U.S. Department of Justice Updates Compliance Program Evaluation Guidance with Focus on Artificial Intelligence and Evolving Policy

_{FALL 2024 |}_{OTHER FEATURES}

U.S. DOJ Updates Compliance Program Evaluation Guidance with Focus on Artificial Intelligence
and Evolving Policy

by
AERYKA FAUSETT
TERENCE GILROY
JEFFREY MARTINO
GEOFF MARTIN
JESSICA NALL
BYRON TUYAY

On September 23, 2024, the US Department of Justice (DOJ) issued an updated version of its Evaluation of Corporate Compliance Programs document.

The Evaluation Guidance was first released by the DOJ in 2017, and it supplements compliance program requirements set forth in DOJ's Justice Manual, the US Sentencing Guidelines, and in a number of subject-matter-specific documents issued by DOJ. The Evaluation Guidance assists DOJ prosecutors in appraising corporate compliance programs at each stage of a corporate criminal prosecution. At the same time, the Evaluation Guidance has become a valuable resource for all companies to measure their compliance program against the expectations of the U.S. Government, and resulting industry best practices.

Use of artificial intelligence, data and emerging technologies

The use of data, analytics, and emerging technologies have been a focus for DOJ for some time now, and an expectation for compliance programs. The latest version of the Evaluation Guidance includes a significantly enhanced focus on these topics. There are two primary additions to the Evaluation Guidance in this area:

Assessment of AI and emerging technology risks – The Evaluation Guidance prompts prosecutors to consider how companies manage and mitigate risks related to the use (and potential misuse) of AI and other emerging technologies. The revised Evaluation Guidance also considers how quickly companies can detect and correct decisions made by AI or new technology, if necessary.
Data analytics and evaluation – Additionally, several edits to the Evaluation Guidance stress the importance of collecting and evaluating data as part of an effective compliance program. Ultimately, the DOJ seeks to evaluate whether companies are using data to proactively identify both areas of improvement for existing compliance programs and potential misconduct.

Corporate compliance programs are now expected to become more proactive and nimble than ever to assess and mitigate the risks posed by AI and other technologies. Our recommendations in this regard include:

Staying ahead of emerging risks – With AI continuing to advance rapidly, compliance programs must continuously evolve to be able to proactively identify and manage emerging risks associated with its current and potential future use and potential misuse.  Prosecutors will closely examine how a company is doing this and refining its AI systems and use cases based on lessons learned and evolving trends.
A cross-functional approach to AI compliance – Companies should adopt a cross-functional approach to AI governance by bringing technologists into these compliance conversations. This will help to ensure that a deep understanding of the technology and its risks informs the development of adequate controls and monitoring mechanisms.
Tabletop exercises – AI can be misused in furtherance of corporate criminal violations in a variety of ways. In devising adequate AI governance and compliance programs, it can be useful to consider the worst possible outcomes across a company's proposed AI use cases by conduct live tabletop training exercises around these potential misuses with the right stakeholders.
Balancing innovation and compliance – Companies should balance potential internal pressure to leverage AI for business benefits with the need to ensure compliance with applicable laws and regulations.
Continuous training and education – Companies should invest in continuous education and training programs to keep up with fast-paced developments in AI, including its emerging risks and challenges.

Evolving DOJ policy in other areas

There are a number of other changes elsewhere in the Evaluation Guidance which provide companies and their compliance counsel with insight into DOJ's current thinking and reminders of its recent policy priorities in a number of key areas, including:

Root cause analysis and integrating lessons learned –The DOJ expects companies to learn from their mistakes (as well those of other companies) as they update their internal controls, policies, procedures, and training.
Continued focus on Mergers and Acquisitions – DOJ last year issued specific guidance on its expectations in connection with M&A due diligence and post-acquisition compliance integration, through its October 2023 Mergers & Acquisitions Safe Harbor Policy. Several of these elements have found their way into the revised Evaluation Guidance. Consideration of these topics, if done in a timely fashion, will allow companies to take advantage of the new M&A Safe Harbor program, if they choose to do so, as well as meeting the DOJ's compliance program expectations.
Supporting whistleblowers…and punishing wrongdoing – Much of DOJ's recent initiatives have revolved around encouraging those who are aware of corporate wrongdoing to report it to DOJ. This has included roll out of a comprehensive Pilot Program for Financial Rewards for Corporate Whistleblowers in August 2024 and new program issued earlier in the year which outlines how DOJ will treat whistleblowers who are themselves implicated in underlying wrongdoing, including offering potential leniency. DOJ also expects companies themselves to encourage and appropriately incentivize internal whistleblowing and to protect whistleblowers from retaliation and this expectation is now reflected in a number of the latest revisions to the Evaluation Guidance.

Conclusion

None of these revisions to the Evaluation Guidance come as a surprise to those who have been closely following the significant volume of policy and guidance materials issued by DOJ in recent months and years. Nevertheless, the revised Evaluation Guidance provide insight into those areas where companies should focus effort and resource as they continue to evolve and continuously improve their compliance programs, just as DOJ continues to evolve its own expectations to be increasingly complex and prescriptive. ■

TERENCE GILROY is a partner in the New York office of Baker McKenzie and a member of the Investigations Compliance and Ethics Practice Group.

JEFFREY MARTINO is a partner in the New York office of Baker McKenzie and is co-lead of the firm's Global Cartel Task Force.

GEOFF MARTIN is a partner in the Washington, D.C. office of Baker McKenzie, in the Litigation and Government Enforcement practice group.

JESSICA NALL is a partner in the San Francisco office of Baker McKenzie, leading the firm's West Coast investigations and compliance practice.

BYRON TUYAY is a senior associate in Baker McKenzie's North America Antitrust & Competition Practice Group in Los Angeles.

AERYKA FAUSETT is a Law Clerk at Baker McKenzie.

Which area of concern is your greatest priority to manage and mitigate AI-related risks to your organization in 2025?

Data Privacy and Security
Use of AI for fraudulent, criminal or unethical purposes
Intellectual Property (generated by AI)
Intellectual Property (that underpins AI models)
Balancing innovation with compliance, and managing internal pressures