Who Owns Third-Party AI Risk?

When it comes to third-party vendors, what you don't know is hurting you.Third parties rely on AI for customer service, recruiting, compliance screening, marketing, and decision making.But when a third party uses AI, your organization is on the hook for legal, regulatory, contractual, and reputational risks.Organizations need to understand which third parties use AI, what tools they use, what data is being shared, what controls exist, and who is responsible when something inevitably goes wrong.Third-party AI governance is a critical component of vendor management.The Ethics and Compliance Q and A show is produced by One Stone Creative.

This episode examines OFAC’s new Iran General License X and why it may represent one of the most significant Iran sanctions developments in years. Michael Volkov explains what the license authorizes, why it matters amid ongoing diplomatic negotiations, and why companies should not mistake temporary sanctions relief for a permanent policy shift. The episode highlights practical compliance steps, including careful transaction analysis, documentation, due diligence, screening updates, and close monitoring before the license expires. As always, the focus is on practical, risk-based compliance: helping companies identify legitimate business opportunities while protecting ethics, integrity, and trust.

Not all sanctions violations are willful.Some companies just don't know any better.An effective trade compliance program needs three critical elements.First, in addition to the two we spoke about in the last episode, organizations and companies have to monitor transactions, shipping documents, vessels, payment flows, and escalation of red flags.Employee training is critical.OFAC's compliance framework specifically identifies training as a core compliance expectation.And finally, organizations need to monitor, audit, and test whether their controls are actually working.A compliance program that is never tested is simply operating on assumptions.The best trade compliance programs don't just detect violations, they prevent them.The Ethics and Compliance Q and A show is produced by One Stone Creative.

Artificial intelligence has created one of the most significant governance challenges organizations have faced in decades. Business leaders are under intense pressure to deploy AI quickly, while legal and compliance teams are warning about mounting regulatory, legal, operational, and reputational risks. In this episode, Michael Volkov explains why both sides are right, identifies the most dangerous AI governance gaps emerging across organizations today, and outlines a practical roadmap for responsible AI adoption. The message is clear: the companies that will succeed in the AI era will not be those that move fastest—they will be those that build sustainable AI programs grounded in governance, accountability, and trust.

Most companies think they have a handle on AI. Most don't.Compliance attorney Michael Volkov has sat across the table from Fortune 500 compliance teams, major law firms, and Berkshire Hathaway subsidiaries — and what he keeps finding is "shadow AI": people using AI at work that leadership has no idea about. In this conversation with host Collin McKee, he breaks down where the real legal risk lives, how to protect your business, and why the smart move isn't to slow down — it's to deploy AI the right way.We get into:"Shadow AI" — why your team is already using it and what it exposes you toThe vendor due-diligence checklist before you sign with any AI providerWhy AI hallucinations are a liability you can be sued overHR, hiring bias, and high-risk algorithmic decisionsWriting an AI acceptable-use policy that protects you without slowing you downThe EU AI Act, litigation risk, and AI insuranceWhy you won't be replaced by AI — but by people who know how to use itA practical playbook for any business adopting AI, especially law firms and regulated industries.Chapters0:00 Why most companies don't actually have a handle on AI0:38 The CEO email that shows how NOT to deploy AI4:09 Shadow AI: a Fortune 100 example6:42 The real risk — hiring, HR & algorithmic decisions9:34 Why AI hallucinations are a legal liability10:03 The vendor due-diligence checklist before you sign12:50 Why companies still won't write an AI use policy16:24 The "double-checking wastes my time" trap18:39 The EU AI Act, litigation & AI insurance19:27 What small & mid-size businesses actually need23:39 You won't be replaced by AI — but by people who use it26:19 AI as a force multiplier, not a headcount cut28:04 Where to find Michael VolkovAbout the guest — Michael VolkovCompliance attorney and AI governance expert. Founder of The Volkov Law Group.YouTube:    / @volkovlawtv  Blog & podcast (Corruption, Crime & Compliance): https://blog.volkovlaw.com/LinkedIn:   / michael-volkov-9716b45  About Endeavor's AIIf this episode hit home and your company needs help with implementation, automations, workflows, and the AI infrastructure to do this right — that's what we do.Website: https://www.endeavorsai.com/Book a 30-min call: https://calendly.com/collin-endeavors...Instagram:   / endeavorsai  LinkedIn:   / endeavors-ai  

Michael Volkov delivers the operational compliance program guidance companies must implement to execute safely within OFAC's new Venezuela general license framework, structured around five program pillars: transaction scoping with mandatory lifecycle revalidation at each critical deal stage; beneficial ownership-based counterparty due diligence that goes beyond standard SDN screening to identify Russia, Iran, Cuba, North Korea, and PRC-connected ownership structures; contract review and modification to incorporate mandatory U.S. governing law provisions, sanctions representations, FGDF payment mechanics clauses, and robust termination rights; pre-built Foreign Government Deposit Fund payment procedures requiring documented legal and compliance approval, a standardized State Department submission package, and advance coordination before payment deadlines arrive; and a transaction-specific reporting compliance program with calendar-tracked deadlines under GL 52, GL 46B, and GL 51B. Michael concludes that the new Venezuela framework creates genuine commercial opportunity but demands purpose-built compliance architecture—companies that proceed without it are not operating within the authorization.

What separates effective trade compliance programs from ineffective ones?It starts at the top.Good, bad, or ugly, it all trickles down from the top.Here are the five keys to an effective trade compliance program.The first two are building blocks for leadership and due diligence.First, senior executives and boards must actively support trade compliance.Without leadership engagement, compliance programs become check-the-box exercises.Second, organizations need robust screening and due diligence processes.This includes customers, distributors, suppliers, beneficial owners, intermediaries, and other third parties.Trade compliance failures often begin with poor due diligence.Strong leadership and strong due diligence create the foundation for every trade compliance program.The Ethics and Compliance Q and A show is produced by One Stone Creative.

Are your employees whispering corporate secrets into the greedy ears of public-facing AI?Many organizations have no visibility into how their employees are using AI.The solution is not to ban AI.The solution is AI governance.Organizations need approved AI tools, acceptable use policies, employee training, and ongoing monitoring.The question is no longer whether your employees are using AI.The question is whether you know how they are using it.AI risk is no longer a future issue. It is a governance challenge happening right now.The Ethics and Compliance Q and A show is produced by One Stone Creative.

Michael Volkov examines OFAC's new Venezuela general license framework—including General License 52, General License 46B, and the newly effective General License 51B covering Venezuelan-origin minerals—analyzing how these authorizations create conditional pathways for otherwise-prohibited energy and minerals transactions while preserving the underlying blocking regime applicable to PdVSA and the Government of Venezuela. Michael explains the established U.S. entity eligibility requirement, the mandatory contractual conditions requiring U.S. governing law and U.S. dispute resolution in agreements with Venezuelan governmental counterparties, and the critical jurisdictional restrictions excluding transactions with Russia, Iran, Cuba, North Korea, and China-connected entities. The episode provides a detailed operational breakdown of the Foreign Government Deposit Fund payment mechanism established under Executive Order 14373—including the [email protected] submission process and documentary requirements—and concludes with an analysis of the multi-agency reporting obligations triggered under each applicable authorization.

If AI were a real employee and made mistakes, would you fire it?AI is transforming business operations, but organizations often overlook one fundamental problem.They hallucinate.AI can generate fake information, fake legal citations, inaccurate regulatory interpretations, incorrect sanctions screening results, and fabricated facts.The danger is not that AI makes mistakes.The danger is that it makes mistakes confidently.Employees frequently assume AI-generated information is accurate because it sounds authoritative and professional.That's why every organization needs clear governance controls.Require human review, validate critical outputs, and document your procedures for high-risk decisions.AI can improve efficiency, but without oversight, AI errors can quickly become a compliance disaster.The Ethics and Compliance Q and A show is produced by One Stone Creative.