In September 2024, the Department of Justice (DOJ) released an updated version of its Evaluation of Corporate Compliance Programs (ECCP) Guidance. The ECCP serves as a framework for DOJ prosecutors to evaluate a company’s compliance program when considering the appropriate enforcement actions. While updates were made across multiple topics, the most notable changes focus on how companies manage corporate whistleblower programs and address risks associated with Artificial Intelligence (AI) and other emerging technologies.

In Part 1 of this blog series, we examine the DOJ’s updated ECCP guidance, highlighting the risks tied to emerging technologies like AI. Part 2 will delve into the management of corporate whistleblower programs and the DOJ’s guidance on M&A integration, policies and procedures, and tailoring training programs to strengthen compliance.

Use of Data and Emerging Technology
To define AI, the DOJ guidance references the definition found in Section 238(g) of the John S. McCain National Defense Authorization Act of 2019. Acknowledging the inherent risks posed by new technologies like AI, the DOJ emphasizes the importance of evaluating their use in business operations. Companies are encouraged to conduct risk assessments related to emerging technologies, identify mitigation steps, and continuously audit and monitor these technologies to ensure they function as intended.  Additionally, companies should focus on detecting and correcting AI-driven decisions that conflict with their values.

Key themes addressed in the DOJ’s guidance include:

  • Establishing processes to identify and manage internal and external risks associated with emerging technologies
  • Assessing the potential impact of these technologies on the company’s compliance with criminal laws
  • Integrating emerging technologies’ risks into broader Enterprise Risk Management (ERM) strategies
  • Evaluating governance approaches for using new technologies in commercial business operations and compliance programs
  • Addressing potential negative or unintended consequences resulting from the use of these technologies
  • Mitigating risks of deliberate or reckless misuse of technology
  • Implementing controls to monitor and ensure AI’s trustworthiness, reliability, and alignment with applicable laws and the company’s code of conduct, ensuring technologies are used only for their intended purposes
  • Defining a baseline for human decision-making to assess AI outcomes
  • Establishing clear responsibilities and accountability for monitoring and enforcing AI use
  • Providing proper employee training on the use of emerging technologies

By following these guidelines, life science companies can better align the adoption of new technologies with their compliance frameworks and operational goals.

Risk Management
An evaluation of a company’s risk profile should account for specific factors that mitigate risk, including emerging threats as internal and external circumstances evolve. Life science companies should assess which aspects of their operations reduce their risk exposure and whether their approach to risk management is proactive or reactive. Additionally, compliance programs should consider how they allocate compliance resources in a risk-based manner; companies should periodically review vendors and leverage available data to assess risks associated with third-party relationships.

As life science companies navigate the complexities of compliance in an era defined by rapid technological advancement, the DOJ’s updated ECCP guidance serves as a critical resource. By proactively addressing risks tied to emerging technologies, corporate whistleblower programs and overall risk management, organizations can align their compliance frameworks with evolving expectations.

Stay tuned for Part 2 of this blog series, where we’ll dive into the DOJ’s guidance on whistleblower programs, M&A integration, policies and procedures, and tailoring training programs to strengthen compliance.

For the full text of the DOJ Guidance and a redline version that reflects all changes made in the new update, please go to:

Redline Version – ECCP_September 2024 Redline Updates_v3

Clean Version – https://www.justice.gov/criminal/criminal-fraud/page/file/937501/dl

 

February 5, 2025

Jay Ward
Director, Life Science Solutions