This week we have concluded our lengthy exploration of the philosophical underpinnings of the modern corporate compliance program. We have examined Hannah Arendt and her concepts of personal responsibility and how they relate to the modern compliance program; Simone de Beauvoir and the conditions for ethical action in a corporation; John Rawls and institutional justice and fairness in a corporate compliance program; and Jürgen Habermas and the governance of speaking up. In Part 5, we conclude by looking at Hans Jonas and the responsibility for the future of corporate compliance programs.
A corporate decision can continue affecting people long after its sponsors have moved on. Technology makes that possibility especially important. A system approved for a limited purpose can expand across business units, influence thousands of decisions, and create consequences that emerge gradually. Hans Jonas asks us to consider the responsibility that power entails.
For the Chief Compliance Officer (CCO), that perspective changes the approval question. What evidence supports proceeding, what harm could follow, and who will remain responsible as circumstances change? These questions connect ethical responsibility with the practical governance of technology, particularly artificial intelligence.
Technological Power Expands Responsibility
In The Imperative of Responsibility (1984), Jonas reconsidered ethics in light of technological power. His concerns included ecological destruction, nuclear threats, and genetic engineering. The scale and reach of human action created duties extending toward posterity and the environment.
His argument reaches beyond responsibility for an immediate transaction. Decisions can affect the conditions under which others will live, including people unable to challenge those decisions today. The ethical horizon must therefore extend beyond the decision-maker’s own interests and present relationships.
The application to corporate compliance is an interpretation of that argument. Jonas did not write an AI approval checklist. His philosophy nevertheless provides a reason to examine the duration, scale, and reversibility of technological choices. A company’s responsibility should reflect the consequences its capabilities make possible.
This perspective complements the earlier Enlightenment chapters. Evidence and clear reasoning remain essential. Jonas asks what responsibilities follow when the organization can act on that knowledge at a scale whose full consequences remain uncertain. For compliance, the answer begins with disciplined anticipation and continues throughout the activity’s life.
The Approval Whose Consequences Keep Growing
What do you think about the following situation? A multinational company purchases an AI tool to prioritize third-party due diligence. The tool ranks potential intermediaries using corporate records, transaction information, and public data. During a pilot, it reduces the time required to identify files for additional review.
Management approves a broader deployment. Over the following year, procurement teams begin treating low-risk scores as permission to abbreviate diligence. The vendor changes the model. The company expands into countries poorly represented in the original testing. Responsibility for reviewing performance splits among procurement, technology, and compliance.
Later, an investigation finds that several intermediaries with incomplete ownership records received low-risk scores. The model treated missing information as weak evidence of risk, while reviewers interpreted the scores as evidence that meaningful checks had been completed. No one had tested that assumption in the new markets.
The scenario does not establish that AI inevitably weakens diligence. It shows how a limited approval can take on a different operational meaning. A prioritization tool became a basis for reducing scrutiny. Changes in use, data, and responsibility accumulated after the initial decision.
Jonas helps the CCO frame the governance issue. The approval must account for how the system could develop and what its outputs could enable. Responsibility includes the conditions for expansion, the information needed to detect failure, and the authority to intervene before harm spreads.
The DOJ Connection Through Emerging Risk
The Department of Justice’s Evaluation of Corporate Compliance Programs (ECCP) explicitly addresses emerging technology. It asks how companies assess AI’s impact on criminal-law compliance, integrate technology risk into enterprise risk management, and address unintended consequences and misuse. It also examines controls supporting trustworthy, reliable use.
These inquiries make technology governance part of the compliance effectiveness assessment. A company using AI within its own compliance function should apply the same discipline it expects from business operations. The stated purpose of improving compliance does not establish that the tool works appropriately.
In our question above, the CCO should define the approved use precisely, as mission creep is always to be avoided. Prioritizing review is different from authorizing a third party. The decision record should explain what the score means, what it cannot establish, and which diligence requirements remain mandatory. Users need instructions that preserve those distinctions under commercial pressure.
Changes should trigger review according to their significance. A new market, a material vendor update, or a proposal to automate approvals may require additional testing and authorization. The company should assign an accountable owner who can obtain the necessary evidence across functions. Shared participation works best when responsibility for the final decision remains clear.
Uncertainty Calls for Proportionate Safeguards
Companies rarely possess complete information before introducing a technology. See generally Andrew McBride in Recommended Practice for Buying & Selling Compliance Technology, which is based on surveys of compliance technology buyers and vendors. Governance must make uncertainty visible and connect it to a defensible decision. The relevant questions include the severity of possible harm, the number of people affected, the ability to detect errors, and the possibility of reversing the consequences.
A tool that suggests training topics raises different concerns than one that determines which allegations to investigate. The latter can affect whether misconduct is detected at all. Its potential benefit should be assessed alongside the consequences of overlooking a credible concern.
For the third-party tool, a practical safeguard would be to sample low-risk classifications for independent review. Testing only the files the model flags leaves false reassurance largely unexamined. The company should also assess how missing records, unfamiliar languages, and changes in business conditions affect performance.
Deployment can be limited while those questions are tested. Appropriate measures might include restricted uses, defined populations, additional review, or a delay where critical evidence is missing. These are proposed governance responses to the hypothetical. Their suitability depends on the use case and the harm at stake.
The business case should include the cost of maintaining those safeguards. A project whose expected savings depend on eliminating the review needed for reliable operation has an unresolved design problem. Compliance should make that tradeoff explicit before approval and when the project’s economics change.
Turning Responsibility into Continuing Governance
The NIST AI Risk Management Framework provides a voluntary approach to managing AI risks. Its core functions are Govern, Map, Measure, and Manage. Together, they offer an organizational structure for understanding uses and impacts, evaluating risks, and determining responses throughout the AI lifecycle.
Applied to our hypothetical, governance assigns ownership and approval authority. Mapping identifies where the model operates, who relies on its scores, and who could be harmed by error. Measurement tests performance under relevant conditions. Management determines whether to proceed, add safeguards, restrict use, or suspend the tool. These activities should inform one another as evidence changes.
ISO/IEC 42001:2023 specifies requirements for establishing, implementing, maintaining, and continually improving an AI management system. Its relevance here is the organizational discipline of sustained responsibility. The company needs repeatable processes that survive personnel changes and remain connected to actual use.
These frameworks serve different purposes from DOJ’s prosecutorial guidance. Adopting a framework or obtaining certification does not establish compliance with every applicable law or prove that a particular deployment is effective. The company still needs evidence that its controls address the risks of its own activities.
The practical objective is to maintain a record that connects the approved purpose, responsible people, test results, changes, incidents, and remedial decisions. That record enables the next owner to understand why the system was approved and what conditions remain essential to its continued use.
Intervention Must Remain Possible
Responsibility becomes difficult to exercise when the organization cannot change course. Before deployment, determine who can suspend the system, what circumstances require escalation, and how business will continue during an interruption. A fallback process must be sufficiently resourced to operate when needed.
In the hypothetical, repeated unexplained low-risk scores involving missing ownership records could trigger restricted use and a review of affected files. The response should examine past decisions and current performance. Correcting the model does not resolve every consequence of earlier reliance on it.
Vendor arrangements also matter. (See McBride, above.) The company should seek information and contractual provisions appropriate to its risks, including notice of material changes, access to relevant performance evidence, and cooperation with investigations. When adequate visibility is unavailable, decision-makers should account for that limitation in deciding whether and how to use the tool.
Human review requires similar scrutiny. A named reviewer adds little protection if that person lacks time, training, supporting information, or authority to question an output. Test whether reviewers can identify errors and whether their interventions produce corrective action. Human responsibility needs operational support.
Board Oversight Must Extend Beyond Launch
Boards need a view of material technology risks over time. Approval-stage reporting often emphasizes expected benefits. Subsequent oversight should examine whether those assumptions remain valid, whether the use has expanded, and whether the organization retains the resources and authority needed to manage it.
The ECCP examines the information used in board oversight and compliance access to governing authorities. For significant AI deployments, the CCO can use those channels to report unresolved limitations, incidents, changes in use, and overdue corrective actions. Technical detail should explain a decision the board needs to understand.
Directors should ask whose interests the business case omits. Future customers, workers, communities, or business partners may bear costs not reflected in the current project budget. The analysis should consider foreseeable consequences and explain material uncertainties without pretending to predict every outcome.
Accountability should also survive the original sponsor’s departure. Assign continuing ownership, require documented handovers, and maintain review obligations through reorganizations and vendor changes. A system’s effects may persist for years. Its governance should not depend on one individual remembering the conditions attached to launch.
Five Key Jonas Takeaways for the Compliance Professional
- Assess consequences across time and scale. Consider who could be affected, how harm might accumulate, and whether decisions can be reversed. Include foreseeable effects beyond the immediate business case.
- Define the approved use and review material changes. Specify what a system may do, what its outputs establish, and which decisions require human authorization. Reassess expansion, vendor updates, and changes in operating conditions.
- Match safeguards to uncertainty and potential harm. Test the errors that routine monitoring could miss. Use staged deployment, independent review, or restrictions where the evidence does not support broader reliance.
- Preserve the ability to intervene and remediate. Establish suspension authority, workable alternatives, and a process for reviewing past decisions. Verify that human reviewers have the resources and authority to act.
- Make responsibility endure beyond the project team. Maintain ownership, evidence, and review obligations through organizational change. Give the board a clear account of unresolved risk and the decisions required.
Jonas brings our series to a fitting conclusion. Arendt asks who exercises judgment. Beauvoir asks whether people can act on it. Rawls tests the fairness of the rules, and Habermas examines whether concerns influence decisions. Jonas extends responsibility to the consequences that outlast those discussions and to people who cannot participate in them.
Together, these perspectives give compliance professionals a practical agenda for governing corporate power. Build processes that let people question, decide, explain, and correct their actions. Then ask the final board question: what obligations will this decision leave to others, and what have we put in place today to meet them?
