Insights

On Monday, September 23, 2024, the Department of Justice (DOJ), released an update to its Evaluation of Corporate Compliance Programs (ECCP) guidance.  The ECCP guidance was last revised in March 2023, which brought a number of significant changes, including a focus on compensation and incentive structures (e.g., clawbacks), and third party messaging applications.  This 2024 update, while not as significant in scope as its predecessor, nonetheless highlights the DOJ’s focus on new and emerging technologies, such as artificial intelligence (AI), as part of its evolving assessment of what makes a corporate compliance program truly effective, and how prosecutors should evaluate risk assessments and other management tools at the time of a corporate resolution.

As the Department of Energy’s (“DOE”) Loan Programs Office (“LPO”) continues to finance clean energy manufacturing and deployment in the United States, the recent announcement by the DOE’s Office of Inspector General’s (“DOE OIG”) that it intends to scrutinize LPO’s due diligence process increases the risk to program applicants. According to a recent notice issued on SAM.gov, the DOE OIG intends to issue a sole source contract for legal support “assessing the policies and procedures” for the due diligence of loan applications, and evaluate specific LPO loans and guarantees to assess their compliance with, consistency in application of, and the effectiveness of LPO policies and procedures, as well as related Governmentwide regulations, policies, procedures, and directives, to identify specific points of weakness in due diligence practices, and to recommend improvements to mitigate risks.

On May 22, 2024, the U.S. Department of Justice’s National Security Division (NSD) announced its first declination to prosecute a company under its Enforcement Policy for Business Organizations (Enforcement Policy).

Over the past few years, the use of Artificial Intelligence (“AI”) has exploded across multiple industries and many financial services institutions have come to rely on AI—or claim to rely on AI—to generate, assist, and complete business objectives.  So, too, has the regulatory scrutiny around “AI washing,” or firms’ overstating or misrepresenting their use of AI to attract investors.  Similar to "greenwashing," where regulators have scrutinized public claims by companies that they are more environmentally friendly than they actually are, the concept of AI washing has come into sharp focus for the Securities and Exchange Commission (“SEC”), evidenced by multiple public warnings and two recent enforcement actions.

While not new, Congressional investigations have certainly been receiving increased press coverage in recent years, raising questions about their scope and potential risk for organizations and individuals. Congressional investigations have some similarities to other law enforcement and regulatory investigations, but are distinct in many respects. This alert will provide guidance about the unique nature of congressional investigations, and how to respond if you are the target of one.

Artificial intelligence (AI) has been at the forefront of public debate since the release of OpenAI’s ChatGPT in November 2022. Since then, numerous AI applications have been released to the public that serve a wide variety of functions, exacerbating the need for governance, as many technical, ethical, and legal questions remain unanswered. As the AI landscape continues to rapidly evolve, the Biden Administration has taken proactive efforts to develop a National Artificial Intelligence Strategy that seeks to mitigate the risks associated with the transformative technology. These efforts include the establishment of guidelines and standards, investments in research and development (R&D) initiatives, collaborative partnerships with major technology companies, and even a national competition with nearly $20 million in awards.

On September 11, 2023, the U.S. Department of Justice (“DOJ”)’s National Security Division (“NSD”) announced the appointment of its first-ever Chief Counsel and Deputy Chief Counsel for Corporate Enforcement, fulfilling a commitment made by DOJ in March 2023. Both appointees are prosecutors with significant experience prosecuting large-scale, international corporate crimes, commensurate with DOJ’s recent emphasis on holding accountable corporate actors that violate national security laws, including sanctions and export controls.

On July 21, 2023, the Biden administration announced that seven companies leading the development of artificial intelligence (AI) -- Amazon, Anthropic, Google, Inflection, Meta, Microsoft, and OpenAI -- have made voluntary commitments, which the companies agreed to undertake immediately, to help move towards safe, secure, and transparent development of AI technology. The goal of the voluntary commitments, or the “AI Agreement” as it is informally dubbed, is to establish a set of standards that promote the principles of safety, security, and trust deemed fundamental to the future of AI.

Local Law 144, New York City’s law governing the use of automated employment decision tools (“AEDTs”), became effective on July 5th, approximately six months after its original effective date and following several rounds of hearings on its proposed and Final Rule.  Just days prior, the New York City Department of Consumer and Worker Protection (“DCWP”) released a set of Frequently Asked Questions (“FAQs”) to provide guidance for covered employers regarding some of the many open questions that have been raised throughout the months since its regulations were first issued.  While the FAQs provide some clarity, many questions remain.

Last week, the U.S. Department of Defense (“DoD”) issued a memorandum explaining new requirements in its efforts to “Counter[] Unwanted Foreign Influence in Department-Funded Research at Institutions of Higher Education” (the “Memorandum”). The Memorandum discusses DoD’s new processes to review proposals from higher education institutions for fundamental research opportunities, with a focus on security threats posed by China, Russia, and other malign actors.

On May 22, 2023, the Department of Consumer and Worker Protection (“DCWP”) held a roundtable on Local Law 144, New York City’s law regulating the use of Automated Employment Decision Tools (“AEDT”), which will go into effect on July 5.  The roundtable followed the “Final Rule” for the New York AEDT law and clarified several open questions that the Final Rule had left unanswered, including the applicability of the law, the scope of data requirements for the bias audit, and the notice requirement.

On May 16, 2023, the U.S. Senate Committee on the Judiciary, Subcommittee on Privacy, Technology, and the Law held a hearing titled “Oversight of A.I.: Rules for Artificial Intelligence.” This hearing is the first in a series intended to provide a forum for industry leaders to discuss and provide an understanding of the implications of A.I. with an eye toward facilitating the development of appropriate guidelines and regulations.

While the Biden’s administration’s recent corporate enforcement actions and initiatives have garnered significant press attention, China has engaged in recent months in a series of less-publicized corporate enforcement actions and initiatives against non-Chinese companies (mostly, but not exclusively, U.S.-based) operating in the country, including through new investigations, raids of China-based offices, and even detention of employees. China has taken many of these actions based on alleged violations of laws established or updated in the last five years, some of which were issued in response to actions taken by the United States in the ongoing U.S.-China Strategic Competition.

Today, the New York City Department of Consumer and Worker Protection (“DCWP”) announced the “Final Rule” for the New York AEDT law (Local Law 144), and stated that the enforcement date is moved back from April 15, 2023, to July 5, 2023.

Last week the U.S. Department of Justice (“DOJ”) and U.S. Department of Commerce announced a new Disruptive Technology Strike Force (the “DIS-TECH Strike Force”). The Strike Force will bring together experts throughout government – including the Federal Bureau of Investigation (“FBI”), Homeland Security Investigations (“HSI”), and 14 U.S. Attorneys’ Offices in 12 metropolitan regions across the country – to target illicit actors, strengthen supply chains, and protect critical technological assets from being acquired or used by nation-state adversaries. The DIS-TECH Strike Force will be co-led by DOJ’s National Security Division (“NSD”) and the Commerce Department’s Bureau of Industry and Security (“BIS”).

On December 23, 2022, the New York City Department of Consumer and Worker Protection (“DCWP”) updated its proposed rules to implement the new automated employment decision (“AEDT”) tools legislation (Local Law 144), which requires employers using AEDTs to publish the results of a bias audit of such tools on an annual basis.  The DCWP issued its initial proposed regulations on September 23, 2022, which was followed by a public hearing on November 4, 2022.  After announcing that the enforcement date for the law would be pushed back four months, from January 1, 2023, to April 15, 2023, DCWP released these new proposed rules. 

New York City has just announced that it will delay enforcement of Local Law 144, which will require employers and employment agencies using automated employment decision tools to ensure that a bias audit is conducted prior to the use of such tools, and will require notice of the use of such tools to covered candidates or employees.  The NYC Department of Consumer and Worker Protection is planning a second public hearing on the law, due to the high volume of public comments received in response to its proposed rules.  The agency is currently planning to delay enforcement of the rule until April 15, 2023.  We will continue to monitor for updates.

On March 17, 2022, the National Institute of Standards and Technology (“NIST”) published an initial draft of its Artificial Intelligence (AI) Risk Management Framework (“AI RMF”) to promote the development and use of responsible AI technologies and systems.  When final, the three-part AI RMF is intended for voluntary use and to improve the ability to incorporate trustworthiness considerations into the design, development, use, and evaluation of AI products, services, and systems.  NIST has only developed the first two parts in this initial draft:

On November 15, 2021, the Defense Innovation Unit (DIU) released its Responsible Artificial Intelligence (AI) Guidelines (“RAI Guidelines”) to help contractors and federal officials gauge whether AI technology and programs align with the Department of Defense’s (DoD) Ethical Principles for AI (as we previously reported on here). Specifically, the RAI Guidelines provide a process for all stakeholders involved in AI development (e.g., program managers, commercial vendors, and government partners) to achieve the following goals: