 2017, the ECCP has undergone several revisions to incorporate emerging focus areas for the Criminal Division, which leads the DOJ’s corporate criminal enforcement efforts.
Key 2024 Updates
The latest iteration introduces several pivotal updates:
Emerging Technology: Reflecting the rapid adoption of artificial intelligence and other new technologies across various sectors, the ECCP now urges companies to evaluate potential risks associated with these innovations. Companies are expected to establish governance structures for the use of AI, set up controls to ensure these technologies are used as intended, and mitigate any adverse impacts. DOJ prosecutors will scrutinize whether companies have conducted risk assessments related to AI and the measures taken to address identified risks.
A series of questions guide this scrutiny, including:
- What governance structures has the company established for AI usage?
- What controls are in place to ensure technology is used appropriately?
- How is the company training its employees on AI applications?
Nicole Argentieri, head of the DOJ's Criminal Division, highlighted the importance of such measures by citing potential risks such as AI-generated false approvals and documentation.
Whistleblower Protections: Emphasising the significance of whistleblowing in uncovering misconduct, the updated ECCP requires companies to both encourage and protect internal reporting. Prosecutors will examine a company's commitment to whistleblower protections through their treatment of employees who report misconduct, ensuring there are no practices that discourage such reporting.
Data Analytics: Acknowledging the growing role of data analytics in compliance, the ECCP now formally incorporates the use of data in program evaluations and third-party management. Prosecutors will assess whether companies use data analytics to scrutinise their compliance programs' effectiveness and manage third-party relationships effectively.
Implications for Corporate Compliance
The revisions underscore the necessity for companies to proactively manage new and evolving risks through comprehensive compliance programs. Investing in robust AI governance, bolstering whistleblower protections, and leveraging data analytics will be critical areas under DOJ scrutiny. According to Argentieri, companies must make timely and appropriate investments in their compliance infrastructure to preemptively identify, prevent, and address misconduct.
The DOJ’s latest updates to the ECCP are comprehensive, reflecting a nuanced understanding of contemporary compliance challenges. Companies are thus encouraged to regularly review and enhance their compliance programs to align with these updated guidelines, ensuring they remain well-prepared for any DOJ evaluations.
Source: Noah Wire Services