Using AI
Inside the
E&C Function

Insights from Business Ethics Leadership Alliance (BELA) Organizations

Progress Over Perfection:

How Palo Alto Networks’ E&C team is putting AI to work

Insights from Catherine Razzano, Global Ethics and Compliance Leader, Palo Alto Networks

Building internal momentum to adopt AI inside sensitive legal workflows

Culture helps. According to Razzano, Palo Alto’s CEO set a clear expectation that every function would develop a real use case for AI. That mandate gave Legal and Compliance teams permission to experiment. She also challenges a common assumption: not everything handled by Legal and E&C is so sensitive that it precludes model-assisted workflows. With reasonable controls, many tasks are suitable for AI augmentation and will benefit from it.

Transforming investigations

Razzano describes a pragmatic start that favors momentum over theory (or, as she puts it, “progress over perfection”). In particular, her team uses enterprise tools including Google’s Gemini and NotebookLM to accelerate investigations. They load large, case-relevant data sets into a secure notebook environment—email, Slack, CRM records, purchase orders, and expenses, where privacy allows—then instruct the model on the allegation and ask it to surface the most relevant threads.

In effect, AI performs a first-level review that previously went to contractors or junior reviewers. Investigators then work from the model’s prioritized outputs.

The payoff is time. Just as important, prompt discipline is sharpening investigative scoping. By forcing the team to state precisely what they are looking for, the tool narrows the inquiry to the facts that matter and the evidence most likely to advance the case. Privilege questions remain on the radar, but Razzano’s preference is to move, learn, and manage risk rather than hold for perfection.

The team is also experimenting with auto-drafting investigation reports. The aim is not to publish model-written findings but to get from a blank page to a solid middle quickly, then have human reviewers tighten facts, reasoning, and tone. That shift compresses cycle time without relaxing quality control.

Where else is AI already delivering business value for Legal and E&C?

Razzano points to a simple but telling example. Outside counsel delivered a long memo on a regulatory issue. The business needed next-day, actionable steps. Instead of sending the memo back for a “plain English” rewrite, the team fed it into NotebookLM, asked the questions they would have asked counsel, and prompted the system for a checklist formatted the way their business partners prefer. Within 30 minutes, they had a usable plan that saved rework, outside spend, and a day of delay.

The result was closer to the business need than a revised memo would likely have been.

For Razzano, this illustrates three themes that resonate with boards and audit committees: efficiency, cost control, and better service to the business—all of which align directly with her team’s own operating principles. It is the kind of story that makes AI tangible for non-technical stakeholders.

How are you approaching employee engagement with AI tools?

Internally, the company is iterating a chatbot that does more than link to policies. Version 1 can answer “What is our gifts policy?” with a policy citation. Version 2 is designed to ask context questions (e.g., where a client dinner might be, whether the guest is a government customer or a commercial client), then guide the employee to the right rules while quietly capturing structured data about the interaction. The goal is a more conversational, consultative experience that raises engagement and generates operational signals E&C can use.

Guiding principles to operationalizing AI

Razzano points to a four-point outlook that provides a helpful and empowering context around how her team makes use of AI:

Start and learn. Use AI where it can safely shrink effort and clarify focus.

Human-in-the-loop. Reserve human judgment for findings, conclusions, and narrative.

Business orientation. Measure value by cycle time saved, dollars avoided, and whether outputs are truly usable by the business.

Data foundations. Treat isolated wins as steps toward an integrated, signals-driven program.

Where is this headed over the next 12 months?

Razzano expects continued expansion of AI-assisted investigations, wider use of model-drafted work products that humans finish, a more conversational internal chatbot, and steady progress on the data plumbing that enables risk indicators and dashboards. The predictive layer will take longer, but the groundwork is already underway.

For example, her team has already launched a data-utilization effort with three stages:

Map the data environment. Identify systems that house E&C-relevant data.

Define and prioritize key risk indicators. Tie them to core program pillars.

Build the plumbing. Over a one- to three-year roadmap, connect priority data into dashboards and analytics that progress from descriptive to predictive.

The north star is a data-driven program that flags risky transactions and patterns earlier, not a scattering of point solutions. Predictive capabilities sit at the far end of the roadmap, but the interim wins—visibility and faster decision support—matter now.

KEY TAKEAWAY

AI will not run the program.

It will let a lean E&C team cover more ground faster, with better alignment to the business. The mandate is to move with integrity and control while building the future state in parallel.

AI in E&C: From Literacy to Leverage

Insights from Samantha Vaughan, VP, Corporate Compliance Governance & Chief Privacy Officer, Verisk

Building literacy as a foundation

Vaughan emphasizes that effective, responsible, and ethical AI use starts with a strong literacy baseline. To that end, Verisk’s privacy and compliance teams completed a four-hour AI fluency course, which covered not only AI ethics, but also:

Large language model (LLM) mechanics
Determining AI needs and the appropriate AI role (such as AI acting as a process assistant, consultant, or full delegate)
Where AI excels and where it needs improvement
Overreliance risks

The training was practical, requiring participants to experiment with prompts, compare outputs across models, and apply lessons to real or hypothetical compliance tasks. This investment created a shared vocabulary across the team and helped normalize AI as a daily tool rather than a novelty.

Modernizing compliance communications

At Verisk, an immediate AI application has been used to support reimagining their Code of Conduct. The existing version is solely text-based, similar to traditional policies. The new design in development emphasizes clarity, visual elements, and practical examples. Rather than drafting manually from scratch, Vaughan and her team are using AI as a virtual consultant at various points in the process. An internal, licensed LLM helps supplement best-practice examples, organize themes, and accelerate the drafting process.

It doesn’t replace human authorship, but it reduces “blank-page work” and helps generate new angles for communicating core value expectations in practice.

Retrieval Augmented Generation (RAG) for training and enablement

One of the most valuable applications Vaughan identifies is Retrieval Augmented Generation (RAG). This approach allows compliance teams to point an LLM directly to internal documents (such as policies, codes of conduct, or guidance materials) and generate first drafts of training slides, blogs, or talking points. Within PowerPoint, for example, CoPilot can draw from corporate templates and designated policy documents to produce structured outlines and draft slides that practitioners can refine. While the AI output is not perfect, it offers an immediate and credible starting point that saves hours of manual drafting.

The key benefit is speed and efficiency, allowing compliance professionals to redirect time toward judgment, nuance, and stakeholder engagement.

Governance and the right tool for the task

Verisk’s responsible and ethical AI governance framework recognizes that “AI” is not a single technology.

DOWNLOAD

AI Governance Framework

Verisk maintains an ethical AI policy, plus distinct standards for generative AI and for algorithmic/predictive AI. Vaughan stresses that this distinction matters: predictive modeling, long used in insurance and other regulated industries, presents very different risks and oversight requirements than generative text. For compliance professionals, this underscores the importance of selecting the right tool for the task at hand and maintaining transparency about how models are being applied.

Vendor diligence as an ethical imperative

The growing reliance on external AI technology providers makes vendor diligence a core E&C responsibility. Vaughan cautions against treating vendor privacy assurances as sufficient overall diligence. Beyond whether personal data is used, compliance teams must insist on evidence of fairness testing, bias audits, and clear assessments of potential impacts on individuals, particularly in employment or HR contexts. Regulatory guidance (e.g., from the UK Information Commissioner’s Office) provides useful benchmarks, but responsibility rests with the adopting organization. Outsourcing does not relieve accountability.

Evolving capabilities and rising risks

The rapid progress of AI capabilities continues to surprise even seasoned observers. Where early tools were rudimentary and error-prone, today’s models can extract insights from even fragmentary materials, distilling meaning and generating useful questions or starting points. Yet the improvement also increases the risk of overconfidence: outputs may be polished and convincing, but still fundamentally flawed. Vaughan emphasizes the ongoing need for human-in-the-loop review to separate valuable insights from hidden errors or biases.

Upskilling as survival, not optional growth

Reflecting on her career, Vaughan notes that no prior technological wave—whether big data, the web, or modern productivity tools—demanded the same degree of mental transformation as AI. She believes professionals who fail to adopt AI will soon be outperformed by those who do, even at a basic level, and decisively outpaced by those who develop deeper mastery. The productivity advantage of tasks like generating first-draft presentations from policies is already visible. For E&C professionals, the lesson is clear: mastering AI is not an enhancement but a necessity for staying competitive.

The bigger picture for AI in E&C

Vaughan’s perspective highlights a pragmatic blueprint:

invest in literacy
leverage RAG to accelerate real work
separate governance across different AI modalities
demand rigorous vendor diligence
maintain human oversight at every step

Done thoughtfully, AI allows E&C teams to redirect time from drafting and formatting to designing stronger controls, sharper training, and faster, more informed outcomes.

Built-In, Not Bolt-On:

How Cargill’s E&C Team Is Putting AI to Work

Insights from Samantha McMacken, Senior Director, Ethics and Compliance, Cargill

AI as a Thought Partner

Cargill’s use of AI goes well beyond experimentation. The E&C team has built specialized agents, trained on policies and standards, that can draft investigation summary reports and support triage activities. These agents don’t just generate formatted documents, they also prompt investigators with follow-up questions and potential angles that might have been overlooked.

The design goal is to make the agent behave more like a knowledgeable colleague than a passive tool, operating within strict guardrails and aligned with organizational principles.

Unlocking Data and Analytics

The technology has also become central to reporting and analytics. Preparing board materials and business dashboards once relied heavily on Power BI, requiring significant time and technical skill. Now, McMacken’s team can upload data to GPT-based agents that cleanse, organize, and visualize the information according to Cargill’s unique rules and calendars. Roughly 90% of visuals produced for the leadership reporting that McMacken manages are now generated through AI, with human review ensuring accuracy. This allows her to spot trends across longer time horizons, identify cultural red flags, and provide more nuanced insights than manual methods could deliver.

How to Train an Agent

Success depends on disciplined training. Rather than overwhelming agents with every possible resource, the team identifies each agent’s core mission and loads only the most relevant materials. For example, the triage agent is trained on issue-type definitions, keyword maps, flagging criteria, and style guidance for summaries. Well-structured markdown instructions ensure the outputs are both accurate and usable.

Users are also encouraged to treat the agent like a colleague by questioning discrepancies, asking for explanations, and learning from the iterative exchange.

Keeping Humans in the Loop

While AI accelerates workflows, human judgment remains the final safeguard. Every output is reviewed, and responsibility ultimately rests with the investigator or analyst. This “human-in-the-loop” approach allows the team to maintain accountability while taking advantage of AI’s speed. The result is more communications, summaries, and reports completed in less time…all without sacrificing quality.

Faster Investigations

One area where this balance is particularly valuable is investigations. Intake and preparation tasks, such as adding summaries, tagging issue types, and formatting metadata, traditionally slowed down the process. With AI handling much of this routine work, investigators can focus on interviews, analysis, and decision-making. Upcoming integrations with transcription tools may further reduce cycle times by eliminating the need for manual note-taking, allowing investigators to manage more cases simultaneously.

Building Skills Through Curiosity

McMacken’s rapid adoption of AI was driven largely by experimentation. Before bringing the technology into her professional role, she tested different models in personal projects, studied external resources, and exchanged ideas with colleagues. She encourages peers to start small, using whatever tools their organizations approve, and to approach AI with curiosity. This hands-on exploration, she argues, is the fastest way to understand both the capabilities and the gaps that AI can address.

Elevating Visibility and Securing Support

AI adoption has also enhanced the visibility of the E&C function within Cargill. Early wins positioned the team as strong candidates for pilots of enterprise tools, including GPT Enterprise and Microsoft Copilot. Demonstrated value has since helped the team secure more licenses and ongoing support from leadership. Regular usage metrics and monthly surveys that quantify hours saved provide tangible evidence of impact, making budget discussions easier and reinforcing leadership confidence.

Elevating Visibility and Securing Support

Distributed Impact

Beyond flagship initiatives, distributed adoption across teams has delivered meaningful gains. A colleague in derivatives, for example, applied GPT to automate a market surveillance task, saving more than 100 hours in a single quarter. These smaller, decentralized successes combine with larger efforts to create program-wide acceleration. The effect is not only efficiency but also broader buy-in, as employees see AI solving problems relevant to their own work.

Next Steps: Orchestration and Integration

Looking ahead, Cargill’s E&C team is focusing on orchestration: linking multiple agents and automations for seamless end-to-end workflows. The vision is an integrated process where a bot can draw data directly from case management systems, triage it, draft reports, and return it to investigators without requiring manual transfers. Combining AI with existing automation platforms such as Power Automate will help ensure AI is “built-in, not bolt-on,” as McMacken describes it, with humans in the loop as the final approver.

A Strategic Mindset

For McMacken, the philosophy is clear: AI should be embedded into systems and processes in ways that add lasting value, not patched on as an afterthought. That mindset, paired with disciplined training, measurable results, and a commitment to human oversight, is enabling Cargill’s E&C team to keep pace with rising workloads, increase its strategic relevance, and pioneer a model for how compliance functions can responsibly leverage AI.