Compliance programs designed for traditional operational and financial risks often falter when AI is introduced. The Department of Justice's September 2024 revisions to the Evaluation of Corporate Compliance Programs underscore this: prosecutors will now evaluate how your organization manages AI-related risks and impose harsher penalties when AI misuse exacerbates criminal conduct.
However, many compliance officers approach AI governance with the same tools and assumptions used for third-party due diligence or anti-corruption controls. This mismatch leads to predictable failures.
Why These Mistakes Keep Happening
AI presents a unique challenge. It's simultaneously a technology, operational, reputational, and legal risk. Your compliance program likely has separate frameworks for each domain, but AI doesn't adhere to these boundaries. A chatbot that inaccurately describes product specifications can lead to consumer protection violations, breach contractual warranties, and expose your organization to fraud claims, all from a single output.
The EU AI Act, described as the "first comprehensive regulation on AI by a major regulator anywhere," organizes its compliance obligations around risk tiers, not functional departments. Colorado's AI Act requires developers of "high-risk" systems to use "reasonable care" to prevent algorithmic discrimination. Neither regulation aligns neatly with existing control libraries, leading to six common errors.
Mistake 1: Treating AI as an IT Project
Why it happens: The IT department acquired the AI tool, so IT owns the risk. This logic works for server maintenance but fails for AI.
The consequence: Compliance discovers issues only after deployment. Consider an organization that implements an AI-driven hiring tool without compliance review. The system optimizes for historical hiring patterns, encoding past discrimination. By the time compliance is aware, thousands of applications have been processed using a biased algorithm, creating regulatory exposure and a documented pattern of discriminatory impact.
The fix: Establish a cross-functional AI governance committee that includes compliance, legal, HR, procurement, and IT. Require compliance sign-off before any AI system processes personal data, makes automated decisions, or interacts with customers. Document this requirement in your technology acquisition policy and code of conduct, so procurement knows to involve compliance early.
Mistake 2: Failing to Inventory AI Use Cases
Why it happens: There's no central register of AI deployments. Business units adopt AI tools independently, often through SaaS subscriptions that bypass IT procurement. You're managing risks you don't know exist.
The consequence: Prosecutors will ask whether your compliance program identified and assessed AI-related risks. Without an inventory, you can't demonstrate that assessment occurred. Deputy Attorney General Lisa Monaco directed prosecutors to evaluate "risks associated with AI" as part of ECCP assessments, making the absence of an inventory evidence of program inadequacy.
The fix: Conduct an AI discovery exercise across all business units. Ask: (1) What systems make automated decisions? (2) What systems generate content or documentation? (3) What systems process personal or sensitive data using predictive models? Maintain this inventory as a living document within your enterprise risk management framework, with quarterly updates required from each department head.
Mistake 3: Assuming Vendor Compliance Equals Your Compliance
Why it happens: Your AI vendor claims their system complies with applicable regulations, and you rely on that representation without independent verification.
The consequence: Vendor compliance doesn't transfer. The Colorado AI Act imposes obligations on deployers, not just developers. If the vendor's "reasonable care" doesn't account for how your organization uses the system, you inherit the gap. Principal Deputy Assistant Attorney General Nicole Argentieri emphasized that prosecutors will assess "whether the company is monitoring and testing its technology to evaluate if it's functioning as intended and consistent with the company's code of conduct." That's your responsibility, not the vendor's.
The fix: Require vendors to provide technical documentation explaining how their AI system makes decisions, what data it uses, and what accuracy or error rates it produces. Then test those claims. Run sample inputs through the system and verify outputs against your compliance standards. Document this testing in your third-party due diligence files, and repeat it annually or whenever the vendor updates the model.
Mistake 4: Neglecting Human Oversight Mechanisms
Why it happens: The AI system is faster and cheaper than manual review, so you remove the human checkpoint. Efficiency gains justify the automation.
The consequence: When AI generates false approvals or fabricated documentation, no one catches it until external parties raise concerns. Monaco specifically warned that prosecutors will consider AI-generated false documentation as an aggravating factor in sentencing. Your compliance program must demonstrate that human decision-makers retain meaningful control over AI outputs, particularly for high-stakes decisions like credit approvals, hiring, or compliance certifications.
The fix: Define decision categories where AI can recommend but not execute. For high-risk determinations, require a qualified employee to review AI recommendations and document the basis for accepting or overriding them. Train these reviewers to recognize common AI failure modes: pattern matching that ignores context, overconfidence in predictions, and hallucinated details that sound plausible but aren't factual.
Mistake 5: Skipping AI-Specific Training
Why it happens: Your annual compliance training covers your code of conduct and key policies. AI feels like a specialized topic that doesn't warrant universal training.
The consequence: Employees don't recognize AI misuse when they see it. They accept AI-generated summaries without verifying source documents. They input confidential information into public AI tools. They assume AI outputs are accurate because they're machine-generated. The ECCP revisions direct prosecutors to assess "how employees are trained to responsibly use AI," which means generic training won't satisfy the standard.
The fix: Develop role-specific AI training modules. Teach procurement teams to identify AI-related contract terms. Train managers who use AI hiring tools to recognize algorithmic bias indicators. Show customer service staff how to escalate AI-generated responses that contradict company policy. Make this training mandatory for any employee who interacts with AI systems in their role, and refresh it annually as your AI inventory evolves.
Mistake 6: Ignoring AI Risks in Your Risk Assessment
Why it happens: Your annual enterprise risk assessment uses established categories: fraud, corruption, data privacy, workplace safety. AI doesn't fit neatly into any single bucket, so it gets fragmented across multiple risk owners or omitted entirely.
The consequence: The ECCP revisions ask whether "management of risks related to the use of AI and other new technologies [is] integrated into broader enterprise risk management strategies." If your risk register doesn't explicitly identify AI risks, you can't demonstrate integration. This gap becomes particularly problematic when an AI-related incident occurs and prosecutors review your risk assessment history.
The fix: Add AI governance as a distinct risk category in your next enterprise risk assessment cycle. Identify specific AI-related threats: algorithmic discrimination, data poisoning, model drift, automated fraud, privacy violations from training data, and reputational harm from AI-generated content. Assign ownership for each risk, define controls, and establish monitoring metrics. Link these AI risks to your existing risk taxonomy so compliance, audit, and the board can see how AI governance connects to your broader control environment.
Prevention Checklist
Use this checklist quarterly to verify your AI compliance program remains current:
- AI governance committee met and reviewed new AI deployments
- AI inventory updated with business unit inputs
- High-risk AI systems identified using EU AI Act or Colorado AI Act criteria
- Vendor AI systems tested for accuracy and consistency with company values
- Human oversight requirements documented and monitored for high-stakes AI decisions
- Role-specific AI training completion rates reviewed and gaps addressed
- AI risks incorporated into enterprise risk assessment and board reporting
- Incident reporting mechanism tested for AI-related concerns
- Monitoring controls validated for AI system outputs
- Documentation prepared to demonstrate ECCP compliance if prosecutors inquire
The revised ECCP guidance doesn't create new legal obligations, but it changes how prosecutors will evaluate your compliance program's adequacy. If you're still treating AI as someone else's problem, you're building the record prosecutors will use against you.
