The most important question arising from Anthropic’s IPO disclosures is what compliance professionals should do with the risks they reveal. Identifying exposure begins the analysis. Building a program that can manage that exposure is the business challenge.
In Parts I and II, I examined ten corporate compliance risks, ranging from AI safety and regulatory enforcement to third-party dependencies, financial reporting, and board oversight. In this blog post, I want to turn those risks into five practical lessons for CCOs, general counsel, directors, and business leaders can use today for the compliance management of AI.
Those lessons extend beyond AI developers. A manufacturer using AI in procurement, a financial services company deploying customer-facing tools, or a professional services firm connecting AI to confidential records must understand how those uses affect its control environment. Purchasing the technology does not eliminate the need to govern its use.
The central issue is accountability. Who owns the risk? Which controls address it? How does management know those controls work? What happens when they fail? These are familiar compliance questions. AI makes the answers more urgent.
- AI governance must become part of enterprise compliance
A standalone AI ethics policy cannot carry the weight of an enterprise compliance program. Principles require operational decisions: what uses are permitted, what information systems may access, what actions require approval, and who can suspend deployment. Start with an inventory of AI uses across the business. Include purchased applications, internally developed systems, employee experimentation, and AI features embedded in existing software. For each use, identify the business owner, data involved, decisions supported, and authority granted. A drafting assistant and an agent authorized to initiate payments require different controls.
Then connect the inventory to the enterprise risk assessment. Classify uses according to potential harm, legal exposure, sensitivity of information, and difficulty of reversing an action. Assign control owners and specify when reassessment is required. A new data connection or expanded permission can change the risk without changing the product name. Governance also requires decision rights. Compliance, legal, security, technology, and business teams should understand their respective responsibilities. Disagreements about deployment need a documented escalation route, including authority to delay implementation when critical safeguards remain unresolved.
Frameworks such as the NIST AI Risk Management Framework and ISO/IEC 42001 can help organize this work. Their practical value depends on whether the company translates its chosen approach into operating responsibilities and verifiable controls.
The CCO question: Can we identify the accountable owner and supporting controls for every material AI use?
- Traditional compliance risks remain fundamental
AI changes how misconduct can occur and how quickly its effects can spread. Established compliance disciplines still provide the starting point for identifying the exposure. Consider a hypothetical procurement agent that recommends vendors and prepares payment instructions. Its technical performance may appear strong while its workflow bypasses conflict disclosures, restricted-party screening, or approval requirements. Faster processing can amplify a weak control environment.
The appropriate response is to examine the underlying business process. Map where an AI system receives information, makes recommendations, changes records, or initiates actions. Identify the approvals, segregation of duties, documentation, and monitoring that must remain effective at each stage. Determine whether automation has created a new route around an existing safeguard. Anti-corruption controls illustrate the point. An intermediary recommended by an AI tool still requires appropriate diligence. A payment description generated by a model still requires verification. A confident recommendation cannot substitute for evidence about ownership, services performed, compensation, or government connections.
Training should reflect these practical choices. Employees need examples showing when to question an output, obtain approval, preserve records, or report a concern. Generic instructions to use AI responsibly provide little help when a system recommends a questionable transaction under commercial pressure. The CCO should also examine incentives. Employees measured solely on speed or volume may have little reason to challenge an automated recommendation. Managers must support escalation when verification delays a transaction.
The CCO question: Where could AI bypass, weaken, or obscure a control we already depend upon?
- Third-party risk management must include technology dependencies
Traditional third-party programs often focus on agents, distributors, consultants, and other commercial intermediaries. AI requires equally careful attention to model providers, cloud infrastructure, data suppliers, integration partners, and subcontractors supporting critical services. The first task is dependency mapping. Determine which providers support essential workflows, what information they receive, and whether multiple applications depend on the same underlying service. Several vendor contracts may conceal a single point of operational failure.
Due diligence should follow the actual use. A tool processing public information presents different concerns from a service accessing customer records or executing transactions. Ask how information is retained, whether it may be used for training, how access is controlled, and what changes the provider can make without customer approval. Contracts should support the controls the company needs. Depending on risk, that may include incident notification, restrictions on data use, information about subcontractors, access to assurance evidence, and notice of material service changes. Legal and procurement teams should identify gaps before the business becomes dependent on the service.
Monitoring must continue after onboarding. A provider update can affect performance, permissions, or data handling. Assign responsibility for reviewing material changes and deciding when testing must be repeated. Finally, test the exit plan. Can the business recover its information, revoke access, and maintain essential operations if the relationship ends? A contractual termination right offers limited protection when no workable alternative exists.
The CCO question: Which technology dependencies could prevent us from meeting critical obligations, and what is our tested response?
- Compliance must be embedded in product development
Compliance review is most useful while business and technical choices can still be changed. Waiting until launch makes it harder to address weaknesses in data access, system permissions, customer communications, or monitoring. The Evaluation of Corporate Compliance Programs (ECCP) expressly addresses how companies assess and manage risks associated with AI and other emerging technologies. That provides an enforcement-informed reason to integrate AI risk into the broader compliance program.
For the CCO, the practical response is a development process with review points proportionate to risk. Assess the intended use before development, review controls during testing, document approval before deployment, and monitor behavior afterward. Material changes should trigger renewed review. Testing should examine foreseeable misuse and control failure alongside normal performance. Can a user induce unauthorized disclosure? Can an agent exceed its permissions? Does the system preserve records needed to investigate an incident? Can a human reviewer meaningfully intervene?
A nominal human approval step deserves particular scrutiny. If reviewers lack time, information, or authority to challenge recommendations, the safeguard may offer little protection. Test how people actually perform the review under realistic workloads. Compliance also needs access to relevant information and sufficient technical support to assess the results. Establish channels for employees to report unexpected behavior without having to prove a technical defect first. Investigations should connect incidents to root causes and corrective action.
The CCO question: At what development decisions can compliance require changes, and what evidence supports approval?
- Boards must demand evidence of effectiveness
Board oversight depends on information that enables challenge. Counts of policies issued, training completed, and committee meetings held describe activity. Directors also need evidence about whether material risks are being controlled. Management reporting should identify significant AI uses, unresolved control weaknesses, incidents, overdue remediation, and decisions to accept residual risk. Explain what changed since the previous report and whether the change affects the company’s ability to operate within approved limits.
Metrics need context. An increase in reported incidents may reflect improved detection rather than worsening performance. A low incident count may conceal weak monitoring. Directors should ask how management interprets the numbers and what independent testing supports that interpretation. Reports should also surface disagreements and exceptions. If management approved deployment despite an unresolved compliance concern, the board needs to understand the decision, compensating controls, accountable executive, and deadline for reconsideration. Commercial significance should increase the quality of scrutiny.
Directors do not need to reproduce technical testing. They need reliable reporting, access to appropriate expertise, and a clear process for following material concerns through remediation. Meeting records should capture substantive questions, commitments, and follow-up. The board question: What evidence would cause management to restrict or suspend an AI deployment, and has that response been tested? The larger lesson: turn commitments into operating discipline
Anthropic’s disclosures bring emerging technology risk, traditional compliance obligations, and governance expectations into one discussion. The practical response is an integrated program that connects business decisions to accountable owners, tested controls, and timely escalation.
Begin with three actions: identify the most consequential AI uses, test whether existing controls cover them, and present unresolved gaps to the appropriate decision makers. Assign deadlines and verify remediation. Give business owners clear responsibility for explaining remaining gaps and reporting progress until corrective work is complete.
For CCOs and boards, the measure of progress is whether the organization can demonstrate that its controls work as capabilities, permissions, and business uses change. That is how AI governance becomes an effective business discipline. The following is my qualitative assessment, not a quantitative risk score disclosed by Anthropic. The rankings reflect the combined importance of regulatory exposure, potential harm, and control complexity.
| Rank |
Corporate compliance risk |
Priority |
Primary accountability |
| 1 |
AI safety and autonomy |
Critical |
Chief AI/Safety Officer, CCO |
| 2 |
Regulatory enforcement |
Critical |
General Counsel, CCO |
| 3 |
Privacy and cybersecurity |
Critical |
CISO, Privacy Officer |
| 4 |
Intellectual property |
Critical |
General Counsel |
| 5 |
Export controls and sanctions |
Critical |
Trade Compliance, CCO |
| 6 |
Third-party risk |
High |
Procurement, CCO |
| 7 |
Anti-bribery and corruption |
High |
CCO |
| 8 |
Financial reporting and disclosure |
High |
CFO, Audit Committee |
| 9 |
Corporate governance |
High |
Board, General Counsel |
| 10 |
Consumer protection |
High |
Legal, Product Compliance |
