In today’s rapidly evolving technological landscape, the integration of artificial intelligence (“AI”) into business operations presents unparalleled opportunities for efficiency and innovation. Alongside these advancements, however, come new challenges and risks that must be addressed to ensure regulatory compliance and ethical responsibility. Recently, the Department of Justice (“DOJ”) has underscored the importance of proactively managing AI-related risks as part of an effective compliance program, signaling a shift in regulatory expectations. In this blog post, we explore the key considerations and actionable steps for organizations to effectively navigate AI-related risks and enhance their compliance efforts.

Understanding the DOJ’s Guidance:

In our last blog post, we discussed Deputy Attorney General Monaco’s announcement directing DOJ to incorporate assessment of risks associated with AI into its policy on Evaluation of Corporate Compliance Programs. DAG Monaco’s directive emphasized DOJ’s focus on targeting illegal activities from disruptive technologies, including AI, in its efforts to combat new and emerging threats.

For a growing number of businesses, AI is increasingly leveraged to improve business efficiencies. DAG Monaco warned, however, of the significant risk of misusing AI to commit corporate crime such as fraud, price fixing, market manipulation, and discrimination. Compliance officers are on notice that DOJ will now consider how well an organization’s compliance program mitigates the risk of misusing AI when assessing the program as part of a corporate resolution.

Assessing AI Risks:

Integrating assessment of AI risk into compliance programs requires a comprehensive review of all business activities leveraging AI across the organization, as well as existing policies and procedures that may govern those activities. Organizations must consider the potential regulatory, contractual, and reputational implications of AI-use and assess the level of risk by determining what controls are already in place, the likelihood of a violation, and the likely damage to the organization. Collaboration among stakeholders and leveraging external expertise may be necessary to ensure a thorough understanding of AI-related risks, mirroring the approach taken for similarly significant compliance risk areas such as antitrust, bribery, and data security/privacy. 

Key Steps for Implementation:

• Identify AI Risks and Compliance Gaps: Gather pertinent information to identify AI-related risks and gain an understanding of inherent risk of financial impact and probability. Conduct a thorough review of current compliance protocols to identify gaps in addressing identified AI-related risks.
• Integrate AI Risk Assessment: Determine the appropriate timing, scope, and method of conducting assessments of AI-related risk as part of the compliance program’s overall risk assessment for the organization. Develop mechanisms for assessing the design, implementation, and effectiveness of the compliance program in managing AI risks, including the effectiveness of compliance strategies and controls implemented to mitigate identified AI-related risks.
• Identify and Engage Stakeholders: Foster collaboration among key members of business operations, legal, IT, and compliance functions to leverage expertise and ensure a holistic approach to addressing AI-related risks.
• Continuous Improvement: Establish processes for ongoing monitoring, assessment, and enhancement of the AI risk assessment to adapt as the organization’s risk profile changes due to evolving business processes, elimination of known vulnerabilities, regulatory changes, and identification of additional risks.
• Document Compliance Efforts: Maintain comprehensive documentation of AI risk assessment processes and mitigation strategies to demonstrate compliance and accountability to regulators.

Conclusion:

Effectively navigating AI risks requires a proactive approach and a commitment to continuously enhancing compliance efforts. By incorporating AI-related risk assessment into corporate compliance programs, organizations can mitigate potential liabilities and regulatory scrutiny while upholding legal and ethical standards. Upon integration into the Evaluation of Corporate Compliance Programs, DOJ’s guidance will serve as a valuable framework for organizations to strengthen their compliance posture in the face of emerging AI technologies, ensuring alignment with evolving regulatory expectations. As organizations embrace the transformative potential of AI, prioritizing compliance and risk management is essential to foster trust, uphold integrity, and drive sustainable growth in an increasingly digital world.