Episode 406: AI Risks and Compliance – Building a Governance Framework

Artificial intelligence is rapidly transforming business operations—but it is also introducing a new generation of legal, ethical, and compliance risks. In this episode, we explore how AI risk is accelerating across organizations, from data leakage and bias to over-reliance on flawed outputs and hidden third-party exposure. Drawing on real enforcement trends and practical examples, we explain why AI risk is fundamentally a human and governance issue—not just a technology challenge—and why companies must adopt a risk-based approach that distinguishes between high- and low-risk AI use cases. This episode outlines the core elements of an effective AI compliance program, including governance structures, employee training, vendor oversight, and regulatory readiness in an increasingly scrutinized environment.

Are you actually thinking of turning over your compliance program to ChatGPT? If so, you need to listen to this.AI has to be implemented in a methodical way, a step-by-step program. So let's talk about those steps.First, you need a governance structure, meaning you have to have an organization responsible across the entire organization for all your uses of AI.Second, like every issue that we deal with in ethics and compliance, you need a risk assessment. And you need to look at specific use cases and how those are going to impact your risk profile. This is critical. Only then you can start to tailor your program.Third, you need to decide and investigate what exactly your risks are.Is it algorithmic, meaning you're using it for your business purpose, or non-algorithmic?Stay tuned to part two, and we're gonna talk about the rest of the steps.The Ethics and Compliance Q and A show is produced by One Stone Creative.

In this episode, we examine the Department of Justice’s declination in the Balt Medical case—a textbook example of how DOJ is applying its Corporate Enforcement Policy in practice. Despite a multi-year foreign bribery scheme involving payments to a physician at a state-owned hospital, DOJ declined to prosecute the company based on its timely self-disclosure, full cooperation, and effective remediation. But the real story lies in DOJ’s simultaneous prosecution of two individuals who allegedly orchestrated the scheme, highlighting the central role of individual accountability in earning cooperation credit. This episode unpacks how companies must now “connect the dots” for prosecutors—identifying responsible actors and providing actionable evidence—if they hope to secure favorable outcomes.

In this episode, we break down the sweeping shift in U.S. sanctions policy toward Venezuela following the 2026 political transition and the issuance of multiple new general licenses by the Office of Foreign Assets Control. While the U.S. has opened the door to significant commercial activity—particularly in oil, gas, and minerals—this is not a full lifting of sanctions but a highly conditional framework with strict compliance guardrails. Companies can now engage in transactions involving Venezuelan energy and infrastructure, but must navigate complex restrictions, reporting obligations, and geopolitical limitations, including prohibitions involving Russia, Iran, and China-linked entities. This episode explores the opportunities, risks, and compliance challenges created by this carefully calibrated reopening of the Venezuelan economy.

The final quarter of 2025 produced a modest resurgence in Foreign Corrupt Practices Act (FCPA) activity following the administration’s June 2025 FCPA guidelines. Whether that uptick signals a sustained enforcement trend remains uncertain. But one theme remains clear: individual FCPA enforcement is alive and well.While corporate resolutions may benefit from evolving DOJ policy and a renewed emphasis on negotiated dispositions, individuals continue to face indictment, trial, sentencing, forfeiture, and reputational destruction

In this episode of Corruption, Crime and Compliance, Michael Volkov sits down with entrepreneur and innovator Paul Allen, founder of Ancestry.com and Soar.com, to explore the evolving intersection of artificial intelligence, governance, and public trust. Paul shares insights from his latest venture, CitizenPortal.ai, an AI-powered civic intelligence platform aimed at making government activity more transparent, accessible, and accountable to everyday citizens. The conversation moves beyond hype, focusing on how AI can strengthen—not replace—democratic institutions through constrained, verifiable systems that enhance understanding and engagement. With a thoughtful and pragmatic lens, Paul discusses the risks, opportunities, and responsibilities that come with deploying AI in the public sphere, offering listeners a compelling vision for how technology can rebuild trust in institutions at a critical moment.

The U.S Department of Commerce announced two settlements recently involving export control enforcement actions.First, the Department of Commerce’s Bureau of Industry and Security (BIS) imposed a $374,474 civil penalty against California-based satellite technology supplier Vizocom for unlawfully exporting controlled technical data related to military antennas to a Chinese manufacturer.Second, (BIS) imposed a $1 million civil penalty against Teledyne FLIR, a U.S. manufacturer of thermal imaging cameras, for multiple violations of the Export Administration Regulations (EAR) involving exports to China and Hong Kong. The enforcement action highlights a recurring compliance challenge for multinational exporters: the complex application of the EAR’s de minimis rules, as well as the importance of careful screening and strict adherence to license conditions.

In this episode, I sit down with Matthew Campbell, whose decades-long effort to seek answers about the death of his brother in the World Trade Center has now reached the doorstep of the Supreme Court of the United Kingdom.This is not a case about liability for the September 11 attacks. Instead, it raises a fundamental constitutional question: can the UK government refuse to reopen an inquest—without meaningful judicial oversight? After the Attorney General denied Campbell’s request for a fresh inquest based on what he argues is new evidence, UK courts largely closed the door on review. Now, the Supreme Court will decide whether that decision is beyond challenge or subject to legal scrutiny.At stake is more than a single case. This litigation tests the boundaries of executive power, the scope of judicial review, and the rights of families seeking to revisit official findings long after tragedy strikes. It also highlights the tension between finality in legal determinations and the pursuit of truth.In our conversation, Matt Campbell explains what has driven his persistence, how the legal battle has evolved, and why this case could have broader implications for accountability in the UK legal system.Whether you approach this from a legal, historical, or human perspective, this episode explores a compelling intersection of law and loss—and the enduring question of when a case is truly closed.

Vera is a Chartered Accountant, Certified Internal Auditor, and award-winning Ethics and Compliance expert who writes and speaks about philosophy, business ethics, compliance, risk, and governance.She is the Executive Director of Boards of the Future™, a non-profit that works with corporate boards globally to advocate for stronger ethics, risk, and compliance backgrounds.She spends time between Milan and Los Angeles and serves as a Chair, director, and ethics advisor for global professional bodies, corporations, and international nonprofits.

Anik A. Shah is Director & Sr. Legal Counsel, Anti-Bribery and Anti-Corruption, at Sandisk, a global semiconductor manufacturer. Anik has more than 15 years of compliance, investigations, regulatory, and law enforcement experience.Anik started his career at the U.S. Securities and Exchange Commission (SEC), where he investigated anti-fraud, anti-bribery, and other violations by multi-national financial institutions and technology companies and their executives. At the SEC, Anik routinely partnered with law enforcement and regulatory authorities throughout the U.S. and in Europe, Africa, and Asia on multi-jurisdictional investigations and enforcement. He was also selected for a special detail assignment as a federal prosecutor with the U.S. Department of Justice.Prior to joining Sandisk, Anik worked on compliance, regulatory, and corporate governance issues at multi-national financial institutions. As a leading anti-bribery and anti-corruption practitioner, Anik routinely presents at industry, professional, and trade association events.