The United States Department of Justice (DOJ) has unveiled a significant update to its Evaluation of Corporate Compliance Programs (ECCP), underscoring the evolving challenges and opportunities posed by new technologies like artificial intelligence (AI). On 23rd September 2024, the announcement was made at the Society of Corporate Compliance and Ethics' Annual Compliance & Ethics Institute, where the Principal Deputy Assistant Attorney General, Nicole Argentieri, articulated the details before an engaged audience.

The revised ECCP, a critical framework for assessing corporate compliance efforts, remains a crucial tool for prosecutors when determining decisions related to criminal investigations, potential charges, and the resolution of corporate misconduct cases. Introduced initially in 2017 and revised several times since, the guidance has now included new directives that reflect the changing technological and ethical landscape facing corporations today.

Argentieri, speaking at the event, emphasized the onus on companies to proactively enhance their compliance programs to better detect, prevent, and address misconduct. She stated, "Now is the time to make the necessary compliance investments," highlighting the DOJ's strategic focus on contemporary compliance challenges.

The key enhancements in the updated ECCP focus predominantly on three areas: the risks associated with emerging technologies like AI, the protection and incentivisation of whistleblowers, and the adequacy of access to data for compliance purposes.

Emerging Technologies and AI

In recognising the dual nature of AI and related technologies as both a remedy and a potential risk, the DOJ's revised guidelines encourage companies to scrutinise the usage of these technologies within their operations. Prosecutors are now advised to assess several aspects of a company's technology management, including:

  • How companies evaluate the implications of new technologies on their legal compliance capabilities.
  • The existence and efficacy of controls that ensure technologies are used as intended.
  • The integration of AI-related risk management into broader enterprise risk management frameworks.
  • Governance structures that supervise technology use.

Companies employing AI in compliance roles are expected to ensure the technology’s trustworthiness and legality, involve human oversight in AI decision-making processes, and enforce accountability.

Whistleblower Incentives and Protection

The ECCP revision further accentuates the DOJ's stance on the importance of protecting whistleblowers. Companies are encouraged to:

  • Foster an environment where employees feel encouraged to report misconduct.
  • Establish firm anti-retaliation policies and ensure comprehensive training regarding these policies and related external laws.
  • Treat whistleblowers equitably in disciplinary processes compared with those who did not report misconduct.

Access to Data

A significant part of the updated compliance guidelines also pertains to the availability and management of data. The updated ECCP urges corporations to ensure that compliance personnel can access data sources promptly and that such data is leveraged effectively for compliance functions. Furthermore, it advises firms to maintain the quality and accuracy of data analytics tools and to assess the balance of technological resources allocated to compliance versus other business areas.

The announcement and subsequent discourse shed light on the DOJ's expectations regarding corporate responsibility in the digital age. By highlighting emerging technologies, whistleblower protection, and access to resources, the revised ECCP aims to guide companies in refining their compliance strategies to align with contemporary legal expectations.

Source: Noah Wire Services