DOJ Updates Corporate Compliance Programs Criteria To Include Focus on AI Emerging Technologies

In prepared remarks delivered on Sept. 23, 2024, at the Society of Corporate Compliance and Ethics conference in Grapevine, Texas, Principal Deputy Assistant Attorney General Nicole M. Argentieri, head of the U.S. Department of Justice’s (DOJ) Criminal Division, announced updates to DOJ’s guidance on the Evaluation of Corporate Compliance Programs (ECCP).

The ECCP sets forth criteria for prosecutors to consider in determining the adequacy and effectiveness of a corporation’s compliance program when a corporation comes within the remit of the Criminal Division’s oversight authority.^[1] In March 2024, Deputy Attorney General Lisa Monaco had announced that prosecutors would consider how a company's compliance program mitigates the risk of misusing artificial intelligence (AI) and had directed the Criminal Division to incorporate the assessment of disruptive technology risks into its ECCP guidance.^[2]

Accordingly, as Argentieri outlined in her remarks, and as reflected in the newly updated ECCP, those criteria now explicitly consider how companies manage risks related to new and emerging technologies such as AI. Prosecutors are to consider the technologies that a company uses as part of its business, whether the company has undertaken any risk assessment on the use of those technologies, and any appropriate steps a company might have taken to mitigate associated risks.

As a second significant update, DOJ also expanded its assessment of whether a company sufficiently encourages employees to proactively report misconduct and without fear of retaliation.^[3]

A third update to the ECCP is consideration of whether compliance personnel have appropriate access to company data, resources and technology, and whether companies are channeling resources and technology into gathering and leveraging data for compliance purposes. 

Broadly, the changes to the ECCP appear to reflect an interest in crediting companies — and thereby incentivizing companies — to proactively evaluate and update their own compliance programs to mitigate risk, rather than waiting for prescriptive guidance. 

These updates are consistent with other recently announced DOJ policies and priorities. In April 2024, the Criminal Division announced a voluntary self-disclosure pilot program for individuals.^[4] Under the program, culpable individuals are now eligible to receive a non-prosecution agreement (NPA) if they come forward with information as of yet unknown to DOJ detailing corporate misconduct. (DOJ maintains a similar program for corporations themselves to voluntarily self-disclose in exchange for the presumption of declination of prosecution.) Recently, in August 2024, the Criminal Division also announced a three-year Corporate Whistleblower Awards Pilot Program, whereby individuals who provide the Criminal Division with previously unknown information about certain kinds of corporate misconduct that results in a successful forfeiture may be eligible for an award.^[5]

All of these programs and associated assessment criteria reflect a desire by DOJ to deter corporate misconduct, incentivize corporations to invest in robust compliance programs, and increase self-reporting of corporate misconduct. Rather than waiting for DOJ to tell corporations how AI may expose them to risk, for example, DOJ puts the onus on corporations to consider and resolve for themselves their own vulnerabilities. More than simply a tool for prosecutors evaluating a corporation that finds itself in DOJ’s crosshairs, the ECCP offers compliance officials a helpful road map to strengthen their internal policies and procedures in order to, hopefully, altogether avoid the risks that would otherwise expose them to DOJ’s oversight.

^[1]_{https://www.justice.gov/criminal/criminal-fraud/page/file/937501/dl; see also https://www.kramerlevin.com/en/perspectives-search/doj-reinforces-its-focus-on-affirmative-corporate-accountability-at-the-abas-38th-annual-white-collar-conference.html for a Kramer Levin client alert discussing updates to the ECCP in March 2023.}

^[2]_{https://www.justice.gov/opa/speech/deputy-attorney-general-lisa-monaco-delivers-keynote-remarks-american-bar-associations}

^[3]_{https://www.justice.gov/opa/speech/principal-deputy-assistant-attorney-general-nicole-m-argentieri-delivers-remarks-society}

^[4]_{https://www.justice.gov/opa/blog/criminal-divisions-voluntary-self-disclosures-pilot-program-individuals}

^[5]_{https://www.justice.gov/criminal/criminal-division-corporate-whistleblower-awards-pilot-program}