DOJ to Evaluate AI Use in Corporate Compliance Programs

Prosecutors to Consider Companies' Use of AI When Assessing Compliance Programs | PYMNTS.com

Companies' use of artificial intelligence (AI) is one of the things prosecutors will look at when assessing their compliance programs during investigations of criminal offenses like bribery or fraud. Nicole Argentieri, principal deputy assistant attorney general for the criminal division of the Department of Justice (DOJ), said this on Monday (Sept. 23) while outlining changes to the DOJ's Evaluation of Corporate Compliance Programs (ECCP), the Wall Street Journal (WSJ) reported Tuesday (Sept. 24). This DOJ guidance is important to lawyers and compliance officers because compliance programs that adhere to its guidelines are eligible for more lenient treatment when a compliance breakdown occurs, according to the report. In prepared remarks for a speech delivered Monday, Argentieri said that under the updated ECCP, prosecutors will consider AI and other technology a company uses to conduct business, whether the company has conducted a risk assessment of the use of that technology, and whether it has taken steps to mitigate that risk. "For example, prosecutors will consider whether the company is vulnerable to criminal schemes enabled by new technology, such as false approvals and documentation generated by AI," Argentieri said. "If so, we will consider whether compliance controls and tools are in place to identify and mitigate those risks, such as tools to confirm the accuracy or reliability of data used in the business. We also want to know whether the company is monitoring and testing its technology to evaluate if it is functioning as intended and consistent with the company's code of conduct." In the second of three major changes to the ECCP outlined in her speech, Argentieri said prosecutors will consider companies' commitment to whistleblower protection and treatment of employees who report misconduct. The third update outlined in the speech covers a compliance program's access to data and technology, and whether the company is putting the same resources into compliance as it puts into other parts of the business. The ECCP was first issued in 2017 to lay out a series of factors for prosecutors to consider when assessing the effectiveness of corporate compliance programs as part of making charging decisions and negotiating resolutions.

If your AI does the crime, you'll do the time: DoJ

If juggling the extreme cost and hazy ROI of AI weren't enough of a headache, the United States Department of Justice (DoJ) now expects enterprise compliance officers to start weighing the tech's potential for harm - or risk stiff fines if it breaks the law. Nicole Argentieri, the principal deputy assistant attorney general for the DoJ's criminal division, discussed the changes made to the Evaluation of Corporate Compliance Program (ECCP) guidelines [PDF] in an address to the Society of Corporate Compliance and Ethics earlier this week. The guidelines detail how DoJ prosecutors should approach criminal investigations and evaluate service providers' effectiveness at preventing criminal behavior. As such, the ECCP effectively functions as a guide for compliance officers looking to avoid the DoJ's ire. After a pilot program, these rules have officially been extended to include the use of AI. The tech is are increasingly being deployed by businesses and could therefore conceivably be used to make decisions or facilitate actions that are less than legal. The ECCP guidelines include a list of questions the DoJ thinks compliance officers should ask themselves about the use of AI systems because those are exactly the questions prosecutors will be asking in the event of an investigation. Examples include: You can find the full list of AI-related compliance questions on page four of the ECCP document here. According to Argentieri, per a transcript, "prosecutors will consider whether the company is vulnerable to criminal schemes enabled by new technology such as false approvals and documentation generated by AI. If so, we will consider whether compliance controls and tools are in place to identify and mitigate those risks." Additionally, the DoJ will take into consideration whether the company is actively monitoring and testing AI applications to ensure they're functioning as intended. In other words, it doesn't matter whether it's the AI that broke the law - the company will be held accountable. Executives should therefore take steps to identify and address these risks before the DoJ comes knocking. "Because we prosecute corporate crime, we ask not just what happened, but why it happened and what the company has done to prevent misconduct from recurring," Argentieri explained, adding: "We expect corporations to continuously review and update their compliance programs to account for emerging risk factors." In addition to guidelines governing AI compliance, the ECCP updates also include guidance related to whistleblowers under a program designed to incentivize workers to report illegal activities. ®