DOJ emphasizes importance of AI risk mitigation, whistleblower protections, and clawback compensation policies

Last Monday, the Department of Justice (the DOJ or the Department) announced significant updates to the DOJ Criminal Division’s Evaluation of Corporate Compliance Programs (ECCP).¹ These updates discuss, for the first time, the importance of mitigating specific risks associated with the use of artificial intelligence (AI). The updates also reiterate the Department’s focus on whistleblower protections and clawback compensation policies.

The ECCP now contains extensive guidance about the importance of understanding and managing risks associated with companies’ use of new technologies, with an emphasis on AI risks. Earlier this year, Deputy Attorney General Lisa Monaco previewed these changes, warning companies that prosecutors would “seek stiffer sentences for offenses made significantly more dangerous by the misuse of AI.” When announcing the changes, Nicole Argentieri, the head of the DOJ’s Criminal Division, explained that “prosecutors will consider the technology that a company and its employees use to conduct business, whether the company has conducted a risk assessment of the use of that technology, and whether the company has taken appropriate steps to mitigate any risk associated with the use of that technology.” (Emphasis added). They will also ask “whether the company is monitoring and testing its technology to evaluate if it is functioning as intended and consistent with the company’s code of conduct.”

This development is in line with the government’s broader approach to ensure that emerging technologies, including AI, are managed responsibly. It also dovetails with other ECCP updates emphasizing that compliance personnel’s access to data is key to implementing an effective compliance program. As explained by Argentieri, the ECCP was revised to add questions regarding “whether compliance personnel have adequate access to relevant data sources and the assets, resources, and technology that are available to compliance and risk management personnel.” As part of this assessment, prosecutors will “consider whether companies are putting the same resources and technology into gathering and leveraging data for compliance purposes that they are using in their business.”

While the newly added section on mitigating risks associated with (the responsible use of) AI and other technologies in the ECCP might grab the most headlines, it’s not the only important update. Argentieri took this opportunity to underscore the DOJ’s existing priorities. Argentieri highlighted the recent announcement of a Corporate Whistleblower Awards Pilot Program and noted that the “ECCP now includes questions designed to evaluate whether companies are encouraging employees to speak up and report misconduct or whether companies employ practices that chill reporting.” The whistleblower program offers financial incentives to encourage whistleblowers to report corporate wrongdoing to the DOJ. Further, as noted by Argentieri, “making an internal report before coming forward to the [D]epartment is a factor that will increase the amount of a potential whistleblower award.” In the program’s first month, the DOJ received 100 reports from whistleblowers.

Argentieri also noted developments related to the Pilot Program Regarding Compensation Incentives and Clawbacks launched in March 2023. The clawback pilot program requires companies to align compensation to ethical practices and to include compliance-related criteria as performance indicators in determining executives’ compensation. So far, prosecutors have required nine companies to make these adjustments as a part of resolutions of criminal investigations and have provided credit against statutory penalties when companies reduce executive compensation due to poor compliance-related behavior. “From our whistleblower and clawback pilot programs to our updated ECCP, we are using more tools than ever before to identify corporate misconduct and to encourage companies to be good corporate citizens,” said Argentieri.

* * *

Argentieri’s final message to companies was clear: “Now is the time to make the necessary compliance investments to help prevent, detect, and remediate misconduct.”

Companies may want to take this opportunity to assess whether their compliance policies, procedures, and internal controls align with the ECCP (particularly these latest changes) and the DOJ’s priorities. Specifically, if they have not already done so, companies could consider:

1. conducting comprehensive risk assessments to identify risks associated with the company’s use of new technologies, including AI;
2. revising their policies and procedures to ensure ongoing monitoring of technology-related risks;
3. addressing identified technology-related risks and taking remedial action as appropriate;
4. comparing the company’s use of data against industry norms to determine whether their compliance department is effectively using data to bolster their compliance programs;
5. reviewing employee and vendor agreements to ensure that they do not contain provisions that could inhibit whistleblowing (and revising them if necessary); and
6. ensuring that the company’s code of conduct and other policies clearly set forth the company’s position on retaliation;
7. testing the effectiveness of the company’s reporting mechanisms;
8. ensuring executives’ employment agreements and other corporate incentive schemes link discretionary compensation to compliant behavior and clearly provide the company with the ability to claw back compensation if they violate applicable criminal or civil laws, regulations, or company compliance policies

__________

^{1 The ECCP is the corporate compliance handbook prosecutors use to assess the effectiveness of a corporation’s compliance program during criminal investigations.}

[View source.]