Skip to content
AI is changing how organisations conduct third-party due diligence. It can process large volumes of information, reduce manual screening work and help compliance professionals focus on more complex risks. But as technology takes on a greater role in research, screening and risk assessment, compliance teams face a fundamental question: can they explain and defend the decisions that follow?
Our recent webinar, AI in Compliance: Defensibility and the Accountability Gap in Third-Party Risk Decisions, which I moderated, brought together two complementary perspectives:
- David A. Last, Partner at Barnes & Thornburg and former Chief of the US Department of Justice’s FCPA Unit, on regulatory expectations.
- James Swenson, Managing Director at Ethixbase360, on practical experience integrating AI into due diligence workflows.
Here are six key takeaways.
1. Regulators want evidence that AI works, not simply that it is being used
The DOJ’s September 2024 update to its Evaluation of Corporate Compliance Programs (ECCP) explicitly addresses AI and other emerging technologies.
As Last explained, the guidance asks companies to consider how AI affects their compliance programmes, whether associated risks are incorporated into broader enterprise risk management, whether governance is consistent across commercial and compliance uses, and what controls are in place to ensure the technology is trustworthy, reliable and used for its intended purpose. The quality of the underlying data matters too.
“What DOJ really wants to understand is how is the company using its data. Is it creating efficiencies? And if so, how is it working? And how does the company know that it’s working?”
— David A. Last, Partner, Barnes & Thornburg
Last described three questions that underpin the DOJ’s assessment of corporate compliance programmes: Is the programme well designed? Is it adequately resourced and empowered? And does it work in practice?
The third question is particularly relevant to AI. A company may have implemented sophisticated technology, but that alone does not establish that its compliance controls are effective. If an AI-assisted third-party assessment later becomes part of an investigation, prosecutors may examine what the technology was intended to do, whether it performed as expected, what limitations were known and how the company responded when problems emerged.
2. AI delivers the greatest value when applied to clearly defined tasks
From an operational perspective, Swenson highlighted the benefits we’ve seen at Ethixbase360 from integrating AI into our due diligence processes. These include high-volume name screening, identifying and clearing obvious false positives, and summarising and synthesising large amounts of research.
These capabilities reduce the time analysts spend processing information, allowing them to concentrate on higher-risk relationships, complex findings and decisions requiring professional judgment.
“We see AI not necessarily as something that’s going to replace an analyst or replace a due diligence practitioner, but is going to allow that person to focus their time on higher-risk scenarios.”
— James Swenson, Managing Director, Ethixbase360
However, Swenson cautioned against assuming that a solution designed for one process will work for another. Technology developed for customer onboarding in financial services may not be appropriate for assessing complex international supply chains. Even within the same organisation, different third-party populations may require different approaches.
The starting point is a clear understanding of the problem being addressed, the risks involved and what successful performance looks like. As Swenson put it, it means “really making sure that whatever you’re looking at is fit for purpose for what you’re trying to do.”
3. One of the greatest risks is what AI fails to find
Much of the discussion around AI reliability focuses on hallucinations, where a system generates inaccurate or fabricated information. Swenson identified another concern that may be particularly significant in third-party due diligence: incomplete findings.
“I think where the real risk lies in third-party risk management is when AI comes back with nothing.”
— James Swenson
An AI system may return an assessment indicating that no material risks were identified. But that result is only as reliable as the information the system was able to access. Corporate ownership records may sit behind paywalls. Relevant information may be held in local registries or published in foreign languages. Some sources may be publicly available but difficult to retrieve through automated research.
“AI can really only synthesise the information that it finds,” Swenson said. “But somebody using the AI, you don’t necessarily know what it wasn’t able to find.” An apparently complete assessment is not necessarily a comprehensive one, and a report with no adverse findings can create a false sense of security.
Compliance teams need to understand the coverage and limitations of their AI tools, particularly for third parties in jurisdictions where reliable information is hard to obtain. This is also where experienced analysts remain essential: they understand local sources and ownership structures, know which issues to escalate and to whom, and recognise how risk reads differently in Asia than in Latin America.
4. Testing must continue after implementation
Both speakers emphasised that testing is essential to making AI use defensible. For Last, the question is whether a company can demonstrate that its technology is functioning as intended, rather than assuming it will continue to do so. That means assessing performance before deployment and revisiting it as the technology, business and risk environment evolve.
Swenson described how we approached implementation at Ethixbase360, running AI-enabled processes alongside existing workflows, allowing the team to compare results and identify differences before relying on the new technology.
“Whatever portion of the process the AI is running, you also have your pre-AI process doing it at the same time so that you can compare results.”
— James Swenson
This parallel testing can reveal not only limitations in AI performance but also inconsistencies and opportunities for improvement in existing processes.
Once live, the work continues. “It’s not like you just set it and forget it,” Last said. He suggested testing controls the way a bad actor would try to get around them. In FCPA cases, for example, contracts often come in just below an approval threshold, at $1.99 million against a $2 million limit. Would your AI catch that pattern?
There is no universal testing schedule. The right frequency depends on the application, the organisation’s risk profile and how quickly conditions change. For ongoing third-party monitoring, where new risks can emerge at any time, testing and quality controls need to reflect that reality.
5. AI does not change who is accountable for a compliance decision
As AI becomes more deeply embedded in third-party risk management, responsibility can appear increasingly distributed. An AI system may collect information. A platform may generate a risk assessment. An analyst may review the findings. A business owner may then decide whether to approve the relationship. If something goes wrong, where does accountability sit?
Last was unequivocal about the enforcement perspective:
“From DOJ’s perspective, accountability is always going to be on the people, not the machines.”
— David A. Last
“It’s not going to be sufficient in any circumstance to say, well, the AI messed up, so it’s not our fault,” he added. Companies remain responsible for their decisions, including those informed by AI-generated findings.
Swenson drew an important distinction between the responsibilities of technology providers and those of the organisations using their services. Providers should be able to explain where information came from, how it was obtained and how risk assessments were produced. But the decision to accept or reject a third party rests with the organisation, which understands its own commercial context and risk appetite. “The ultimate ownership of the risk and making that decision would still sit within the business owner,” he said.
That division of responsibility needs to be reflected in clearly documented processes, rather than assumed.
6. Defensibility depends on being able to explain the decision
Reaching the right conclusion is not enough if the organisation cannot explain how it got there.
“Usually you want to be in a position to explain three things: what you did, how it worked, and why you did it this way.”
— David A. Last
This does not mean compliance professionals need to understand every technical detail of an AI model. They do need to know how the technology operates, what it can and cannot do, and what controls are in place to manage its limitations.
Documentation should establish the role AI played in the assessment, the basis for its findings, the human review undertaken and the rationale for the final decision. Organisations should also decide which scenarios warrant extra scrutiny or should stay out of AI-enabled workflows altogether, such as confidential reviews during an M&A transaction.
The objective is to demonstrate that the organisation adopted a reasonable, risk-based approach, understood its limitations and took appropriate steps to manage them.
The next challenge: keeping governance aligned with technology
AI capabilities are evolving quickly, and expectations around the speed of compliance processes are changing with them. Swenson noted that organisations already face pressure to complete due diligence faster, partly because stakeholders assume AI should make it almost instantaneous. But meaningful risk assessment still requires testing, validation, contextual analysis and, sometimes, further investigation. Those activities take time.
To close, I asked each panellist for the one question compliance leaders should be asking about their own use of AI:
- David A. Last: “Are you testing it to make sure that it’s doing what you think it’s doing?” Avoid over-reliance and the set-and-forget approach: “You still need a human touch.”
- James Swenson: Understand your organisation’s risk profile, by geography, industry and third party, “and then question whether or not whatever you’re implementing is fit for that purpose.”
Watch the full webinar
Hear the full discussion with David A. Last and James Swenson, including practical examples of AI testing, third-party due diligence and regulatory expectations.
For more perspectives on what works, what doesn’t and where people stay essential, subscribe to AI Labs Perspectives.