Intelligence Hub – AI in Compliance: Who Is Accountable When AI Influences a Third-Party Risk Decision?

Regulators want evidence that AI works, not simply that it is being used

The DOJ’s September 2024 update to its Evaluation of Corporate Compliance Programs (ECCP) explicitly addresses AI and other emerging technologies. As Last explained, the guidance asks companies to consider how AI affects their compliance programmes, whether associated risks are incorporated into broader enterprise risk management, whether governance is consistent across commercial and compliance uses, and what controls are in place to ensure the technology is trustworthy, reliable and used for its intended purpose. The quality of the underlying data matters too.

“What DOJ really wants to understand is how is the company using its data. Is it creating efficiencies? And if so, how is it working? And how does the company know that it’s working?”

Last described three questions that underpin the DOJ’s assessment of corporate compliance programmes: Is the programme well designed? Is it adequately resourced and empowered? And does it work in practice?

The third question is particularly relevant to AI. If an AI-assisted third-party assessment later becomes part of an investigation, prosecutors may examine what the technology was intended to do, whether it performed as expected, what limitations were known and how the company responded when problems emerged.

AI delivers the greatest value when applied to clearly defined tasks

From an operational perspective, Swenson highlighted the benefits seen at Ethixbase360 from integrating AI into its due diligence processes. These include high-volume name screening, identifying and clearing obvious false positives, and summarising and synthesising large amounts of research. These capabilities reduce the time analysts spend processing information, allowing them to concentrate on higher-risk relationships, complex findings and decisions requiring professional judgment.

“We see AI not necessarily as something that’s going to replace an analyst or replace a due diligence practitioner, but is going to allow that person to focus their time on higher-risk scenarios.”

However, Swenson cautioned against assuming that a solution designed for one process will work for another. Technology developed for customer onboarding in financial services may not be appropriate for assessing complex international supply chains. Even within the same organisation, different third-party populations may require different approaches.

The starting point is a clear understanding of the problem being addressed, the risks involved and what successful performance looks like. As Swenson put it, it means “really making sure that whatever you’re looking at is fit for purpose for what you’re trying to do.”

One of the greatest risks is what AI fails to find

Much of the discussion around AI reliability focuses on hallucinations, where a system generates inaccurate or fabricated information. Swenson identified another concern that may be particularly significant in third-party due diligence: incomplete findings.

“I think where the real risk lies in third-party risk management is when AI comes back with nothing.”

An AI system may return an assessment indicating that no material risks were identified. But that result is only as reliable as the information the system was able to access. Corporate ownership records may sit behind paywalls. Relevant information may be held in local registries or published in foreign languages. Some sources may be publicly available but difficult to retrieve through automated research.

“AI can really only synthesise the information that it finds. But somebody using the AI, you don’t necessarily know what it wasn’t able to find.”

Compliance teams need to understand the coverage and limitations of their AI tools, particularly for third parties in jurisdictions where reliable information is hard to obtain. This is also where experienced analysts remain essential: they understand local sources and ownership structures, know which issues to escalate and to whom, and recognise how risk reads differently in Asia than in Latin America.

Testing must continue after implementation

Both speakers emphasised that testing is essential to making AI use defensible. For Last, the question is whether a company can demonstrate that its technology is functioning as intended, rather than assuming it will continue to do so. That means assessing performance before deployment and revisiting it as the technology, business and risk environment evolve.

Swenson described how Ethixbase360 approached implementation, running AI-enabled processes alongside existing workflows, allowing the team to compare results and identify differences before relying on the new technology.

“Whatever portion of the process the AI is running, you also have your pre-AI process doing it at the same time so that you can compare results.”

This parallel testing can reveal not only limitations in AI performance but also inconsistencies and opportunities for improvement in existing processes.

Once live, the work continues. “It’s not like you just set it and forget it,” Last said. He suggested testing controls the way a bad actor would try to get around them. In FCPA cases, for example, contracts often come in just below an approval threshold, at $1.99 million against a $2 million limit. Would your AI catch that pattern?

There is no universal testing schedule. The right frequency depends on the application, the organisation’s risk profile and how quickly conditions change. For ongoing third-party monitoring, where new risks can emerge at any time, testing and quality controls need to reflect that reality.

AI does not change who is accountable for a compliance decision

As AI becomes more deeply embedded in third-party risk management, responsibility can appear increasingly distributed. An AI system may collect information. A platform may generate a risk assessment. An analyst may review the findings. A business owner may then decide whether to approve the relationship. If something goes wrong, where does accountability sit? Last was unequivocal about the enforcement perspective:

“From DOJ’s perspective, accountability is always going to be on the people, not the machines.”

“It’s not going to be sufficient in any circumstance to say, well, the AI messed up, so it’s not our fault,” he added.

Swenson drew an important distinction between the responsibilities of technology providers and those of the organisations using their services. Providers should be able to explain where information came from, how it was obtained and how risk assessments were produced. But the decision to accept or reject a third party rests with the organisation, which understands its own commercial context and risk appetite. “The ultimate ownership of the risk and making that decision would still sit within the business owner,” he said.

That division of responsibility needs to be reflected in clearly documented processes, rather than assumed.

Defensibility depends on being able to explain the decision

Reaching the right conclusion is not enough if the organisation cannot explain how it got there.

“Usually you want to be in a position to explain three things: what you did, how it worked, and why you did it this way.”

This does not mean compliance professionals need to understand every technical detail of an AI model. They do need to know how the technology operates, what it can and cannot do, and what controls are in place to manage its limitations.

Documentation should establish the role AI played in the assessment, the basis for its findings, the human review undertaken and the rationale for the final decision. Organisations should also decide which scenarios warrant extra scrutiny or should stay out of AI-enabled workflows altogether, such as confidential reviews during an M&A transaction.

Keeping governance aligned with technology

AI capabilities are evolving quickly, and expectations around the speed of compliance processes are changing with them. Swenson noted that organisations already face pressure to complete due diligence faster, partly because stakeholders assume AI should make it almost instantaneous. But meaningful risk assessment still requires testing, validation, contextual analysis and, sometimes, further investigation. Those activities take time.

To close, each panellist was asked for the one question compliance leaders should be asking about their own use of AI:

“Are you testing it to make sure that it’s doing what you think it’s doing?”

Last’s advice: avoid over-reliance and the set-and-forget approach. “You still need a human touch.”

Swenson: understand your organisation’s risk profile, by geography, industry and third party, “and then question whether or not whatever you’re implementing is fit for that purpose.”