On September 23, 2024, the U.S. Department of Justice (DOJ) Criminal Division announced updates to its Evaluation of Corporate Compliance Programs (ECCP), providing new expectations for corporate compliance in an evolving landscape of technology and data. These updates emphasize proactive management of emerging technologies such as artificial intelligence (AI), greater emphasis on data analysis, and stronger protections for whistleblowers. 

The key message from DOJ’s updated ECCP is that data is the cornerstone of compliance—whether it’s assessing risk, integrating compliance after a merger, or managing the impact of AI. 

Key DOJ Compliance Initiatives and BigID’s Role

Emerging Technologies and AI: Managing the Risks

The DOJ’s revised ECCP emphasizes the importance of managing risks related to AI and other emerging technologies. Companies are expected to address AI risks both in their commercial operations and within their compliance programs. This includes mitigating potential misuse of AI, ensuring human oversight, and continuously testing to confirm that technologies function as intended.

How BigID Can Help: BigID enables companies to identify, classify, and govern AI data and models.  Through advanced data discovery and classification capabilities, BigID enables companies to identify sensitive data at risk, enable AI security and governance to make sure that the data AI is trained for is safe for use (and does not contain sensitive information), identify what AI models can access enterprise data, and assess the compliance implications of AI-driven data processes.  BigID’s data intelligence platform helps organizations maintain transparency and control over their AI technologies, reducing the risk of misuse and empowering organizations to streamline AI risk assessments and compliance management.

Access to Data and Leveraging Data Analysis

The updated ECCP underscores the importance of data access for compliance personnel. Prosecutors will consider whether compliance teams have the same access to company data as other business teams, and whether they leverage data analytics to improve compliance efficiency.

How BigID Can Help: BigID enables security, compliance, data, and risk teams to gain comprehensive visibility and controls to critical data across the organization. With its ability to automate data discovery, classification, and monitoring, BigID facilitates compliance teams in their ability to create a data-driven compliance ecosystem. By providing extensive reporting on insights and risk, BigID helps ensure that compliance controls are efficiently integrated across data assets, making it easier for compliance personnel to identify and address potential risks.

Integration of Compliance Post-Mergers and Acquisitions

The DOJ’s new guidance places more emphasis on integrating compliance programs after mergers and acquisitions (M&A). Companies are expected to conduct risk assessments on newly acquired entities and adapt their compliance frameworks accordingly.

How BigID Can Help: BigID provides a solution to assess and map data across merged or acquired entities, giving organizations visibility into potential compliance risks. By identifying sensitive data, tracking data movement, and ensuring proper controls are in place, BigID helps organizations seamlessly integrate compliance measures into new business units. This supports DOJ’s expectation that compliance should be effectively integrated following M&A transactions.

Adequate Resource Allocation for Compliance Programs

The DOJ’s revisions also direct prosecutors to evaluate whether companies allocate sufficient resources to their compliance programs, including financial support, staffing, and technology. Companies are encouraged to utilize data analytics tools to assess compliance effectiveness and allocate resources accordingly.

How BigID Can Help: BigID supports resource optimization by providing automation in data discovery, classification, and analysis, which helps compliance teams operate more efficiently. By offering tools to assess the impact of compliance initiatives, BigID helps organizations justify the commercial value of investments in compliance, addressing the DOJ’s expectation that compliance functions be well-resourced and technologically equipped.

How BigID Maps to ECCP Expectations

The DOJ’s updated ECCP is primarily focused on how companies use data for risk management, transparency, and overall compliance effectiveness. BigID’s platform directly aligns with these priorities, empowering companies in several key areas:

Risk Identification and Mitigation for AI:

BigID’s ability to discover, classify, and govern data across various platforms and AI systems ensures that organizations have the right controls in place to identify risks associated with AI use. With BigID, companies can establish effective AI risk assessments that align with DOJ expectations, including monitoring and auditing the outputs of AI systems against a “baseline of human decision-making.”

Access to Data for Compliance Teams:

The DOJ stresses the need for compliance teams to have unrestricted access to corporate data. BigID offers solutions that provide compliance officers with a clear view into all enterprise data—helping bridge the gap between compliance and business teams. This enables compliance teams to measure the effectiveness of their initiatives using data that is accurate, timely, and complete.

Vendor Risk Management and M&A Due Diligence:

With the ECCP’s new focus on third-party risks and M&A transactions, BigID supports effective vendor risk management through data inventory and assessment, and data mapping tools. BigID helps manage risk, validate data in the due diligence processes in M&A scenarios, and adequately address compliance and data governance concerns.

BigID and Data-Driven Compliance: A Strategic Alignment

The DOJ’s updated ECCP guidance clearly signals that data is the foundation of effective corporate compliance. Compliance programs must be dynamic, integrated, and data-driven, capable of adapting to new risks while maintaining robust oversight. BigID’s data intelligence platform aligns seamlessly with these expectations, offering the capabilities that companies need to build transparent, proactive, and resilient compliance programs in the age of AI.

BigID provides comprehensive visibility into enterprise data, enabling organizations to know and control their data, conduct effective risk assessments, and manage and secure data across the entire organization. This capability supports a range of DOJ compliance requirements—from managing AI and emerging technology risks to facilitating data-driven compliance assessments.

In an era where compliance is increasingly driven by data, BigID provides companies with the necessary foundation to stay ahead of regulatory expectations. As DOJ places more emphasis on emerging technologies, data access, and proactive risk management, organizations can rely on BigID to enhance their compliance capabilities and leverage their data to meet DOJ standards effectively.

Get started with BigID today – and schedule a 1:1 demo with our AI risk experts.