The 2026 midterm elections have changed the political environment in which American businesses operate. Democrats have won control of both chambers of Congress, setting the stage for divided government during the remaining two years of the Trump administration. For compliance professionals, the immediate task is to assess how that change could affect scrutiny of corporate conduct, regulatory priorities, and the information boards need to oversee risk.
In our post-election episode of Compliance Into the Weeds, Matt Kelly and I explored those implications. Our discussion covered considerable ground, but three issues deserve particular attention from chief compliance officers: anti-corruption and investigation readiness, AI governance and state enforcement, and conflicts of interest involving prediction markets.
Each presents a different operational challenge. Together, they raise a familiar governance question: can your company demonstrate that its decisions were properly authorized, its risks understood, and its controls effective?
That question should guide the compliance response to the election. Political developments belong in the risk assessment because they can change who examines corporate behavior, what information they demand, and which decisions receive public attention.
Anti-Corruption and Investigation Readiness
Matt raised an important prospect during our conversation: a change in congressional control could bring greater scrutiny of relationships between businesses and the administration. Companies should prepare for that possibility without assuming that every government interaction will become an investigation.
Start with the underlying business activity. Government contracts, regulatory approvals, politically connected intermediaries, charitable contributions, and executive relationships can all warrant review when public officials have influence over commercial outcomes. The practical question is whether your company can explain the business purpose, approval process, and controls surrounding those activities.
Consider the GOP consultant hired to help secure a government approval (or better yet, a pardon or to make an investigation ‘go away’.). The consultant has political connections, receives an unusually large fee, and communicates primarily with a senior executive. A contract and invoice establish that money changed hands. They do little to establish what services were performed, whether the fee was reasonable, or how potential conflicts were evaluated.
The CCO should be able to reconstruct that relationship through contemporaneous evidence. Who sponsored the engagement? What diligence occurred? Who approved the compensation? What deliverables were received? Were concerns escalated, and how were they resolved?
These questions apply across domestic and international operations, although the governing legal requirements differ. Compliance teams should work with counsel to identify the applicable anti-bribery, ethics, procurement, disclosure, and accounting obligations.
Investigation readiness also requires reliable access to business communications. The FTC and DOJ specifically addressed collaboration platforms and disappearing messages in their January 2024 preservation guidance. Their announcement reinforced that preservation responsibilities extend to these communications during government investigations and litigation.
For the CCO, that creates a practical testing opportunity. Ask legal, IT, records management, and internal audit to walk through a realistic preservation exercise. Determine whether the company can identify relevant custodians, preserve covered communications, suspend applicable deletion settings, and retrieve records from approved business systems. Identify gaps before an urgent request exposes them.
Boards should also understand who controls an investigation when senior management is implicated. Establish escalation criteria, independent reporting arrangements, and access to appropriate outside expertise. A protocol that requires an allegation against an executive to pass through that executive creates an obvious governance weakness.
The DOJ’s Evaluation of Corporate Compliance Programs (ECCP) provides a useful benchmark: program design, adequate resources and authority, and effectiveness in practice. Those questions remain valuable for boards evaluating whether management can support its assurances with evidence. Employees will watch the response closely. Consistent treatment of executives and frontline personnel demonstrates that the company’s standards carry operational meaning.
AI Governance and State Enforcement
Our discussion also addressed the difficulty of managing AI across multiple jurisdictions. Here, precision matters. Federal AI policy exists: the White House released America’s AI Action Plan in July 2025, identifying more than 90 proposed federal policy actions involving innovation, infrastructure, and international leadership. The business challenge is determining which requirements apply to each use of AI and translating them into workable controls.
State obligations already deserve attention. The Texas Responsible Artificial Intelligence Governance Act took effect January 1, 2026. The Texas attorney general’s guidance describes prohibited uses, specified disclosure requirements, and enforcement authority, including civil investigative demands. A change in political leadership therefore occurs against an existing legal framework that companies must understand.
For a national business, an AI inventory should connect technology to actual decisions. Identify where AI influences hiring, pricing, customer service, fraud detection, healthcare, procurement, and other activities. Record the business owner, vendor, data inputs, affected populations, and jurisdictions involved. An inventory that lists software names alone will provide limited help when an investigator asks why a customer received a particular outcome.
Take a hypothetical customer service system that recommends denying refunds. The company should understand whether employees meaningfully review those recommendations, whether the system produces inaccurate explanations, and whether customers can obtain reconsideration. It should also know whether the vendor can change the model without notifying the business. Those are operational questions with legal, reputational, and financial consequences.
The NIST AI Risk Management Framework offers a practical structure through its Govern, Map, Measure, and Manage functions. It emphasizes responsibility, context, assessment, and continuing risk management across the AI lifecycle. ISO/IEC 42001 complements that approach with requirements for establishing and continually improving an AI management system.
CCOs can use these frameworks to organize governance while counsel maps applicable legal obligations. Framework adoption should produce identifiable owners, documented assessments, testing records, escalation procedures, and corrective actions. Vendor oversight deserves particular attention. Request evidence supporting performance claims. Examine contractual access to incident information, material change notifications, and relevant testing. Determine how the company will respond if a vendor cannot explain a harmful result or promptly correct a defect.
The board should receive reporting that connects AI risk to business exposure. Useful measures include significant incidents, overdue corrective actions, unapproved deployments, and exceptions to required review. Management should explain who has authority to suspend a system and what circumstances would trigger that decision. That authority must be usable when commercial pressure favors continued deployment.
Prediction Markets and Conflicts of Interest
Prediction markets introduce a compliance problem that reaches well beyond the companies operating them. Employees may possess confidential information about an event, or influence its outcome, while having an opportunity to trade on that outcome. The potential conflict deserves attention even when an employee views the transaction as a small personal wager.
In February 2026, the CFTC’s Division of Enforcement issued an advisory discussing two disciplinary cases handled by Kalshi. One involved a political candidate trading on his own candidacy. The second involved a video editor trading contracts connected to content about which the editor likely had advance knowledge. The advisory identified potential violations involving fraud and misuse of confidential information. For corporate compliance teams, the lesson is concrete: existing policies may fail to address how employees use company information outside conventional securities transactions.
Consider an employee who knows when an important product announcement will occur. Consider another who helps determine the timing of a public communication. If a relevant event contract is available, either employee could face a conflict involving confidential information, influence over the outcome, or both. Legal treatment depends on the facts, applicable law, and market rules. Company policy can establish a clear behavioral standard while counsel evaluates those requirements.
Review your organization’s confidentiality, personal trading, conflicts, and acceptable-use policies together. Determine whether they expressly address event contracts, tipping others, and transactions involving outcomes an employee can influence. Define the scope carefully enough that employees understand it and compliance can administer it consistently.
Training should use examples drawn from the business. Relevant employees could include executive assistants, communications personnel, product teams, government affairs staff, and contractors. Access to sensitive information often extends well beyond senior management. Provide a route for questions before a transaction occurs. Where proportionate, establish disclosure or preclearance requirements for sensitive roles. Any monitoring should be designed with legal and privacy input. Boards should ask whether management has assessed this exposure and assigned responsibility for closing policy gaps.
What CCOs and Boards Should Do Next
These three priorities call for a focused response:
- Refresh the risk assessment. Identify government relationships, AI uses, and confidential information exposures that warrant additional scrutiny.
- Test investigation readiness. Conduct a preservation exercise and confirm escalation arrangements for allegations involving senior leaders.
- Examine AI controls. Select consequential systems and test whether ownership, review, monitoring, and corrective action work in practice.
- Update conflicts guidance. Address prediction markets explicitly and train employees whose information or influence creates exposure.
- Give the board an accountable plan. Assign owners, deadlines, and evidence of completion, then report unresolved weaknesses.
The election creates a timely reason to examine these issues. The business case extends beyond any election cycle. Effective compliance helps management make defensible decisions, protects information entrusted to employees, and gives directors a reliable basis for oversight. The CCO’s next board presentation should explain where exposure has changed, what management is doing about it, and how the company will demonstrate that its response works.