Tag: CCO

Categories
Blog

Nvidia Prelude- Board Accountability and the Role of Compliance

Jensen Huang’s departure puts Nvidia’s board at the center of the company’s next chapter. Mr. Huang resigned for his affair with Alice Huang (no relation). Directors now face decisions about the investigation, executive accountability, leadership continuity, and the controls that protect the business. Their response will determine how the company addresses the questions that brought it to this point.

The formal record deserves precision. Nvidia announced Huang’s resignation on November 12, 2026. Its Form 8-K, Item 5.02, states that the board accepted his resignation as president, CEO, and director effective November 11. The Wall Street Journal (WSJ) described the departure as an ouster; the company’s filing records a resignation.

Nvidia appointed Colette Kress interim CEO while retaining her as CFO and named Harvey C. Jones its first board chair. Those changes establish new leadership responsibilities. They do not establish findings about the underlying allegations or demonstrate that any necessary remediation is complete.

The allegations concerning an intelligence connection and a personal relationship’s effect on export policy remain unverified premises for this series. A leadership decision cannot substitute for evidence about either question. However there are allegations that Ms. Huang’s employer, Megaspeed, was a cut out for Chinese companies banned from receiving Nvidia chips.

For compliance professionals, the immediate priority is to understand what the board will require next. Independent investigators need access to relevant records and witnesses. Directors need to assess what information reached the company, how concerns were evaluated, and whether business decisions require further examination. If that inquiry reaches directors’ own actions, the process must provide an objective way to examine them.

Nvidia’s independent directors announced on November 10 that they had retained Joon H. Kim and Wachtell, Lipton, Rosen & Katz. Following a departure, the board should reaffirm the investigation’s mandate and address practical changes in access, cooperation, and reporting. It should also protect the people providing evidence. On another front,  Congressional requests for testimony, reported by Fortune, underline why accountability questions continue after the departure.

The Department of Justice’s Evaluation of Corporate Compliance Programs, (ECCP), examines investigative independence, compliance authority, and whether corrective measures work in practice. Those questions provide a useful framework for directors overseeing the response. We will explore some of these questions in a later blog post.

Founder dependence and succession belong within that discussion. Boards should identify decisions, relationships, and institutional knowledge concentrated in one executive, then establish how the company will maintain them. An interim appointment requires clear delegation, adequate support, and continued access for the CCO to independent directors.

The practical board questions are straightforward: Who owns the investigation? Who can challenge its scope? Who verifies that corrective actions work? Who protects those raising uncomfortable facts? And who ensures that business continuity does not displace the inquiry?

Beginning on Monday, I will explore key aspects of L’Affair Nvidia and the different aspects of what it all means for the Board of Directors, CCOs and corporate compliance and corporations more generally. We will consider the need for succession planning and what happens when a CEO acts like they are bigger than the entity itself and will tolerate not only no dissention but not even questions. We wil also look at the new reality for corporate compliance professionals around the role of compliance and national security issues.

Join us on Monday where we begin with Part 1 to explore the governance arrangements that preceded the leadership transition: board composition and independence, the code of conduct, conflict disclosures, and the difficulty of investigating a powerful CEO. Its references to Huang as CEO and to Nvidia’s structure without a board chair describe that earlier period. That foundation helps us assess the work now facing the board and the lessons other companies should apply.

Categories
Blog

Extreme Networks Part 2 – Turning the Near Miss Into an Effective Compliance Response

The Extreme Networks Department of Justice (DOJ) and Office of Foreign Assets Control  (OFAC) resolutions give compliance professionals an assignment: examine how information moves from a transaction, a customer interaction, or a whistleblower report to a decision that protects the business.

In Part One, we traced the company’s path from an April 2022 complaint through internal investigations, an October journalist inquiry, and disclosure days before publication. The DOJ credited good-faith investigative work, cooperation, and remediation but concluded that disclosure did not meet its policy requirements. OFAC separately recognized voluntary disclosure while treating the apparent violations as egregious.

The lesson for a chief compliance officer is to connect prevention, detection, investigation, and disclosure. Each function must deliver usable information to the next. The following actions translate that lesson into responsibilities and evidence that management and directors can evaluate.

Make acquisition diligence test the actual customer

Extreme Networks acquired Russian customer relationships that included documentation identifying MMZA. Transaction records nevertheless used DEMZ, and diligence failed to recognize MMZA’s blocked status through its sanctioned parent. A response begins with reconciling acquired contracts, customer records, purchase orders, and service obligations. Legal and compliance should identify the actual end users, examine relevant ownership, and investigate inconsistent identities before approving continued business.

Corporate development should own the delivery of complete acquisition data. Trade compliance should own sanctions analysis. The integration leader should ensure that unresolved accounts remain restricted until authorized reviewers approve them. The evidence of effectiveness is a documented reconciliation showing which relationships were reviewed, what discrepancies emerged, how they were resolved, and which accounts remain restricted. A completed acquisition questionnaire alone cannot demonstrate that the operating business understood its customers. Boards overseeing acquisitions should ask whether management has identified inherited relationships that require additional investigation before revenue, support, or renewals continue.

Verify end users through independent evidence

Extreme Networks’ Russian employees dealt directly with MMZA, while business records named another company. Email domains, physical addresses, support interactions, and meetings contradicted the nominal customer identity. Compliance teams should compare these data sources. A mismatch should trigger an inquiry tailored to the risk. Account contacts and service users can reveal relationships that screening the contracting entity alone will miss.

The distributor’s explanations also require attention. Here, questions were routed back to Russian employees involved in concealment. Asking the commercial chain to explain itself supplied insufficient independence.

Trade compliance should establish when independent research, ownership analysis, reliable translations, or direct verification is required. Sales operations and customer support should provide the underlying records. An end-user certificate should support an assessment. When it conflicts with other evidence, reviewers must resolve the contradiction. Testing should measure whether the company identifies the true recipient across sales and service systems, including transactions that generate no immediate revenue.

Require evidence before releasing a compliance hold

Extreme Networks had compliance holds. Yet transactions and portal access proceeded despite unresolved inconsistencies. That makes hold release a critical control point. Companies should define who can release a hold, what evidence supports that decision, and when a second reviewer is required. Unanswered questions should remain visible, with escalation deadlines and an accountable decision maker.

The reviewer should document the discrepancy, the work performed, the evidence obtained, and the basis for concluding that the transaction may proceed. Extreme Networks’ remediation included requiring documented reasons for terminating a compliance hold. Trade compliance should own the standard, with systems personnel implementing the workflow. Internal audit should sample released holds and independently reconstruct whether the recorded evidence supports approval.

Useful measures include unresolved exception age, repeated discrepancies involving the same intermediary, and approvals lacking independent corroboration. A fast release rate is meaningful only when the underlying decisions withstand review.

Investigate the business process surrounding the allegation

The DOJ credited Extreme Networks’ initial investigation as having been done in good faith. The later discovery of evidence nevertheless demonstrates why investigative scope deserves continuing scrutiny. An allegation about a subsidiary should prompt investigators to consider how that operation obtains customers, processes orders, provides support, records identities, and communicates with intermediaries. Those processes identify evidence sources beyond interviews and the customer master file.

The investigation leader should prepare an evidence map linking each material allegation to relevant custodians, systems, documents, and unresolved questions. When new allegations emerge, the team should reconsider its hypotheses and scope. The general counsel and CCO should agree on who can expand the inquiry, engage specialized expertise, and escalate findings. Board reporting should distinguish facts, provisional conclusions, and unanswered questions.

The evidence of effectiveness is a defensible explanation of what the inquiry tested and why. Closing an investigation should require support for the conclusion and a clear trigger for reopening it when additional information arrives.

Reassess disclosure while the investigation continues

Extreme Networks’ October disclosure preceded publication but followed the journalist’s inquiry. The DOJ treated the imminent prospect of public disclosure as disqualifying under its voluntary disclosure standard. The key lesson is that companies should establish a disclosure review alongside the investigation. The review should identify what is known, the potential legal exposure, relevant authorities, remaining uncertainty, and circumstances that could affect eligibility for cooperation or disclosure benefits.

Counsel should document the decision and specify when it will be revisited. New allegations, evidence of concealment, government contact, or an external inquiry should prompt immediate reassessment. A scheduled review should also prevent the issue from disappearing while investigative work continues. The DOJ’s 2026 Corporate Enforcement and Voluntary Self-Disclosure Policy expressly encourages reporting potential wrongdoing before an internal investigation is complete. That does not require reporting every unsubstantiated accusation. It supports a process that evaluates disclosure using the available evidence while accurately explaining what remains unknown. The general counsel should coordinate the legal assessment, with your CCO participation and board oversight appropriate to the matter’s significance. No fixed internal deadline substitutes for assessing the actual circumstances.

Evaluate each authority separately

OFAC recognized voluntary disclosure; DOJ concluded that the disclosure did not meet its policy requirements. Compliance leaders should build that distinction into their response procedures. Counsel should maintain an assessment for each relevant authority covering the conduct, applicable disclosure standard, recipient, timing considerations, current decision, and next review. The factual account should remain consistent even when the legal analysis differs.

Management should receive an explanation of which benefits may remain available and which conditions remain uncertain. Reporting to one authority should never be treated as automatic satisfaction of another authority’s expectations. The DOJ and OFAC outcomes also show why misconduct severity and disclosure credit need separate treatment. OFAC’s egregiousness determination coexisted with voluntary disclosure credit. Neither label alone explains the complete resolution. The board needs an intelligible account of these differences so it can oversee decisions without assuming that “we self-reported” resolves every enforcement consideration.

Demonstrate remediation through actual performance

Extreme Networks changed screening procedures, added compliance personnel, increased training frequency for customer-facing roles, and improved acquisition diligence. The DOJ cited the effectiveness of its compliance program in deciding against an independent monitor.

For other companies, the practical assignment is to test whether improvements address the failure mechanism. Buying a screening tool or revising a policy should lead to observable changes in decisions. Compliance and internal audits can replay representative scenarios using conflicting domains, misleading customer names, ownership links, and inconsistent certificates. Reviewers should demonstrate that they identify the issue, obtain reliable evidence, and escalate when necessary.

Training should test judgment in these situations. Managers should reinforce that employees have authority to stop a transaction and seek guidance. Compensation and discipline should support those expectations. The DOJ agreement specifically addresses compliance incentives, consequence management, data access, and root cause analysis. OFAC’s commitments likewise address management support, risk assessment, controls, testing, and training. Together, they require attention to how the program operates across the business.

Give directors evidence they can challenge

Extreme Networks’ board received an investigative presentation in summer 2022. That fact illustrates why board engagement should include questions about scope, unresolved evidence, and decisions requiring further review. Directors do not need to conduct the investigation themselves. They need enough information to assess whether management has assigned appropriate resources, preserved independence, and identified the decisions that cannot wait for a final report.

A useful briefing should identify material facts, remaining investigative gaps, disclosure considerations, accountable executives, and the next decision date. Remediation reporting should connect each change to a root cause and a test of operating effectiveness. The NPA’s three-year term and OFAC’s requirement to maintain specified measures for at least five years also make clear that resolution creates continuing obligations. Someone must own delivery, testing, reporting, and escalation throughout those periods.

Actions to take now

Start by selecting several recently released compliance holds and tracing the supporting evidence. Then review one acquisition’s customer integration and one significant whistleblower investigation. Ask whether the organization connected the relevant information and made its consequential decisions explicitly. Bring the findings to management with named owners, completion dates, and tests to show whether improvements work. Directors should ask what changed in actual business decisions after each corrective action.

The objective is an organization that recognizes contradictory evidence, investigates it effectively, and reassesses disclosure while choices remain available. Extreme Networks provides a concrete basis for testing that capability. The CCO’s responsibility is to turn the enforcement lesson into a business process that can demonstrate its effectiveness.

Categories
Blog

Responsible Steward for Managing Risk

How does compliance demonstrate its value when enforcement priorities change? That question keeps coming up in conversations with compliance professionals. It deserves an answer grounded in the work companies do every day: making sound decisions, protecting resources, maintaining trust, and pursuing opportunities within appropriate boundaries.

In a recent conversation with Anik Shah, we explored how compliance can remain relevant during enforcement uncertainty. Anik offered a phrase that captured the responsibility exceptionally well: “responsible steward for managing risk.”

I immediately told him that phrase deserved a blog post. It provides a useful organizing principle for the next evolution of compliance. Stewardship combines professional judgment, business understanding, and accountability. It also creates an obligation to leave the organization better equipped to manage risk than before. For CCOs, that means explaining risks accurately, recommending workable responses, and ensuring that decision-makers understand the consequences of their choices.

Credibility Begins with an Accurate Assessment

Shah emphasized that credibility is the compliance professional’s most important currency. Its value depends on whether management can rely on our advice. When enforcement priorities change, compliance must acknowledge the change. Repeating yesterday’s assessment without examining today’s circumstances weakens our standing with business leaders who can see that the environment has shifted.

In February 2025, the Trump Administration issued an executive order directing a pause in initiating new FCPA investigations and enforcement actions, alongside a review of existing matters. DOJ subsequently issued revised enforcement guidelines on June 9, 2025, emphasizing American economic and national security interests. Those developments changed enforcement policy; they did not repeal the FCPA.

A credible CCO explains that distinction and then examines the company’s actual exposure. Which government interactions, intermediaries, transactions, and jurisdictions warrant attention? What has changed in the likelihood of scrutiny? Which legal obligations and business vulnerabilities remain?

International developments also matter. In March 2025, authorities in the United Kingdom, France, and Switzerland established an anti-corruption prosecutorial task force to strengthen collaboration. The European Union’s new anti-corruption directive entered into force in May 2026, with national implementation generally required within two years and additional time for certain provisions. These developments require multinational companies to assess obligations across their operating footprint.

Precision also means avoiding sweeping claims about limitation periods. Counsel should assess the applicable offense, jurisdiction, and any tolling issues. A proposal to extend a limitation period must be described as a proposal. Credibility suffers when an urgent message depends on an overstated legal premise. The responsible steward makes the strongest accurate case available.

Stewardship Turns Analysis into Decisions

Shah described stewardship as leadership: helping the company navigate risk through clear, actionable advice. That requires compliance to understand what the business is trying to accomplish. Consider a hypothetical proposal to enter a new market through a distributor. The distributor has strong government relationships, requests substantial commissions, and provides incomplete ownership information.

A useful compliance assessment connects those facts to a decision. It identifies the information required before approval, explains the concerns surrounding compensation and ownership, and proposes conditions for proceeding. Those conditions might include verified beneficial ownership, documented services, payment controls, contractual protections, and continuing monitoring.

Management should also understand the alternatives. It could use another distributor, narrow the proposed engagement, delay entry while questions are resolved, or abandon the arrangement if material concerns cannot be addressed. This approach gives decision-makers a clear view of the opportunity and its constraints. It also makes accountability visible. Management owns the business decision within established authority; compliance provides independent advice, challenges unsupported assumptions, and escalates unacceptable conduct.

Stewardship includes the willingness to stop a transaction when necessary. Commercial pressure cannot convert prohibited conduct into an acceptable risk. The discipline is to explain the reason, document the decision, and identify a lawful path forward where one exists.

Demonstrate the Business Value of Controls

Shah also identified compliance benefits that deserve greater attention in management discussions: detecting waste, fraud, and abuse. An expense review may uncover duplicate reimbursement, unsupported entertainment, or spending inconsistent with company policy. Third-party diligence may reveal an undisclosed employee relationship. A review of payments may identify services that were never delivered.

Each finding can protect company resources and improve management information, even where no bribery violation is established. CCOs should make those outcomes visible through evidence. Report substantiated recoveries, recurring control failures, corrective actions, and improvements in review time. Explain how the findings changed a process or prevented a known weakness from continuing.

Be disciplined about financial claims. Hours released for other work do not automatically become cash savings. Distinguish estimated losses avoided from money actually recovered. That discipline reinforces the larger argument: compliance contributes to business performance through better decisions and stronger controls. Its value can be demonstrated without assigning a speculative dollar amount to every activity.

Boards should expect that connection. A report showing policy completion rates becomes more useful when it also explains whether employees apply the policy and whether identified weaknesses are being corrected.

Trust Must Be Earned in Daily Operations

Our conversation returned repeatedly to trust. Employees need confidence that raising a concern will lead to a fair response. Business leaders need confidence that compliance advice reflects sound judgment. Directors need confidence that significant issues reach them promptly. Those expectations are connected.

A company that invites employees to speak up must have managers prepared to listen. Reports should receive appropriate attention, investigations should be conducted fairly, and employees should receive meaningful updates within confidentiality constraints. Promotion and compensation decisions reinforce the message. If a manager repeatedly overrides controls yet continues to advance because of strong sales, employees will draw their own conclusions about the company’s priorities.

CCOs should examine those signals with human resources and business leadership. Ask whether ethical conduct affects performance assessments, whether repeat exceptions receive scrutiny, and whether corrective action applies consistently across organizational levels. Stewardship also requires institutional continuity. Document important judgments, develop colleagues, and preserve the reasoning behind significant decisions. A program dependent on one individual’s memory or relationships remains vulnerable when that person leaves.

Use AI to Create More Room for Judgment

AI was an important part of our discussion because it can support stewardship work. The practical opportunity is to reduce time spent gathering and sorting information so compliance professionals can focus more on interpretation, investigation, and advice. Expense review provides a useful starting point. A controlled pilot could assess whether a tool helps identify duplicate submissions, missing documentation, unusual spending patterns, or transactions requiring additional review.

Begin with a defined population and a documented baseline. Compare the tool’s output with experienced reviewers. Examine false positives and missed issues, including a sample of transactions the tool did not flag. Measure total review time, including the effort required to resolve alerts. A flagged transaction should prompt examination. An employee deserves a fair assessment of the facts before any conclusion is reached.

Regulatory monitoring offers another practical use case. An AI-assisted process could collect developments from approved sources, summarize changes, and route potentially relevant items to responsible specialists. Its usefulness depends on verification. The process should preserve the underlying source, distinguish proposals from enacted requirements, identify effective dates, and connect developments to the company’s activities. A confident summary that omits a jurisdictional limitation can send the business in the wrong direction.

For both applications, establish ownership, access controls, confidentiality protections, and procedures for addressing errors. Determine whether the tool is approved to handle the information involved. Review performance when the model, data, or business process changes. The management case should be specific: faster identification of relevant issues, broader review coverage, or additional capacity for substantive advice. Present measured results alongside implementation costs and unresolved limitations.

Success in expense review does not establish suitability for preparing financial statements. Each materially different use requires its own assessment, testing, and accountable oversight. Most importantly, decide how released capacity will be used. Time saved can support deeper third-party reviews, stronger investigations, or earlier involvement in business planning. Technology delivers compliance value when it improves decision quality and timeliness. Professional judgment remains necessary to determine what an anomaly means, what action is proportionate, and when an issue requires escalation.

Put Stewardship into Practice

CCOs can translate this approach into five immediate actions:

  1. Refresh the risk narrative. Explain what has changed, what remains applicable, and how the assessment affects priorities.
  2. Provide decision-ready advice. Present options, conditions, owners, and escalation points alongside identified risks.
  3. Demonstrate operational value. Track substantiated outcomes and distinguish measured benefits from estimates.
  4. Test trust. Examine reporting experiences, management responses, incentives, and consistency of accountability.
  5. Pilot AI with clear controls. Define the use case, validate performance, and direct released capacity toward higher-value judgment.

Boards should ask whether compliance has sufficient authority and information to challenge decisions, whether management acts on significant findings, and what evidence demonstrates improvement.

Being a responsible steward for managing risk means accepting responsibility for the quality of the guidance we provide and the capabilities we help build. That is a durable basis for compliance leadership through changing enforcement priorities, new technologies, and the next business opportunity.

Categories
Blog

After the Election: Three Compliance Priorities for CCOs and Boards

The 2026 midterm elections have changed the political environment in which American businesses operate. Democrats have won control of both chambers of Congress, setting the stage for divided government during the remaining two years of the Trump administration. For compliance professionals, the immediate task is to assess how that change could affect scrutiny of corporate conduct, regulatory priorities, and the information boards need to oversee risk.

In our post-election episode of Compliance into the Weeds, Matt Kelly and I explored those implications. Our discussion covered considerable ground, but three issues deserve particular attention from chief compliance officers: anti-corruption and investigation readiness, AI governance and state enforcement, and conflicts of interest involving prediction markets.

Each presents a different operational challenge. Together, they raise a familiar governance question: can your company demonstrate that its decisions were properly authorized, its risks understood, and its controls effective?

That question should guide the compliance response to the election. Political developments belong in the risk assessment because they can change who examines corporate behavior, what information they demand, and which decisions receive public attention.

Anti-Corruption and Investigation Readiness

Matt raised an important prospect during our conversation: a change in congressional control could bring greater scrutiny of relationships between businesses and the administration. Companies should prepare for that possibility without assuming that every government interaction will become an investigation.

Start with the underlying business activity. Government contracts, regulatory approvals, politically connected intermediaries, charitable contributions, and executive relationships can warrant review when public officials influence commercial outcomes. The practical question is whether your company can explain the business purpose, approval process, and controls surrounding those activities.

Consider the GOP consultant hired to help secure a government approval (or better yet, a pardon) or to make an investigation ‘go away.’ The consultant has political connections, receives an unusually large fee, and communicates primarily with a senior executive. A contract and invoice establish that money changed hands. They do little to establish what services were performed, whether the fee was reasonable, or how potential conflicts were evaluated.

The CCO should be able to reconstruct that relationship through contemporaneous evidence. Who sponsored the engagement? What diligence occurred? Who approved the compensation? What deliverables were received? Were concerns escalated, and how were they resolved?

These questions apply across domestic and international operations, although the governing legal requirements differ. Compliance teams should work with counsel to identify the applicable anti-bribery, ethics, procurement, disclosure, and accounting obligations.

Investigation readiness also requires reliable access to business communications. The FTC and DOJ specifically addressed collaboration platforms and disappearing messages in their January 2024 preservation guidance. Their announcement reinforced that preservation responsibilities extend to these communications during government investigations and litigation.

For the CCO, that creates a practical testing opportunity. Ask legal, IT, records management, and internal audit to walk through a realistic preservation exercise. Determine whether the company can identify relevant custodians, preserve covered communications, suspend applicable deletion settings, and retrieve records from approved business systems. Identify gaps before an urgent request exposes them.

Boards should also understand who controls an investigation when senior management is implicated. Establish escalation criteria, independent reporting arrangements, and access to appropriate outside expertise. A protocol that requires an allegation against an executive to pass through that executive creates an obvious governance weakness.

The DOJ’s Evaluation of Corporate Compliance Programs (ECCP) provides a useful benchmark: program design, adequate resources and authority, and effectiveness in practice. Those questions remain valuable for boards evaluating whether management can support its assurances with evidence. Employees will watch the response closely. Consistent treatment of executives and frontline personnel demonstrates that the company’s standards carry operational meaning.

AI Governance and State Enforcement

Our discussion also addressed the difficulty of managing AI across multiple jurisdictions. Here, precision matters. Federal AI policy exists: the White House released America’s AI Action Plan in July 2025, identifying more than 90 proposed federal policy actions involving innovation, infrastructure, and international leadership. The business challenge is determining which requirements apply to each AI use case and translating them into workable controls.

State obligations already deserve attention. The Texas Responsible Artificial Intelligence Governance Act took effect January 1, 2026. The Texas Attorney General’s guidance describes prohibited uses, specified disclosure requirements, and enforcement authority, including civil investigative demands. A change in political leadership therefore occurs against an existing legal framework that companies must understand.

For a national business, an AI inventory should connect technology to actual decisions. Identify where AI influences hiring, pricing, customer service, fraud detection, healthcare, procurement, and other activities. Record the business owner, vendor, data inputs, affected populations, and jurisdictions involved. An inventory that lists software names alone will provide limited help when an investigator asks why a customer received a particular outcome.

Take a hypothetical customer service system that recommends denying refunds. The company should understand whether employees meaningfully review those recommendations, whether the system produces inaccurate explanations, and whether customers can obtain reconsideration. It should also know whether the vendor can change the model without notifying the business. Those are operational questions with legal, reputational, and financial consequences.

The NIST AI Risk Management Framework offers a practical structure through its Govern, Map, Measure, and Manage functions. It emphasizes responsibility, context, assessment, and continuing risk management across the AI lifecycle. ISO/IEC 42001 complements that approach by requiring an AI management system and continuous improvement.

CCOs can use these frameworks to organize governance while counsel maps applicable legal obligations. Framework adoption should produce identifiable owners, documented assessments, testing records, escalation procedures, and corrective actions. Vendor oversight deserves particular attention. Request evidence supporting performance claims. Examine contractual access to incident information, material change notifications, and relevant testing. Determine how the company will respond if a vendor cannot explain a harmful result or promptly correct a defect.

The board should receive reporting that connects AI risk to business exposure. Useful measures include significant incidents, overdue corrective actions, unapproved deployments, and exceptions to required review. Management should explain who has authority to suspend a system and what circumstances would trigger that decision. That authority must be usable when commercial pressure favors continued deployment.

Prediction Markets and Conflicts of Interest

Prediction markets introduce a compliance problem that reaches well beyond the companies operating them. Employees may possess confidential information about an event or influence its outcome while having an opportunity to trade on that outcome. The potential conflict deserves attention even when an employee views the transaction as a small personal wager.

In February 2026, the CFTC’s Division of Enforcement issued an advisory discussing two disciplinary cases handled by Kalshi. One involved a political candidate trading on his own candidacy. The second involved a video editor trading contracts connected to content about which the editor likely had advance knowledge. The advisory identified potential violations involving fraud and misuse of confidential information. For corporate compliance teams, the lesson is clear: existing policies may not address how employees use company information outside conventional securities transactions.

Consider an employee who knows when an important product announcement will occur. Consider another who helps determine the timing of a public communication. If a relevant event contract is available, either employee could face a conflict involving confidential information, influence over the outcome, or both. Legal treatment depends on the facts, applicable law, and market rules. Company policy can establish a clear behavioral standard while counsel evaluates those requirements.

Review your organization’s confidentiality, personal trading, conflicts, and acceptable-use policies together. Determine whether they expressly address event contracts, tipping others, and transactions involving outcomes an employee can influence. Define the scope carefully enough that employees understand it and compliance can administer it consistently.

Training should use business-specific examples. Relevant employees could include executive assistants, communications personnel, product teams, government affairs staff, and contractors. Access to sensitive information often extends well beyond senior management. Provide a route for questions before a transaction occurs. Where proportionate, establish disclosure or preclearance requirements for sensitive roles. Any monitoring should be designed with legal and privacy input. Boards should ask whether management has assessed this exposure and assigned responsibility for closing policy gaps.

What CCOs and Boards Should Do Next

These three priorities call for a focused response:

  1. Refresh the risk assessment. Identify government relationships, AI uses, and confidential information exposures that warrant additional scrutiny.
  2. Test investigation readiness. Conduct a preservation exercise and confirm escalation arrangements for allegations involving senior leaders.
  3. Examine AI controls. Select consequential systems and test whether ownership, review, monitoring, and corrective action work in practice.
  4. Update conflicts guidance. Address prediction markets explicitly and train employees whose information or influence creates exposure.
  5. Give the board an accountable plan. Assign owners, deadlines, and evidence of completion, then report unresolved weaknesses.

The election creates a timely reason to examine these issues. The business case extends beyond any election cycle. Effective compliance helps management make defensible decisions, protects information entrusted to employees, and gives directors a reliable basis for oversight. The CCO’s next board presentation should explain where exposure has changed, what management is doing about it, and how the company will demonstrate that its response works.

Categories
Blog

Anthropic’s IPO: A 90-Day Action Plan for Your Compliance Program

You don’t need to build frontier AI models to learn from the risks examined in this series. If your company purchases AI services, connects them to business systems, or relies on their outputs, those choices belong in your compliance risk assessment. The practical question is what you will do differently on Monday morning.

Parts I and II examined ten risks arising from Anthropic’s registration statement. Part III translated them into lessons for compliance professionals. Part IV considered the questions its Safety and Risk Committee should ask. This concluding post brings the discussion to your company, with a 90-day plan to turn those lessons into operating decisions and meaningful board oversight.

The objective is a defensible starting point: know your consequential AI uses, assign responsibility, test critical safeguards, and give directors a clear account of unresolved exposure. Ninety days can establish that discipline. Continuing review must sustain it.

Translate the risk into your business

Start with how the technology operates in your environment. Your company may have little control over a provider’s model development, but it can decide what data to supply, which systems to connect, what permissions to grant, and which outputs require verification.

Consider a manufacturer introducing an AI procurement assistant. Initially, it summarizes supplier proposals. Later, it ranks vendors, drafts diligence reports, and prepares payment instructions. Each expansion changes the compliance analysis. A tool that once saved reading time now influences third-party selection and financial controls.

A CCO should connect those changes to existing responsibilities: conflict disclosures, intermediary diligence, restricted-party screening, approval limits, and accurate records. This makes the conversation relevant to procurement, finance, and management. The issue is whether the business process remains controlled as the tool takes on more responsibility.

Days 1–30: Establish visibility and ownership

Convene a working group with procurement, technology, security, privacy, legal, finance, and relevant business leaders. Use existing governance forums where they work. Ask each function to identify AI uses that affect sensitive information, consequential decisions, external communications, or transactions.

Next, combine those discussions with available purchasing records, software inventories, and security information. Include AI features added to existing applications and tools employees obtain outside normal procurement. Explain that disclosure enables assessment and support. Employees need a practical way to surface uncertain uses.

For each consequential use, record the business purpose, accountable executive, provider, information involved, connected systems, permissions, and affected stakeholders. Identify whether the tool advises a person or can act independently. Document known gaps in the inventory so management understands its limits.

Prioritize according to potential harm, applicable obligations, reversibility, and the reach of an error. A public-information drafting tool should receive proportionate review. An agent that changes supplier records or handles confidential investigation material warrants closer scrutiny.

Assign business ownership explicitly. The CCO coordinates the compliance assessment and challenges weaknesses; business leaders remain responsible for their processes. Security, privacy, legal, and technology teams own their respective controls and advice—document who can approve, restrict, or suspend a use and how disagreements escalate.

Day-30 deliverable: A prioritized inventory with accountable owners, immediate safeguards, unresolved questions, and the three to five uses requiring deeper review. Address urgent exposure immediately rather than waiting for the next phase.

Days 31–60: Test the controls that matter

Select the highest-priority workflows and trace an actual transaction or decision from beginning to end. Identify what the AI receives, what it produces, who relies on it, and what can happen before a person intervenes.

In the procurement example, test whether the assistant can recommend a supplier before diligence is complete. Determine whether generated summaries preserve the underlying evidence. Check whether it can change payment details or prepare instructions without independent verification. Use realistic scenarios, including incomplete information and attempts to bypass approval requirements.

Treat human review as a control requiring evidence. Does the reviewer have the source information, time, expertise, and authority to challenge the output? A mandatory approval click provides limited assurance if employees routinely accept recommendations without examination.

Examine the provider relationship alongside internal controls. Ask procurement and counsel to assess data-use terms, retention, incident notification, subcontracting, material service changes, and available assurance information. Document gaps and business consequences. Where negotiating power is limited, consider restricting the use or adding safeguards within your environment.

Test operational resilience. Can the company revoke access, recover necessary records, and continue a critical process if the service fails or becomes unsuitable? Identify dependencies shared across applications. A fallback process needs an owner and an exercise demonstrating that it works.

Translate findings into corrective actions with deadlines and interim protections. Give employees short, role-specific instructions about approved tools, sensitive information, verification, and reporting unexpected behavior. Include a realistic scenario in team training and invite questions about work pressures that encourage shortcuts.

Day-60 deliverable: A documented assessment of selected workflows showing tested controls, failures, limitations, remediation owners, and proposed decisions. Label what remains untested so management does not mistake partial assurance for comprehensive coverage.

Days 61–90: Exercise the response and inform the board

Run a tabletop exercise involving one consequential AI use. For the manufacturer, assume the procurement assistant exposes confidential supplier information and produces unreliable diligence summaries. Ask who detects the problem, limits access, preserves evidence, and determines which decisions require rechecking.

Bring communications, legal, and business leaders into the exercise to support buy-in and internal subject matter expertise. Examine how they assess customer or supplier communications and any applicable notification requirements—test when executives and directors receive notice. Record delays and unclear responsibilities, then assign corrective work.

Retest priority fixes from the previous phase. Internal audit or another qualified reviewer, where appropriate, should challenge management’s conclusion that serious weaknesses have been resolved. For a smaller company, obtain independent expertise selectively where internal capability is insufficient.

Build change review into normal operations. New data connections, expanded permissions, provider updates, and changed business purposes should trigger reassessment proportionate to their significance. Set a recurring cadence to review incidents, exceptions, overdue remediation, and critical dependencies.

Day-90 deliverable: An evidence-based management and board briefing, supported by exercise results and verified remediation. Include a funded plan for remaining work, named owners, and the decisions needed to proceed within approved limits.

Help the board make decisions

Part IV examined Anthropic’s Safety and Risk Committee. Your company should allocate oversight based on its risks, committee responsibilities, and available expertise. A dedicated committee is one possible arrangement. Clear responsibility and coordination are essential, regardless of the structure the board uses.

Prepare a concise briefing around five items: consequential AI uses, material control gaps, testing results, significant incidents or exceptions, and decisions requiring director attention. Explain the business effect of each issue. A request to restrict system access should identify the exposure addressed, operational consequences, and alternatives.

Clarify coordination across audit, risk, compensation, technology, and other relevant responsibilities. Financial reporting concerns, employee incentives, and security incidents may intersect. Establish who leads and how information reaches the full board.

Give directors three questions they can use immediately:

  • Which AI use creates our most significant unresolved exposure, and who owns it?
  • What testing demonstrates that our most important safeguards work, and what remains uncertain?
  • What decision or resource commitment does management need from us today?

Arrange private access for the CCO and relevant control leaders. Preserve records of substantive challenge, decisions, and follow-up. The board should receive enough information to oversee management while management remains accountable for operating the controls.

Measure progress and keep the discipline.

Measure changes in exposure alongside completed activities. Track whether priority uses have tested safeguards, critical permissions have been restricted, serious fixes have been verified, and material changes are reviewed on time. Explain the scope and limitations of each measure.

Compliance teams should apply the same discipline to their own AI tools. Diligence, monitoring, and investigation applications require appropriate confidentiality protections and validation. Check an AI-generated conclusion about misconduct against the underlying evidence before it informs a consequential decision.

The same method can strengthen compliance beyond AI. A weak escalation route, an unsupported product claim, or an untested supplier contingency is a program issue regardless of the technology involved. Ask where each finding may recur across other business units and processes. Use that analysis to update the enterprise risk assessment and internal audit priorities.

Resource decisions should follow the evidence. Identify what existing teams can absorb, where specialist support is necessary, and which planned uses should wait until safeguards are ready. This gives executives a concrete basis for choosing priorities and funding corrective work.

The business value is practical: better-supported decisions, clearer accountability, and fewer avoidable disruptions when technology changes. A company that understands its approved uses and safeguards is better positioned to deploy AI with confidence.

The lesson running through this series is that governance commitments acquire value through daily operating choices. For the compliance professional outside Anthropic, the next step is within reach: identify one consequential workflow, bring its owner into the discussion, and test whether the controls still work. Use the findings to improve the program and give the board a decision it can act upon.

Conclusion

As readers of my blog posts know, I often start on a blog or two, only to get carried away by the subject matter. This week was no exception. Given all the hyperbole around Anthropic, I started only wanting to see if there was anything tangible.

I can remember back in the first decade of this century, in the early days of enterprise-wide risk assessments, consultants would bring us risks such as a meteor or comet strike as a teaching tool. This inevitably bogged business leaders in wildly improbable, sci-fi-level catastrophes. This led many business leaders at the time to take ERM less seriously than they should have if the consultants had been more business-grounded.

The more I studied the Anthropic IPO and wrote this series, the more I saw applicability to what CCOs and compliance professionals need to do today. The compliance professional of 2026 faces different challenges than the compliance professional in 2010, 2015, and certainly anytime pre-pandemic. Even in the 2020’s we have had as much business instability and change from the iterations of the Trump Administration(s).

I want every CCO and compliance professional to understand that the basic principles of compliance still apply, even with the breakneck speed of technological development, and that by using tested principles from the past 20 years, we can continue building the groundwork for compliance. The bottom line is that more effective compliance still means more efficient controls, which lead to greater ROI and profitability.

Categories
Blog

Anthropic’s IPO: Twelve Questions for the Safety and Risk Committee

In Parts I and II, we examined ten corporate compliance risks arising from Anthropic’s Registration Statement. In Part III, we translated those risks into five lessons for compliance professionals. Today, I want to explore 12 questions where those lessons should land at the board level. Anthropic’s Safety and Risk Committee (the “Committee”) provides a specific place to begin.

The registration statement describes a committee consisting of two independent directors, Christopher Liddell and Vas Narasimhan, with Narasimhan serving as chair. Its responsibilities encompass oversight of model safety and security, including the policies, processes, and controls for managing significant model risks. The committee also helps the board oversee other material risks, including legal, regulatory, cybersecurity, privacy, and compliance risks.

That breadth matters. Model safety, commercial decisions, and enterprise compliance can affect one another. A new capability can change misuse exposure. A distribution partnership can complicate access restrictions. A deployment decision can create questions about whether customer representations remain supportable.

The filing states that the committee operates under a board-approved written charter. Its summary does not establish every approval right, reporting arrangement, or escalation threshold. The following twelve questions are my recommended oversight agenda, rather than a description of procedures Anthropic has adopted or findings that its controls are deficient.

1. Which risks require the committee’s closest attention?

A broad mandate requires disciplined prioritization. The Committee should ask management which combinations of model capability, user access, and business activity could create the most serious harm or compliance exposure.

What has changed since the last review? Has a model gained new capabilities, an agent received broader permissions, or a commercial arrangement introduced new users and jurisdictions? Which changes require additional safeguards before deployment or expansion?

Evidence to request: A prioritized assessment connecting material risks to accountable executives, key controls, unresolved gaps, and decisions requiring committee attention. The assessment should explain uncertainty and the risk remaining after safeguards are in place.

The practical lesson is to organize the agenda around consequential decisions. A catalog of risks becomes useful when directors can see what management must do about them.

2. Are responsibilities and escalation routes clear?

The Committee should ask how its work connects to the full board and other Committees. The filing also assigns risk assessment and risk management policy review to the audit committee. Overlapping responsibilities make coordination essential.

Who leads when a safety incident raises questions about investor disclosures, financial exposure, or executive incentives? What requires immediate notification to the committee chair? When must an unresolved issue reach the full board?

Evidence to request: A responsibility map, notification thresholds, and records demonstrating how significant matters move between management, committees, and the board.

The Committee should also establish what happens when management recommends deployment despite a serious unresolved concern. Directors need clarity about who decides, who advises, and who receives notice. They should confirm any authority to require a pause against the actual charter and board delegations.

3. Can independent challenges reach the committee?

Technical expertise is essential, but expertise alone does not guarantee that dissent reaches directors. The Committee should ask whether compliance, legal, security, and safety leaders can present concerns directly, including disagreements with senior management.

Where do staffing, specialist expertise, or information restrictions limit effective challenge? Which recommendations have management declined, and what exposure remains? Can the Committee obtain independent advice when internal assessments conflict?

Evidence to request: Reporting arrangements, material resource gaps, significant unresolved disagreements, and the process for obtaining outside expertise.

Private sessions with relevant control leaders can help directors understand what formal presentations omit. Those sessions should produce clear follow-up where necessary. The test is whether an uncomfortable finding can reach the committee early enough to influence a consequential decision.

4. Do incentives and culture support safety commitments?

The committee should examine how commercial and development pressures affect employee behavior. What happens when testing identifies a concern that could delay an important release? Are employees rewarded for surfacing weaknesses and resolving them?

How does management identify retaliation or other consequences for raising concerns? Do employees have reporting channels that work when an issue crosses technical, legal, and commercial boundaries?

Evidence to request: Employee feedback, significant safety and compliance reports, retaliation follow-up, and examples of decisions changed because employees challenged an assumption.

Where incentives appear to undermine controls, the Committee should coordinate with other relevant committees, such as a compensation committee (if one is ever created). A falling report count requires explanation. It could reflect fewer problems, less trust in reporting, or weaker detection. Directors should ask what evidence supports management’s interpretation.

5. Do safety controls work under realistic conditions?

The Committee should ask what testing establishes about the effectiveness of important safeguards. Which scenarios were examined, what failed, and what limitations remain in the assurance provided?

A model performing well in a controlled evaluation may behave differently when connected to tools, sensitive information, or persistent workflows. Directors should ask whether testing reflects the deployment environment and foreseeable attempts to defeat restrictions.

Evidence to request: Evaluation coverage, significant failures, independent challenges, exceptions, and evidence that corrective measures have been retested.

A useful question is, “Show us an instance in which a safeguard detected a serious problem and enabled intervention.”

Management should explain the detection, the response, and what the example does and does not establish about broader control effectiveness.

6. Are autonomous agents constrained by enforceable limits?

Agent oversight deserves specific attention because authority to act changes the consequences of error or misuse. The Committee should ask what agents can access, change, transmit, purchase, or execute without additional approval.

What prevents an agent from exceeding its permissions? Which actions require meaningful human review? Can the company revoke credentials, contain activity, and preserve evidence when behavior becomes unsafe?

Evidence to request: Permission boundaries, approval requirements, monitoring results, intervention exercises, and records of unauthorized or unexpected actions.

Directors should scrutinize the human review process. A reviewer needs sufficient information, time, and authority to challenge the proposed action. Management should demonstrate that intervention works under realistic conditions and that safeguards remain effective after changes to tools or permissions.

7. Are data protection and intellectual property risks connected to safety oversight?

The Committee’s enterprise remit should bring data and intellectual property questions into the discussion. Which sensitive information supports model development or enters deployed systems? What access, retention, and use restrictions apply?

Can management substantiate its rights to use critical datasets and software? How would the business respond if those rights were challenged or access were lost? What could a security compromise expose beyond immediate service disruption?

Evidence to request: Material data flows, significant security findings, unresolved rights questions, access controls, and incident-exercise results.

The Committee should examine operational consequences alongside legal exposure. A disputed dataset, compromised credential, or exposed model asset may require changes to products, access arrangements, and customer communications. Management should explain how those decisions would be coordinated.

8. Can partners preserve the safeguards Anthropic relies upon?

The Committee should ask where cloud providers, distribution partners, data suppliers, and other critical relationships affect safety and compliance controls.

Which safeguards depend on a partner’s actions? Can management detect prohibited access or misuse through indirect channels? What information, notification rights, and assurance evidence are available when a partner controls part of the environment?

Evidence to request: Critical dependency maps, material contract exceptions, unresolved diligence findings, monitoring results, and tested contingency plans.

Concentration requires particular scrutiny. Several commercial relationships may depend on the same infrastructure. The Committee should ask what management could actually do if a critical provider failed to meet requirements, including how quickly access could be restricted or essential services maintained.

9. Do legal restrictions translate into operational controls?

Sanctions, export controls, anti-corruption obligations, and government interactions require attention across the commercial lifecycle. The Committee should ask how management identifies relevant restrictions and converts them into controls over sales, delivery, support, and access.

Where could resellers, shared accounts, intermediaries, or unusual payment arrangements obscure the actual customer or activity? Which exceptions require escalation, and who approves them?

Evidence to request: Material screening exceptions, access-control testing, high-risk intermediary reviews, and significant unresolved compliance matters.

The Committee should connect these findings to deployment decisions. A policy prohibiting certain access provides limited assurance if the delivery architecture cannot enforce the restriction or identify attempts to bypass it. Management should explain both preventive controls and detection capabilities.

10. Are external claims consistent with internal findings?

The Committee should examine how evidence about safety, reliability, privacy, and security informs product representations and material disclosures. Which claims depend on testing with significant limitations?

What happens when an incident contradicts a public statement? How do safety and compliance findings reach legal, communications, finance, and the disclosure process?

Evidence to request: Substantiation for significant claims, unresolved discrepancies, and records showing how material incidents affect communications decisions.

Financial reporting and investor disclosure matters require coordination with the audit committee and responsible management. The Safety and Risk Committee contributes by ensuring relevant risk information reaches those processes. Ask management which important claim would be hardest to substantiate today, and why.

11. Are investigations independent and connected to decisions?

A significant incident may involve technical failure, misconduct, or both. The Committee should ask who determines investigative scope when allegations concern senior executives, deployment decisions, or the suppression of safety findings.

Are evidence preservation and interim safeguards timely? Who evaluates reporting obligations and potential disclosure decisions with appropriate counsel? What requires independent oversight?

Evidence to request: Suitably protected summaries of significant matters, independence arrangements, interim measures, and outstanding decisions.

The Committee should also examine how the issue came to light. Internal detection, an employee report, a customer complaint, and external discovery reveal different strengths and weaknesses. That detection path should inform improvements to monitoring and reporting.

12. Does remediation withstand independent verification?

Closing an action item should require evidence that the underlying problem was addressed. What failed in the process, permissions, incentives, or supervision? Where else could the same weakness exist?

Who owns each corrective action, what remains overdue, and which interim safeguards protect the business while work continues?

Evidence to request: A remediation record showing severity, owner, deadline, verification results, and repeat findings.

Retesting should reflect the conditions that produced the original failure. The committee should ask who performed the validation and what limitations remain. A revised policy or completed software change is an output. Demonstrated improvement in control performance is the outcome directors need to understand.

An agenda for the next committee meeting

Ask management to present the five most consequential unresolved safety and enterprise compliance risks. For each, require evidence, the accountable executive, available options, and the decision needed. Schedule a private session with relevant control leaders and examine one recently closed remediation item.

Confirm coordination arrangements with the audit and compensation committees. Record substantive challenges, decisions, responsibilities, and follow-up. The final question should be practical: What must this committee escalate or recommend today to make Anthropic’s safety and compliance commitments effective in operation?

Categories
Blog

Anthropic’s IPO: 5 Lessons for Corporate Compliance Professionals

The most important question arising from Anthropic’s IPO disclosures is what compliance professionals should do with the risks they reveal. Identifying exposure begins the analysis. The business challenge is building a program that can manage that exposure.

In Parts I and II, I examined ten corporate compliance risks, ranging from AI safety and regulatory enforcement to third-party dependencies, financial reporting, and board oversight. In this blog post, I want to turn those risks into five practical lessons CCOs, general counsel, directors, and business leaders can use today to manage AI compliance.

Those lessons extend beyond AI developers. A manufacturer using AI in procurement, a financial services company deploying customer-facing tools, or a professional services firm connecting AI to confidential records must understand how those uses affect its control environment. Purchasing the technology does not eliminate the need to govern its use.

The central issue is accountability. Who owns the risk? Which controls address it? How does management know those controls work? What happens when they fail? These are familiar compliance questions. AI makes the answers more urgent.

1. AI governance must become part of enterprise compliance.

A standalone AI ethics policy cannot carry the weight of an enterprise compliance program. Principles require operational decisions: what uses are permitted, what information systems may access, what actions require approval, and who can suspend deployment. Start with an inventory of AI uses across the business. Include purchased applications, internally developed systems, employee experimentation, and AI features embedded in existing software. For each use, identify the business owner, data involved, decisions supported, and authority granted. A drafting assistant and an agent authorized to initiate payments require different controls.

Then connect the inventory to the enterprise risk assessment. Classify uses according to potential harm, legal exposure, sensitivity of information, and difficulty of reversing an action. Assign control owners and specify when reassessment is required. A new data connection or expanded permission can change the risk without changing the product name. Governance also requires decision rights. Compliance, legal, security, technology, and business teams should understand their respective responsibilities. Disagreements about deployment need a documented escalation route, including authority to delay implementation when critical safeguards remain unresolved.

Frameworks such as the NIST AI Risk Management Framework and ISO/IEC 42001 can help organize this work. Their practical value depends on whether the company translates its chosen approach into operating responsibilities and verifiable controls.

The CCO question: Can we identify the accountable owner and supporting controls for every material AI use?

2. Traditional compliance risks remain fundamental

AI changes how misconduct can occur and how quickly its effects can spread. Established compliance disciplines still provide the starting point for identifying the exposure. Consider a hypothetical procurement agent that recommends vendors and prepares payment instructions. Its technical performance may appear strong while its workflow bypasses conflict disclosures, restricted-party screening, or approval requirements. Faster processing can amplify a weak control environment.

The appropriate response is to examine the underlying business process. Map where an AI system receives information, makes recommendations, changes records, or initiates actions. Identify the approvals, segregation of duties, documentation, and monitoring that must remain effective at each stage. Determine whether automation has created a new route around an existing safeguard. Anti-corruption controls illustrate the point. An intermediary recommended by an AI tool still requires appropriate diligence. A model-generated payment description still requires verification. A confident recommendation cannot substitute for evidence about ownership, services performed, compensation, or government connections.

Training should reflect these practical choices. Employees need examples showing when to question an output, obtain approval, preserve records, or report a concern. Generic instructions to use AI responsibly provide little help when a system recommends a questionable transaction under commercial pressure. The CCO should also examine incentives. Employees measured solely on speed or volume may have little reason to challenge an automated recommendation. Managers must support escalation when verification delays a transaction.

The CCO question: Where could AI bypass, weaken, or obscure a control we already depend upon?

3. Third-party risk management must include technology dependencies

Traditional third-party programs often focus on agents, distributors, consultants, and other commercial intermediaries. AI requires equally careful attention to model providers, cloud infrastructure, data suppliers, integration partners, and subcontractors supporting critical services. The first task is dependency mapping. Determine which providers support essential workflows, what information they receive, and whether multiple applications depend on the same underlying service. Several vendor contracts may conceal a single point of operational failure.

Due diligence should follow the actual use. A tool that processes public information raises different concerns than a service that accesses customer records or executes transactions. Ask how information is retained, whether it may be used for training, how access is controlled, and what changes the provider can make without customer approval. Contracts should support the controls the company needs. Depending on risk, that may include incident notification, restrictions on data use, information about subcontractors, access to assurance evidence, and notice of material service changes. Legal and procurement teams should identify gaps before the business becomes dependent on the service.

Monitoring must continue after onboarding. Provider updates can affect performance, permissions, or data handling. Assign responsibility for reviewing material changes and deciding when testing must be repeated. Finally, test the exit plan. Can the business recover its information, revoke access, and maintain essential operations if the relationship ends? A contractual termination right offers limited protection when no workable alternative exists.

The CCO question: Which technology dependencies could prevent us from meeting critical obligations, and what is our tested response?

4. Compliance must be embedded in product development

Compliance review is most useful while business and technical choices can still be changed. Waiting until launch makes it harder to address weaknesses in data access, system permissions, customer communications, or monitoring. The Evaluation of Corporate Compliance Programs (ECCP) expressly addresses how companies assess and manage risks associated with AI and other emerging technologies. That provides an enforcement-informed reason to integrate AI risk into the broader compliance program.

For the CCO, the practical response is a development process with review points proportionate to risk. Assess the intended use before development, review controls during testing, document approval before deployment, and monitor behavior afterward. Material changes should trigger renewed review. Testing should examine foreseeable misuse and control failure alongside normal performance. Can a user induce unauthorized disclosure? Can an agent exceed its permissions? Does the system preserve records needed to investigate an incident? Can a human reviewer meaningfully intervene?

A nominal human approval step deserves particular scrutiny. If reviewers lack time, information, or authority to challenge recommendations, the safeguard may offer little protection. Test how people actually review realistic workloads. Compliance also needs access to relevant information and sufficient technical support to assess the results. Establish channels for employees to report unexpected behavior without first proving a technical defect. Investigations should connect incidents to root causes and corrective action.

The CCO question: At what development decisions can compliance require changes, and what evidence supports approval?

5. Boards must demand evidence of effectiveness

Board oversight depends on information that enables challenge. Counts of policies issued, training completed, and committee meetings held describe activity. Directors also need evidence about whether material risks are being controlled. Management reporting should identify significant AI uses, unresolved control weaknesses, incidents, overdue remediation, and decisions to accept residual risk. Explain what changed since the previous report and whether the change affects the company’s ability to operate within approved limits.

Metrics need context. An increase in reported incidents may reflect improved detection rather than worsening performance. A low incident count may conceal weak monitoring. Directors should ask how management interprets the numbers and what independent testing supports that interpretation. Reports should also surface disagreements and exceptions. If management approved deployment despite an unresolved compliance concern, the board needs to understand the decision, compensating controls, accountable executive, and deadline for reconsideration. Commercial significance should increase the quality of scrutiny.

Directors do not need to reproduce technical testing. They need reliable reporting, access to appropriate expertise, and a clear process for following material concerns through remediation. Meeting records should capture substantive questions, commitments, and follow-up. The board question: What evidence would cause management to restrict or suspend an AI deployment, and has that response been tested? The larger lesson: turn commitments into operating discipline

Anthropic’s disclosures bring emerging technology risk, traditional compliance obligations, and governance expectations into one discussion. The practical response is an integrated program that connects business decisions to accountable owners, tested controls, and timely escalation.

Begin with three actions: identify the most consequential AI uses, test whether existing controls cover them, and present unresolved gaps to the appropriate decision-makers. Assign deadlines and verify remediation. Give business owners clear responsibility for explaining remaining gaps and reporting progress until corrective work is complete.

For CCOs and boards, measure progress by whether the organization can demonstrate that its controls work as capabilities, permissions, and business uses change. That is how AI governance becomes an effective business discipline. The following is my qualitative assessment, not a quantitative risk score disclosed by Anthropic. The rankings reflect the combined importance of regulatory exposure, potential harm, and control complexity.

Rank Corporate compliance risk Priority Primary accountability
1 AI safety and autonomy Critical Chief AI/Safety Officer, CCO
2 Regulatory enforcement Critical General Counsel, CCO
3 Privacy and cybersecurity Critical CISO, Privacy Officer
4 Intellectual property Critical General Counsel
5 Export controls and sanctions Critical Trade Compliance, CCO
6 Third-party risk High Procurement, CCO
7 Anti-bribery and corruption High CCO
8 Financial reporting and disclosure High CFO, Audit Committee
9 Corporate governance High Board, General Counsel
10 Consumer protection High Legal, Product Compliance

Categories
Blog

Anthropic’s IPO: Top 10 Corporate Compliance Risks, Part II

What does it take to build an effective compliance program around an AI business? In Part I of this series, Tom Fox examined the first five of 10 key risks for compliance professionals identified in Anthropic’s IPO disclosures: AI safety and autonomy, regulatory enforcement, data privacy and cybersecurity, intellectual property, and export controls. Each raises a practical question for CCOs and boards: can management demonstrate that its governance and controls are effective as the technology advances?

The remaining five risks extend that inquiry across the enterprise. Third-party dependencies, bribery and corruption, financial reporting, board oversight, and product representations are familiar responsibilities for compliance professionals. In an AI business, however, those responsibilities must account for powerful commercial partners, rapid international expansion, complex infrastructure dependencies, and claims about technology whose performance can be difficult to validate.

This is where compliance must be embedded in business decisions. Due diligence must inform partner selection. Disclosure controls must support investor communications. Product claims must rest on evidence. Board reporting must give directors enough independent information to challenge management and require corrective action.

6. Third-party risk, strategic partnerships, and supply-chain dependencies

The disclosed risk: Anthropic identifies substantial dependencies involving computing infrastructure, cloud providers, strategic partners, vendors, and commercial intermediaries.

The compliance exposure: Critical third parties may create cybersecurity, data protection, sanctions, operational resilience, concentration, and regulatory compliance risks. A control failure at a cloud provider or commercial partner can become an enterprise-level compliance incident.

The CCO response: Apply risk-based third-party due diligence, contractual control requirements, audit rights, continuous monitoring, concentration-risk assessments, and exit planning for critical suppliers.

The Board question: Which third-party relationships could materially impair the company’s ability to operate lawfully or meet its compliance obligations if they failed?

7. Anti-bribery, corruption, and financial crime

The disclosed risk: Anthropic expressly identifies obligations under the FCPA, UK Bribery Act, anti-money laundering laws, and comparable international requirements. It acknowledges risks arising from third-party intermediaries, government interactions, lobbying, and international expansion.

The compliance exposure: Global sales and government contracting can create opportunities for improper payments, questionable intermediary compensation, conflicts of interest, and corrupt procurement activity. The company acknowledges that it may face liability for third-party misconduct even when it has not expressly authorized the conduct.

The CCO response: Implement risk-based third-party due diligence, beneficial ownership checks, government-interaction controls, transaction monitoring, gifts-and-hospitality procedures, and continuous testing of intermediary payments.

The Board question: Does the anti-corruption program cover the full network of resellers, intermediaries, agents, and other parties involved in global commercialization?

8. Financial reporting, disclosure controls, and public-company readiness

The disclosed risk: Anthropic highlights the difficulty of accurately forecasting revenues, expenses, computing requirements, and business performance. It also acknowledges that certain operational metrics depend on internal methodologies, assumptions, and systems that have not been independently verified.

The compliance exposure: Rapid growth and complex financial arrangements can create significant risks involving revenue recognition, valuation, financial reporting, internal control effectiveness, and potentially misleading investor disclosures. The transition to a public company raises expectations for disclosure controls, audit committee oversight, and Sarbanes-Oxley compliance.

The CCO response: Strengthen disclosure committees, financial control testing, management certifications, data lineage, audit trails, and review of operational metrics included in investor communications.

The Board question: Can management substantiate every material financial and nonfinancial performance metric disclosed to investors?

9. Corporate governance, board oversight, and conflicts of interest

The disclosed risk: Anthropic’s registration statement addresses its distinctive governance structure, long-term public benefit objectives, capital structure, and relationships with investors and strategic partners.

The compliance exposure: Complex governance arrangements may create tensions among shareholder interests, management incentives, public benefit commitments, safety obligations, and commercial pressures.

The CCO response: Establish explicit board-level risk ownership, documented escalation requirements, independent compliance reporting, conflict-of-interest procedures, and regular assessments of governance effectiveness.

The Board question: Does the board receive sufficient independent information to challenge management’s decisions regarding AI safety, regulatory compliance, and commercialization? For directors, the central issue is whether governance mechanisms support meaningful oversight of mission-critical risks, consistent with the principles associated with Delaware’s Caremark oversight doctrine.

10. Consumer protection, product representations, and misleading AI claims

The disclosed risk: Anthropic identifies risks involving model reliability, accuracy, safety, marketing representations, customer expectations, and consumer protection enforcement. Its financial statement disclosures also identify litigation alleging deceptive advertising concerning subscription plans, allegations the company disputes.

The compliance exposure: AI companies may face liability when representations concerning safety, capabilities, reliability, privacy, or performance exceed what testing and operational evidence can support.

This risk is particularly significant when customers rely upon AI outputs for consequential decisions or deploy AI agents with authority to act.

The CCO response: Require legal and compliance review of material AI product claims, retain supporting testing evidence, establish performance validation standards, and monitor customer complaints for indications of misleading representations.

The Board question: Do the company’s public claims about AI safety and performance have documented, independently challengeable evidence to support them?

Part II completes Tom’s compliance-focused ranking of Anthropic’s disclosures with risks six through ten. Their position on the list should not diminish the attention they receive. A failure in any one of these areas can expose weaknesses across the broader control environment. For each, he considers the disclosed risk, the compliance exposure, the CCO response, and the question directors should ask.

Across these ten risks, a common thread emerges: effective AI governance depends on the quality of the company’s underlying compliance program. Third-party oversight, reliable disclosures, independent challenge, and substantiated product claims require accountable owners, tested controls, and timely corrective action. These responsibilities extend to any business incorporating AI into its operations.

Tomorrow in Part III, Tom will translate this risk analysis into five practical lessons for CCOs and business leaders. The focus moves from identifying exposure to managing it: integrating AI into enterprise compliance, adapting traditional controls, overseeing technology dependencies, embedding compliance in product development, and giving boards evidence of effectiveness. For compliance professionals, the next step is to turn these lessons into decisions about how to approve, deploy, monitor, and control AI.

Categories
FCPA Compliance Report

ACI FCPA and Global Anti-Corruption Conference 2026 Speaker Preview Podcast Series, Lamia Matta

In this episode of the FCPA and Global Anti-Corruption Conference 2026 Speaker Preview Podcast series, Lamia Matta discusses her panel at the pre-conference workshop event, “The Compliance Crisis Simulation: Managing a High-Pressure Global Bribery Investigation From Allegation to Resolution.” Some of the issues she discusses in this podcast and her presentation are:

  • Her workshop will be a compliance crisis simulation in which the audience acts as the response team managing a fast-moving global bribery investigation using live polling as new facts, data leaks, and regulator threats emerge, including privacy-law constraints in Europe or China and communications challenges from media leaks.
  • Matta hopes to hear from enforcement officials and benchmark with peers on cooperation, self-disclosure, and practical compliance challenges.

As global enforcement priorities shift and anti-corruption risks grow more complex, staying ahead requires direct insight from those shaping, interpreting, and navigating the regulatory landscape.

Returning to Washington, DC, this December 10-11, ACI’s flagship FCPA and Global Anti-Corruption Conference brings together an unparalleled gathering of government enforcement officials, in-house compliance leaders, and top legal practitioners from around the world. Gain firsthand insights, benchmark strategies with industry peers, and walk away with practical approaches to strengthen compliance programs, manage emerging risks, and prepare for what’s next. Few events offer this depth of expertise, access, and opportunity to connect with the global anti-corruption community.

I hope you can join us. For event details, click ⁠here⁠. As an extra benefit to podcast listeners, ACI is offering a 10% discount on the ⁠registration⁠ price. Use discount code D10-999-CPN27 to apply your discount.

The Compliance Podcast Network produces the ACI FCPA and Global Anti-Corruption Conference 2026 Speaker Preview Podcast series. ACI sponsors this series.

Categories
Blog

Anthropic’s IPO: Top 10 Corporate Compliance Risks, Part I

Anthropic’s S-1 Registration Statement (IPO), released on October 26th, offers a revealing look at the emerging compliance challenges of frontier artificial intelligence companies. More importantly, it provides a roadmap for Chief Compliance Officers (CCOs), general counsel, boards of directors, and risk professionals seeking to understand how traditional corporate compliance obligations intersect with increasingly autonomous AI systems.

Responses have been interesting: Matt Kelly, writing in Radical Compliance, identified “100 pages of risks.” Senator Elizabeth Warren, perhaps only now realizing that Skynet may be on the way to becoming ‘self-aware,’ is quoted by the Wall Street Journal (WSJ) as being “deeply troubled” by the risks listed in the IPO “and is demanding answers to a long list of questions before the artificial-intelligence giant goes public.” Ethisphere’s Erica Salmon Byrne noted that the terms of service place most enterprise AI risk squarely on the customer rather than Anthropic.

My conclusion is more down-to-earth and grounded in corporate compliance. Anthropic’s disclosures show that AI governance is no longer simply a question of responsible technology development. It is an enterprise compliance challenge involving regulatory enforcement, internal controls, cybersecurity, third-party oversight, intellectual property, corporate governance, and organizational accountability. This week, I will explore what I see as the Top 10 risks from a corporate compliance perspective. In this blog post, I will consider the first five in ascending order of criticality.

Yet from this exercise, I believe the most significant compliance question is whether a company’s governance and control environment can keep pace with the capabilities of the technology it develops and deploys. The following rankings prioritize potential regulatory exposure, severity of harm, enterprise impact, and the difficulty of designing effective preventive and detective controls. They reflect a compliance-focused interpretation of Anthropic’s disclosures, not the company’s own ranking.

1. AI safety, model autonomy, and inadequate governance controls

The disclosed risk: Anthropic acknowledges that increasingly capable AI models may create significant safety risks, including harmful outputs, misuse, unintended behavior, and failures of existing safety mechanisms. Its disclosure specifically addresses autonomous agents that can execute code, access external systems, conduct transactions, and operate for extended periods with limited human oversight.

The compliance exposure: A company may deploy AI capabilities that exceed the effectiveness of its risk management, monitoring, and internal control systems. This creates potential exposure under consumer protection laws, AI-specific regulations, negligence theories, and contractual obligations.

The CCO response: Establish formal AI risk classifications, independent safety testing, deployment approval gates, continuous monitoring, incident escalation, and documented human oversight. Map these controls to the NIST AI Risk Management Framework and ISO/IEC 42001.

The Board question: Who has the authority to stop deploying a profitable AI product when safety controls are inadequate?

2. Regulatory investigations, enforcement, and evolving AI laws

The disclosed risk: Anthropic reports receiving an October 2026 FTC civil investigative demand seeking information concerning consumer protection, privacy, data protection, and product safety and security. It also identifies a changing regulatory landscape across the United States and international jurisdictions.

The compliance exposure: The risk is not simply that new regulations may impose additional costs. Regulators can investigate whether existing representations, disclosures, safety practices, and customer protections are deceptive, inadequate, or inconsistent with applicable law.

The CCO response: Create an AI regulatory obligations inventory, assign accountable control owners, test compliance with existing consumer protection requirements, and maintain a centralized regulatory inquiry and enforcement response process.

The Board question: Can management demonstrate that the company’s actual AI controls support the representations it makes to regulators, customers, and investors?

3. Data privacy, cybersecurity, and protection of sensitive information

The disclosed risk: Anthropic identifies risks associated with personal data processing, cybersecurity incidents, unauthorized access, cross-border data transfers, and differing privacy requirements across jurisdictions.

The compliance exposure: AI platforms can process enormous quantities of sensitive information. An unauthorized disclosure, improper use of training data, or compromise involving an AI agent could create exposure under the GDPR, California privacy laws, FTC enforcement authority, and contractual data protection obligations.

The CCO response: Require data mapping, privacy impact assessments, access restrictions, encryption, retention controls, vendor security reviews, and incident response exercises tailored to AI systems.

The Board question: Does management understand what sensitive information enters its AI systems, where that information travels, and who can access it?

4. Intellectual property, copyright, and training-data compliance

The disclosed risk: Anthropic acknowledges substantial uncertainty about how copyright law and open-source licensing apply to AI model training. The filing also describes ongoing copyright litigation and a $1.5 billion settlement in the Bartz copyright class action, approved in July 2026.

The compliance exposure: A company’s underlying AI model may depend upon training data for which its rights are disputed. Adverse litigation outcomes could result in substantial damages, licensing obligations, restrictions on training data, or operational changes to deployed models.

The CCO response: Establish documented data provenance, licensing reviews, training-data acquisition controls, legal approval procedures, and records demonstrating the basis for using copyrighted materials.

The Board question: Can the company demonstrate a defensible legal basis for the data used to develop its most commercially significant AI models?

5. Export controls, economic sanctions, and national security restrictions

The disclosed risk: Anthropic identifies exposure under U.S. export controls, sanctions regimes, and potentially the International Traffic in Arms Regulations. Its filing describes June 2026 U.S. Department of Commerce restrictions affecting its Fable 5 and Mythos 5 models, which were later lifted following safeguard updates.

The company also acknowledges that its export and sanctions controls have not always been fully effective and that it has previously made voluntary disclosures of noncompliance.

The compliance exposure: Advanced AI models may constitute controlled technology. Unauthorized model access, improper transfers, sanctioned-country usage, or inadequate customer screening could trigger enforcement, penalties, and loss of export privileges.

The CCO response: Integrate export classification, restricted-party screening, geolocation controls, customer due diligence, access monitoring, and escalation procedures into the product deployment architecture.

The Board question: Can the company prevent restricted users and jurisdictions from accessing controlled AI capabilities, including through intermediaries?

These first five risks establish a central compliance challenge: can a company demonstrate that its controls keep pace with the AI capabilities it develops and deploys? Safety governance, regulatory compliance, data protection, intellectual property, and export restrictions require clear ownership, tested controls, and timely escalation to the board.

In Part II, I will examine the remaining five risks, moving into the business relationships, commercial practices, financial reporting, and governance arrangements that support an AI enterprise. For CCOs and boards, these issues bring the analysis directly into familiar compliance territory. The question is whether established compliance disciplines have been adapted to the speed, scale, and complexity of the AI business.

These first five risks establish a central compliance challenge: can a company demonstrate that its controls keep pace with the AI capabilities it develops and deploys? Safety governance, regulatory compliance, data protection, intellectual property, and export restrictions require clear ownership, tested controls, and timely escalation to the board.

In Part II, I will examine the remaining five risks, moving into the business relationships, commercial practices, financial reporting, and governance arrangements that support an AI enterprise. For CCOs and boards, these issues bring the analysis directly into familiar compliance territory. The question is whether established compliance disciplines have been adapted to the speed, scale, and complexity of the AI business.