When conducting investigations or determining whether to bring charges, the Department of Justice (DOJ) evaluates whether a company’s AI governance prevents deliberate or reckless misuse that could violate criminal law. The Securities and Exchange Commission (SEC) evaluates whether a company’s public statements about its AI capabilities are accurate and not misleading to investors. These are related but distinct inquiries, and a compliance program designed for one agency’s expectations will not automatically satisfy the other. The good news is that a well-built AI governance framework can address both.
The DOJ Side: AI as a Compliance Program Risk
Under the DOJ’s Evaluation of Corporate Compliance Programs (ECCP) — the framework prosecutors use to assess compliance programs during charging and resolution decisions — prosecutors are directed to examine whether a company has a process to assess the risks introduced by its use of AI and whether the company has controls in place to prevent that technology from being deliberately or recklessly misused to violate the law or the company’s own Code of Conduct.
The ECCP does not leave this as an abstract expectation. Under its risk assessment section, “Management of Emerging Risks to Ensure Compliance with Applicable Law,” the guidance directs prosecutors to specific questions to test a company’s AI risk assessment:
- How does the company assess the potential impact of new technologies, such as artificial intelligence (AI), on its ability to comply with criminal laws?
- What is the company’s approach to governance regarding the use of new technologies such as AI in its commercial business and in its compliance program?
- How is the company curbing any potential negative or unintended consequences resulting from the use of technologies, both in its commercial business and in its compliance program?
- How is the company mitigating the potential for deliberate or reckless misuse of technologies, including by company insiders?
- To the extent that the company uses AI and similar technologies in its business or as part of its compliance program, are controls in place to monitor and ensure its trustworthiness, reliability, and use in compliance with applicable law and the company’s Code of Conduct?
- Do controls exist to ensure that the technology is used only for its intended purposes?
- What baseline of human decision-making is used to assess AI?
- How is accountability over use of AI monitored and enforced?
- How does the company train its employees on the use of emerging technologies such as AI?
A company utilizing AI in its compliance governance should ensure it can fully and specifically answer these questions as it builds out its governance framework.
The SEC Side: Risks of AI Washing Causing Investor Harm
The SEC’s concern runs in a different direction. Under the leadership of SEC Chairman Paul Atkins, the SEC’s priorities have centered on protecting investors and facilitating capital formation. Accordingly, the Enforcement Division has largely focused on policing fraudulent conduct rather than honest mistakes.
That said, the SEC’s Division of Examinations included “AI washing” — material misstatements or exaggerations about a company’s AI capabilities — among its annual examination priorities announced for fiscal 2026. Importantly, AI washing is not limited to companies that falsely claim to use AI. Chairman Atkins stated at a March 2026 Financial Stability Oversight Council (FSOC) roundtable focused on AI innovation that the agency continues to bring actions for “false, misleading, or exaggerated claims about the use of AI.” He clarified that this includes companies that overstate the capabilities of AI they genuinely use — for example, describing a process as fully automated when it substantially depends on human operators — not only companies that entirely fabricate their AI use or capabilities
While the current enforcement environment is focused on fraudulent conduct, deceptive AI washing presents unique risks, particularly where it may result in investor harm. The SEC has not, as of now, created a standalone AI disclosure line item. Instead, existing disclosure and anti-fraud rules are being applied to AI-related statements in earnings calls, marketing materials, investor presentations, and SEC filings alike. That means the exposure may run through product, marketing, and investor relations functions which may not be part of a traditional compliance review.
Where the Two Frameworks Converge
Despite the different lenses, DOJ and SEC expectations converge on a few structural requirements that a single governance program can satisfy simultaneously.
An AI inventory and risk classification process — knowing what AI systems the company uses, deploys, or sells, and what they actually do — is foundational to both. The DOJ wants evidence the company understands its own AI risk exposure. The SEC wants a factual basis for a company’s public claims about its AI capability, which is impossible without an accurate internal inventory.
Cross-functional ownership matters equally to both agencies. A program housed solely in engineering will miss the disclosure risk; a program housed solely in legal or investor relations will miss the operational misuse risk. Effective governance brings together compliance, legal, product, and communications functions, with a defined escalation path when a claim or use case raises questions.
Documentation and testing discipline are the connective tissue. For the DOJ, this means keeping records of risk assessments, access controls, and monitoring outputs that demonstrate the program is functioning, not merely existing. For the SEC, this means being able to substantiate AI-related representations with internal testing data, performance benchmarks, or engineering sign-off. A defense team would want these records on hand if either regulator came calling.
Finally, both frameworks reward genuine internal reporting channels. The DOJ’s emphasis on whistleblower protection and the SEC’s own whistleblower program both create incentives for employees to surface AI-related concerns internally before they become external complaints. A program that makes internal escalation credible and retaliation-free reduces exposure on both fronts at once.
Building the Program
A practical starting point is a joint risk assessment: identify every AI system in use or under development, classify it by function (internal analytics, customer-facing product or decision-support tool) and flag every current or planned public statement about that system’s capabilities. From there, pair each governance control — testing protocols, access restrictions, and human-in-the-loop requirements — with the disclosure obligation it supports, so the same documentation trail serves compliance and investor relations purposes at once.
Companies that treat AI governance as two separate projects — one for the compliance department and one for disclosure counsel — will end up duplicating effort and, more dangerously, leaving gaps where the two frameworks do not obviously overlap. Companies that build a single, well-documented governance structure from the start will find that most of the work satisfies both the DOJ’s and SEC’s expectations simultaneously.
If your AI governance program was built before the DOJ’s 2024 ECCP updates or the developments surrounding the SEC’s current views on potential investor harm flowing from AI washing, it is worth taking a fresh look. The standards both agencies are applying have evolved.