The FCC’s Office of Inspector General is moving away from one-off audits of single recipients toward a data-driven model that matches risk indicators across programs and funding years. Diana Shaw, Megan Brown, Mark Sweet and Lois Ahn of Wiley explain what that means for funding recipients: a red flag in a pandemic-era program can now prompt scrutiny across a company’s other FCC funding.

Federal Communications Commission (FCC) funding recipients should prepare for greater scrutiny and compliance risks as the agency’s Office of Inspector General (OIG) implements a broader, more data-driven approach to oversight. The FCC OIG’s 2026-27 work plan, together with its recent reporting to Congress, signal that the OIG is increasingly using advanced analytics and cross-program risk indicators to identify targets for audits and investigations. As a result, a red flag in one program, or even one funding year, may no longer stay confined there. For companies participating in FCC programs — including the emergency connectivity fund (ECF) and universal service fund (USF) — this shift raises the stakes for documentation, internal controls, remediation and readiness for OIG scrutiny.

The work plan

In late May, the OIG issued its 2026-27 work plan, outlining the audits, inspections and evaluations it plans to undertake over the next two years. The plan reflects the OIG’s continued focus on preventing fraud, waste and abuse in the FCC’s operations. But more notably, it indicates a more targeted and data-driven approach to oversight going forward, particularly for pandemic-era programs like the ECF. Read alongside OIG’s recent semiannual report to Congress, the work plan reflects a more sophisticated approach to oversight, signaling the potential for broader scrutiny — and, therefore, greater exposure — for FCC funding recipients. In particular, issues identified in pandemic-era programs could result in scrutiny in other FCC funding streams, increasing compliance risks for entities that participate in multiple FCC programs.

The plan acts as a strategic roadmap and provides transparency around how the OIG intends to carry out its mission and focus its resources. Among other things, the plan identifies the OIG’s expected discretionary projects. Because these projects are elective, their focus and the challenges they are meant to address offer useful insights into office priorities for the next two years. Among the discretionary projects in the 2026-27 work plan are: “A risk-based review of ECF participants to determine compliance with program requirements and identify potential fraud and improper payments,” and “A review of USAC’s program integrity activities, processes, and protocols related to USF.”

Safeguarding the integrity of the USF and pandemic-era programs has been an important oversight priority of the FCC OIG for years. But due to limited resources, the OIG’s oversight of these programs had been discrete and less systematic in prior years. For instance, in the past, audits focused on a single funding recipient, such as a single rural healthcare facility or a single county public library and assessed its compliance with program rules during one or two funding years. Even when the OIG pursued a program-wide audit, it did so through a narrow lens, typically focusing on narrow time periods, discrete program elements and/or relatively small samples.

Opinion

When Oversight Findings Lead to More Oversight: An OIG Report on China Exports

by Parisa Salehi

July 15, 2026

Six steps exporters should take to ready their due diligence, documentation and escalation for closer scrutiny

Read moreDetails

A data-driven shift at FCC OIG

The FCC OIG’s most recent work plan suggests that it may be adopting a new approach to how it scopes and executes its discretionary projects. The plan and report to Congress suggest that the office has adopted an integrated, data-driven and risk-based oversight model that, importantly, leverages cross-program analytics to better target limited resources.

Specifically, the work plan notes that the OIG intends to “us[e] data analytics to focus on high-risk areas and prioritiz[e] work that will assist FCC in addressing its top challenges.” The report to Congress elaborates on this intent, describing the OIG’s partnership with the Pandemic Response Accountability Committee (PRAC). The PRAC established the Pandemic Analytics Center of Excellence (PACE) to provide “a leading-edge analytic platform with the capacity and scale to help oversee more than $5 trillion in pandemic-related emergency spending.” PACE offers a range of analytic support tools to OIGs that include “data matching, anomaly detection, risk modeling, social network analysis, robotic process automation, link analysis, business intelligence, and open-source intelligence.”

These offerings have vastly enhanced federal OIGs’ ability to identify higher-risk recipients, detect anomalous patterns across large datasets and target audits and investigations more efficiently. With respect to the FCC OIG in particular, it has enabled the agency to develop data dashboards to better identify risks in three pandemic-era FCC programs: ECF, the Covid-19 telehealth program and the Emergency Broadband Benefit Program. According to the spring report, the dashboards incorporate over 30 risk indicators, such as “Small Business Administration fraud hold codes,” “delinquent federal debt” and “single audit findings,” drawn from various federal datasets. And by matching the risk indicators with the FCC’s program participants, the dashboards help the OIG identify high-risk targets for potential audits and investigations.

OIG auditors and investigators are already actively using the dashboards for their investigation and inspection of the Covid-19 telehealth program, and will use them for a “full scope risk-based review of the ECF program.” Participants who trigger multiple risk indicators will likely face heightened scrutiny, particularly where those indicators point to potential fraud, improper payments or weak internal controls.

Scaling oversight through data analytics

These same tools also may allow the FCC OIG to scale the scope of its audits and investigations in ways that were more difficult under its prior, more discrete oversight model. Rather than reviewing a single recipient, a narrow funding period or a limited sample of transactions, the OIG can use the analytical tools now available to identify patterns across larger populations of participants, longer time periods and multiple risk indicators. This may enable the office to design broader reviews that test compliance issues across a wider universe of recipients while still focusing investigative resources on those entities or transactions that appear most anomalous. In practice, that means future audits and investigations may be both broader in reach and more targeted in execution, increasing the likelihood that issues identified in one subset of data will prompt expanded review of related recipients, claims or funding periods.

Expanded exposure across FCC funding streams

Furthermore, the OIG’s new oversight approach may have implications beyond the specific pandemic-era programs under review. The office explained in its semiannual report that because “bad actors do not limit their fraud,” it enhanced the dashboards “to identify recipients in the[] COVID-era programs that participate in and receive funds from other similar FCC programs, such as Lifeline, E-Rate, and Rural Health Care.” The OIG further explained that though receiving subsequent funding is not itself problematic, being flagged for fraud, improper payments or other issues within the pandemic-era programs could result in scrutiny in multiple other FCC funding streams.

This is a meaningful development for FCC funding recipients. A finding or red flag in an emergency Covid program may prompt broader scrutiny of the participant’s conduct across other FCC funding streams, including ongoing USF programs. Taken together, the work plan and semiannual report indicate that the FCC OIG is working toward a more integrated oversight infrastructure, one that combines external datasets, interagency partnerships, risk scoring and cross-program review to identify targets and pursue remedies. This approach may allow the OIG to conduct broader and more targeted oversight despite its limited resources and may increase the compliance stakes for entities that participate in multiple FCC funding programs.

Implications for firms participating in FCC funding programs

For companies that participate in FCC funding programs, the key takeaway is that compliance issues are increasingly unlikely to remain isolated to a single claim, funding year or program. As the OIG becomes better able to identify patterns across datasets and funding streams, participants should expect that weak documentation, recurring control failures or unresolved audit findings may receive greater attention and potentially trigger broader review.

These risks are all the more significant in light of the FCC’s recent adoption of its own suspension-and-debarment program, which gives the agency a formal mechanism to exclude companies or individuals from participation in FCC funding programs such as the USF. The implications of a debarment under the program are not limited to FCC funding: Barred entities may also be precluded from doing business with the federal government more broadly.

Companies should therefore assess whether their compliance programs and internal controls are calibrated not only to meet program-specific requirements but also to withstand a more holistic, data-driven oversight review. In practical terms, that means maintaining clear support for funding requests and certifications, promptly remediating identified weaknesses and ensuring that compliance personnel can explain how controls operate across related FCC programs. Participants also may benefit from conducting targeted internal reviews of higher-risk submissions, vendors or program areas before an OIG inquiry arises.

This was adapted with permission.

The post The FCC’s Watchdog Is Mining Data Across Programs. Funding Recipients Should Take Note. appeared first on Corporate Compliance Insights.

AI has moved into financial reporting itself — proposing journal entries, drafting variance commentary — but a named officer still has to personally certify, under SOX Section 302, that the numbers fairly present the company’s condition. Shreyas Sampath argues that when a model rather than a person produces the output, the “reasonable basis” behind that signature quietly erodes.

When an AI model proposes a journal entry that gets recorded in the books or drafts the variance commentary that informs the financial report, a named officer still has to sign the Section 302 certification attesting that, to their knowledge, the financials fairly present the company’s condition.

“To their knowledge” is tricky here. It assumes the officer has a reasonable basis for what they are certifying. When a person prepares the number, that basis was a chain of people who could each explain their judgment. When a large language model (LLM) generates it, the chain has a gap where a reviewer used to sit, and the officer is the one who signs over that gap.

The teams I work with at Fortune 500 companies have moved AI into reporting workflows without settling what the certifying officer’s reasonable basis rests on once a model, not a person, produces the output. The answer most of them reach for — that IT owns it — is one that fails an audit.

The pressure to deploy is real, and adoption is outpacing oversight. More than half of finance leaders now use AI in some capacity, and the fastest movers are pushing it into financial reporting itself, where AI output no longer just supports human judgment. It shapes the numbers a named executive has to personally certify as accurate.

The reason this falls to the officer rather than staying a technical detail is that finance AI is not a single thing. Summarizing board prep with an LLM sits in a very different risk category than using AI to draft variance commentary or propose journal entries that get recorded in the books. One category supports a decision a person still makes and owns. The other produces output that becomes part of the record the officer attests to.

Most teams configure both kinds of use cases the same way, which is where the exposure builds quietly. The governance a decision-support tool needs and the governance a reporting-critical tool needs look almost nothing alike, and the officer inherits the difference.

Research published by WTW in March 2026 framed this as an emerging AI governance gap under Sarbanes-Oxley (SOX), with direct implications for officer certifications under Section 302. When SOX was written in 2002, it assumed a person made the material decision and could be asked to explain it. A model that generates an output from statistical patterns cannot be deposed, cannot walk an auditor through its reasoning and cannot stand behind a number the way a controller can. The reasonable basis the officer certifies to has to come from somewhere else, which means it has to be built into how the model is governed before the output ever reaches the certified statements.

Consider a use case nearly every organization wants to automate: transaction approval workflows. The logic appears straightforward. When a transaction meets a defined threshold, it should auto-approve. For categories like payments, however, the complexity surfaces quickly.

On a recent client engagement, transactions satisfied every threshold rule configured in the system, yet the underlying payment data was wrong. The result was a series of over- and underpayments to vendors, each one creating reconciliation work, compliance exposure and vendor-relationship fallout that dwarfed whatever efficiency the automation had bought. Now follow that error up the chain. Those payments hit the ledger. The ledger feeds the reporting cycle. That cycle produces the financials an officer certifies. If someone asks that officer what gave them a reasonable basis to sign, the honest answer is that an automated control approved the transactions, and the control was confirming the rule rather than the data. That is a thin basis to certify against, and it was thin from the moment the workflow was designed to validate thresholds without validating what fed them.

The reason this basis erodes so quietly is that the controls meant to protect it were built for a different actor. Internal control frameworks were designed to test whether a person followed a documented procedure. That logic does not translate cleanly to AI surfacing a reconciliation exception or drafting a journal entry for human review. When a model generates the proposal, the review control alone may not be sufficient, and the model itself often needs to be validated as part of the control design; these are choices that need to be made at Sprint One rather than discovered in Q4.

The pattern I see converging at larger audited organizations is narrower than AI vendor pitches might suggest. AI surfaces exceptions, identifies anomalies and drafts supporting analysis. A human retains sign-off on anything that flows to external reporting. The PCAOB has reinforced this direction in public remarks through 2025 and early 2026, describing AI as a tool that should support rather than replace professional judgment with clear documentation of how outputs are generated and reviewed.

Teams getting this right design for audit readiness from the first sprint. Model documentation, input lineage and review evidence are built into the workflow, not retrofitted once the auditors start asking questions. More than three-quarters of executives lack strong confidence they could pass an independent AI governance audit within 90 days, which is a clear signal that retrofitting is what most programs are doing.

These teams also treat governance as a finance-led discipline. AI model validation for reporting workflows is not an IT problem. Finance owns the control, so finance has to own the parameters, the thresholds and the documentation standard.

In my ERP and finance transformation work, “audit-ready from Sprint One” is less about documentation volume and more about a handful of non-negotiables that get locked in at kickoff. Three artifacts I insist on before any configuration begins: a requirements control matrix, a data architecture and process flow diagram mapping every automated decision point as well as functional and technical specs that define what a reviewer must see, capture and retain for every AI-assisted output that touches certified reporting.

Risk

10 Questions Every Organization Should Ask a Potential AI Vendor

by Angela Juneau

July 15, 2026

Adopting AI without understanding how it was built and how it handles data can expose an organization to risks that surface only once something goes wrong

Read moreDetails

Why ‘IT owns it’ leaves the officer exposed

The programs that consistently stall are the ones treating AI governance as an IT deliverable. The controls end up technically sound and operationally orphaned. When the auditor asks who owns model drift monitoring for the tool that proposes accruals, finance points to IT, IT points to the vendor and nobody has a defensible answer. The officer who signed the certification is standing at the end of that chain, and the chain does not reach a person who can account for the number.

Recent analysis from KPMG and Grant Thornton point to the same conclusion: Effective programs run on joint ownership across finance, IT, internal audit and the control owners themselves.

The gap I see most often is finance quietly outsourcing the governance question to IT because the underlying technology feels unfamiliar. The conversation usually starts with “IT is handling the AI piece,” which is a reasonable answer for infrastructure, model hosting and integration, but not for the parameters that determine whether an output is materially correct. Finance owns the threshold for what counts as a reasonable accrual, what constitutes an acceptable variance and what level of review a high-dollar payment requires. When those parameters get set by an IT team or a vendor default because finance never showed up to the design sessions, the control exists on paper but has no one in finance who can defend it to an auditor. Those parameters are the reasonable basis, restated in operational terms. An officer cannot certify a number with confidence when the thresholds behind it were set by whoever configured the tool, and finance is the only function positioned to set them well enough to make them worth standing behind.

Building the basis before the signature

The finance teams that pull ahead this year will treat AI adoption and control design as the same project, accepting a slower first sprint in exchange for something that scales. The deployment pressure is real, and 74% of CFOs now rank AI deployment as a top-three strategic priority. That pressure is exactly why the certification question cannot wait. 

Every workflow that moves AI closer to certified reporting adds another output an officer will eventually sign over, and the reasonable basis for that signature is either designed in at Sprint One or reconstructed under audit pressure later. Teams who understand that are building the basis now, while it is still a design choice rather than a deposition.

The post When AI Writes the Number, Who Has a Reasonable Basis to Certify It? appeared first on Corporate Compliance Insights.

68% of companies have exceeded budget on AI projects

While many companies still struggle to show meaningful ROI on AI projects and concerns persist over the financial risk exposure presented by agentic AI, about two-thirds of executives (64%) say the value of AI agents outweighs the risk, according to a survey by AI security and governance platform WitnessAI.

Only 9% of survey respondents said that 75% or more of their AI projects have delivered measurable returns, while 68% said their AI projects have exceeded budgets during the past year. Just 4% said their AI projects always stay on budget.

Beyond AI budgets being busted, leaders may underestimate the cost of AI incidents, according to the survey. More than a fifth of leaders (21%) reported a single AI security incident costing $1 million or more in the past year, while 43% said the total net cost of all AI-related incidents in that time exceeded $2 million.

A few other key findings:

• 44% of executives say a significant part of their total revenue would be at risk from regulatory penalties if a rogue AI agent exposes data.
• 17% cite governance bottlenecks as the primary reason their AI initiatives underperform on ROI expectations.
• Responsibility for managing AI risk is dispersed, with the chief information officer leading the way (30%) but CISOs (15%) and others like chief technology officers and chief AI officers also playing a role.

1 in 5 UK managers don’t get sexual harassment training

More than a fifth of business managers in the UK don’t receive dedicated training on sexual harassment, according to a survey by compliance eLearning provider VinciWorks.

The poll found that of 985 UK-based HR and compliance professionals surveyed, 21% said business managers aren’t given specific training on sexual harassment. Another 10% responded that mangers receive training but not consistently, while managers’ sexual harassment training is part of general staff training for just under a third.

VinciWorks’ report comes ahead of changes in the UK Employment Rights Act that mandate more rigorous measures to prevent sexual harassment in the workplace; those are set to take effect in October. 

The survey also found that 34% of employers have never carried out a sexual harassment risk assessment, which looks at where harassment could occur in the workplace, while 17% haven’t done an assessment in more than a year. 

Other key findings include:

• Nearly half (47%) described their training as needing improvement, while 14% admitted they provide no sexual harassment training whatsoever.
• Almost 43% reported they don’t provide bystander intervention training, though they would like to and another 23% don’t play to start.

5 themes that will define legal functions by 2030

Gartner has identified five themes that it says will transform legal functions by 2030 in a new report.

Regulatory change will broaden legal’s role, the company said. GCs will face new regulatory issues and a rise in AI disputes, resulting in legal teams playing a larger role in risk appetite, compliance practices, AI governance and IP protection.

Geopolitical volatility will intensify trade and supply chain risk. Changing trade policy, national security, technology battles, data sovereignty and privacy concerns will force legal to work more on trade compliance and supply chains.

AI and DIY technologies will change how legal work gets done. Improvements from technology will require more governance, training and human oversight.

New talent and sourcing models will redefine legal delivery, with Gartner saying its analysts “expect a more fragmented legal services market, with managed services providers, alternative legal service providers, consultants and technology vendors taking a greater share of work, while reduced junior hiring may constrain the long-term talent pipeline.”

Finally, the firm says legal must support growth while operating with fewer resources. 

The post As Costs Rise & ROI Remains Elusive, Majority of Execs Say AI Agents Are Worth the Risks appeared first on Corporate Compliance Insights.

2 Gurus Talk Compliance

What happens when two top compliance commentators get together? They talk compliance, of course. Kristy Grant-Hart and Tom Fox review current compliance news stories, corporate ethics, ESG and governance topics each episode, plus other top commentators in the field.

More from 2 Gurus Talk Compliance here.

The post 2 Gurus Talk Compliance appeared first on Corporate Compliance Insights.

A reader is entitled to three weeks off but can’t shake the feeling that taking them would be selfish, uncommitted or proof they’re expendable. Ask an Ethicist columnist Vera Cherepanova recognizes the setup for what it is: an ethical trap where every worry doubles back into a reason to stay at your desk.

I would like to take three weeks off work, which I’m formally entitled to, but I keep hearing this is a bad idea. If the company can manage without me for three weeks, will that mean I am expendable? Will it make me look less committed than others? And will it be unfair to the rest of the team, who will have to cover my work? Would taking so much time off be selfish or irresponsible, or, in an age of “unprecedented technological progress and AI-driven productivity,” is it finally perfectly ethical to take care of yourself when you need it? — No One Ever

If the company manages without you, maybe you are expendable. If it struggles, you have selfishly abandoned your colleagues. If you disconnect, you are not committed enough. If you remain online, you have not really taken a vacation. This is not so much an ethical dilemma as an ethical trap: Every possible outcome looks like evidence that you should continue working.

Back in 1930, the economist John Maynard Keynes made a famous prediction: By 2030, technological progress and rising prosperity would allow people in advanced economies to work 15 hours a week.

We are now in 2026, and that prediction seems very far from being realized. Many white-collar professionals regularly work 50 hours or more. In some industries, such as investment banking, that number can reach 80 to 120 hours. Even the four-day workweek remains an aspiration.

Yet, Keynes was not entirely wrong about the economics in question. The US became as rich and productive as he had imagined it would, substantially outpacing primary competitors, such as Europe and Japan in GDP growth. What did not happen was the conversion of that prosperity into substantially shorter hours in the office.

Still, there has been some real progress, with an interesting caveat. The data shows that the average American now works about 1,200 fewer hours a year than the average worker did in the late 19th century. But when we zoom in on households, something curious happens. In the 1880s, the typical married American couple averaged about 67 hours of paid work a week. In 2020? Still 67 hours.

Those numbers conceal an enormous social transformation. Once confined to domestic chores, more women entered the workforce thanks to household automation and profound cultural and economic changes. They began working fewer hours in the home and more outside it.

Married men underwent an opposite shift: adopting new technologies, including tractors, cars and computers, made workers more productive in their shorter workdays. Men gradually used their extra time to take on more hours of chores, errands and childcare at home. But these dynamics don’t fully explain why a rich and productive society does not allow its people to be able to work radically less or take more time off as Keynes anticipated.

There are many reasons — far more than I can fit into one column. Rising costs play a major role, but so do rising expectations about what constitutes a comfortable life. Buying a home, raising children and caring for older family members are all more expensive than they used to be.

Keeping up with the Joneses has become more challenging, too. It is difficult to feel prosperous when every part of daily life reminds you that someone else is in the faster line, using the preferred kiosk, sitting in the premium cabin or enjoying the better membership tier. Life simply feels better if you are in Boarding Group 1, right?

The rise of mass consumerism, social norms and the desire to match or exceed the lifestyle of others necessitate higher working hours, creating a hedonic treadmill effect where people feel compelled to continue working to afford the next set of luxury goods or experiences. We are also encouraged to take on more debt to afford those, which is another expansive topic for a conversation about ethics.

The result can be exhaustion, frustration and one reason why even upper-middle-class families can feel miserable. They have to push themselves beyond their limits just to keep up.

Another thing Keynes failed to foresee was the cultural value we would attach to work itself. Among many professionals, long hours have become a status symbol. Exactly as you write, busyness is conflated with importance, constant availability is seen as commitment and being indispensable sounds like the ultimate compliment. But is indispensability really a good proxy for value?

And what about AI, you asked Will the promised gains in efficiency finally reduce working hours? Will we at last have more time off, as we ought to?

Unlikely. Recent evidence shows that AI is making some people work more, not less. In one survey, 18% of developers reported AI-related exhaustion. Turns out AI agents may not reduce work so much as multiply the amount of work humans must initiate, monitor, correct, coordinate. The human becomes an AI babysitter, switching constantly among agents, suffering cognitive overload and feeling pressure to keep machines working around the clock. Some people now set agent tasks overnight and check their output before breakfast. Instead of a shorter workweek, we may be moving toward an “infinite” one.

Technology does not automatically give people leisure time, but it gives organizations and individuals the capacity to produce more. The opportunity to generate more output never stops, unless someone deliberately sets a limit.

It looks like we are trapped in a cycle, sacrificing our well-being for the next flat-screen TV, car, luxury bag or just converting every available hour into output. The bad news is that no one, not even AI, can give you permission to pause. No one, that is, except you. So, break out of the ethical trap. Take the three weeks. And do not spend the vacation checking whether everyone misses you enough.

(Speaking of taking your vacation time, Ask an Ethicist will take a summer break after this column drops to enjoy the remainder of summer. See you again in September.)

Governance

Out of Your Technological Depth? It’s Your Duty to Say So.

by Vera Cherepanova

June 17, 2026

If a director can admit to not knowing enough to make a decision, it’s a sign the board has built and reinforced honesty

Read moreDetails

Readers respond

The previous question came from an independent director facing increasingly technical board decisions involving AI, cyber and robotics. The dilemma revolved around whether admitting that they did not fully understand a material issue was compatible with good fiduciary conduct, raising questions about humility, competence, performative confidence, board culture, the duty of care and how directors can ask for more information or expert support without losing authority.

In my response, I noted: “In Delaware-style US corporate law, directors’ duty of care requires them to make informed decisions, so the substance of the point is sound. In the UK, directors have a statutory duty to exercise reasonable care, skill and diligence.

“John Weinberg, the man who laid down the foundational philosophy on governance and director qualifications in the United States, wrote in his famous 1948 Princeton thesis: “A director must not only be willing to direct, but more important … must know enough to direct,” and “The primary step to be taken is a comprehensive educational program.

“That means to exercise the oversight duty, directors need to make sure they are learning, and when they are expected to project confidence rather than acknowledge limits, that’s a cause for a serious governance concern. To reframe, the duty of care includes knowing when you do not know enough, asking for clarification, expert input or more time and should be viewed not as a weakness but as a strength.” Read the full column here.

Indeed, this kind of vulnerability should be a foundation for building and nurturing a strong organizational culture. When leaders are willing to acknowledge what they do not know, it creates psychological safety for others to speak up, ask questions and close knowledge gaps across the organization. This honesty from the top can turn uncertainty into better governance, stronger decisions and a more resilient culture. — MMA

Have a response? Share your feedback on what I got right (or wrong). Send me your comments or questions.

The post Yes, You Are Allowed to Take Your Vacation appeared first on Corporate Compliance Insights.

Many non‑US businesses assume that compliance with the European Union’s GDPR or a similar home‑country law will largely address US requirements, Kevin Coy and Erin Doyle of Arnall Golden Gregory write. But the US regulatory picture is fragmented, highly sector- and state-specific and generates distinct regulatory and litigation risks that often are not addressed by compliance with home-country laws.

Compliance professionals, in‑house counsel and business leaders should consider 12 areas of data privacy and security diligence, contract terms and governance when planning US operations. 

These areas are not mutually exclusive, and they often overlap. This list is also not exhaustive. Discrete federal and state privacy laws regulate a host of other areas not addressed here, ranging from motor vehicle records and educational records to video rental records, library records and loyalty program information, among others.

1. Sectoral federal privacy laws 

While the US does not have an omnibus privacy law, it does have a number of sectoral and issue-specific privacy laws. HIPAA regulations, covering certain health‑related entities, and the Gramm-Leach-Bliley Act, which regulates financial institutions, are prominent examples.

HIPAA governs protected health information held by “covered entities,” including many healthcare providers and health plans and their “business associates,” a broad array of companies providing services that involve processing protected health information on behalf of covered entities. Covered entities and their business associates must address HIPAA’s privacy, security and data breach notification regulations, including specific contracting and compliance requirements.

Some states, such as Washington and Nevada, have adopted robust health information privacy laws intended to fill gaps regarding the privacy of consumer health data where the HIPAA privacy rules do not apply, and the Washington law includes a private right of action.

The Gramm-Leach-Bliley Act applies to a wide array of financial institutions, not just banks, and requires specific privacy notices, regulates the sharing of “non‑public personal information” and imposes information security requirements.

Foreign businesses entering the health or financial services sectors should treat HIPAA and the Gramm-Leach-Bliley Act as primary regulatory regimes, not as mere supplements to home-country requirements.

2. State privacy laws

The US still lacks a single federal GDPR‑style law, but more than 20 states have now enacted comprehensive consumer privacy statutes, starting with the California Consumer Privacy Act and followed by states like Virginia, Colorado, Connecticut, Texas and others. California is one of the most operationally demanding states: It created a dedicated privacy regulator, the California Privacy Protection Agency and is comparatively aggressive with enforcement.

Each state’s law is distinct, but they all typically include privacy notice requirements, consumer rights obligations (for example, access, deletion, correction and opt‑out options), purpose limitation concepts, data minimization concepts and vendor contracting obligations. While these laws apply across sectors, they do not apply to all businesses due to a range of different applicability triggers and exceptions. As a result, the impact of this category of state laws depends on the size and scope of business operations and the states where business will be conducted. A threshold assessment of which state laws actually apply to an entity should therefore be considered a necessary first step in any US privacy strategy.

3. Marketing and communications privacy

In the marketing and communications space, the US federal CAN‑SPAM Act and similar state laws set rules for commercial email, including identification requirements, opt‑out mechanisms and header‑information accuracy. The Telephone Consumer Protection Act and parallel state mini‑TCPA statutes heavily regulate telemarketing, text messaging and certain automated calling. Do-not-call list rules also apply particularly but not exclusively to telemarketing communications. Some of these laws have driven substantial class action litigation.

4. Website tracking and video or call recording

Additional US laws regulate the recording of videos or calls and using website tracking technologies. Federal and state wiretapping and eavesdropping statutes, as well as call‑recording laws, require one‑party or all‑party consent to record depending on the jurisdiction. Additionally, plaintiffs are increasingly challenging “session replay” and other online tracking technologies like cookies and pixels under these legal frameworks.

For businesses considering US physical retail stores or other locations in the US, notices regarding video surveillance also may be required. Businesses entering the US market that are planning to engage in these types of activities should carefully review their practices in these areas to address compliance concerns and mitigate potential risk.

5. Children’s privacy

Businesses processing personal data about children must consider federal and state privacy laws. US federal law is anchored by the Children’s Online Privacy Protection Act, which applies to online services directed to children under 13 or that knowingly collect personal information from such children. COPPA requires clear notices, verifiable parental consent before collecting most data, limits on use and disclosure and reasonable security. COPPA is enforced primarily by the US Federal Trade Commission and state attorneys general.

In parallel, an expanding set of state child‑focused privacy and online safety laws (for example, age‑appropriate design‑style codes and teen‑specific protections) for people up to age 18 are imposing additional obligations around profiling, targeted advertising and default settings for minors, creating a multilayered regulatory framework.

Data Privacy

New CIPA Claims Expand Privacy Litigation Risk Over Website Consent Banners

by Andrew Chase

July 17, 2026

A lawsuit against Ace Hardware demonstrates the claims that can be brought against organizations under new California laws

Read moreDetails

6. AI and automated decision-making technology laws

New and proposed state laws governing AI and automated decision‑making technology are proliferating, focusing on AI transparency, data minimization, bias and discrimination risks and the need for impact assessments where models rely on sensitive personal information or materially affect individuals (for example, employment, housing, credit or access to essential services).

Non‑US businesses may need to adapt AI governance programs built around GDPR, the EU AI Act or other laws to address specific US disclosure, consent, notice and opt‑out expectations, as well as heightened scrutiny of training data, profiling and the reuse of consumer and employee data for AI purposes.

7. Employee and applicant privacy

Businesses entering the US market may be surprised by the patchwork of US employee‑focused rules. The federal Fair Credit Reporting Act and similar laws in many states regulate the use of third‑party background screening reports regarding applicants and employees, as well as use of such reports for other purposes. State and local “ban the box,” “fair chance” and antidiscrimination laws restrict when and how criminal history information can be requested and used during hiring, typically requiring delayed inquiries and individualized assessments. Other state laws restrict the use of credit reports and salary history information as part of the hiring process.

Employers also face state laws regarding lawful off‑duty conduct (for example, protecting certain lawful products or activities), drug‑testing constraints and restrictions on requesting social media credentials or disciplining employees for lawful online activity. These laws collectively require careful coordination of global human resources and compliance policies. Employee health plans also may be subject to HIPAA requirements for covered entities.

8. Biometrics privacy laws

Several states have enacted biometric privacy statutes, the Illinois Biometric Information Privacy Act being the most prominent example that is frequently cited in private class actions. These laws can apply to technologies like fingerprint time clocks, facial recognition for physical or logical access and voiceprints. These often require informed consent, data retention limits and secure disposal.

9. Cybersecurity laws

Data security obligations are increasingly being codified not just as general “reasonable security” requirements but as more detailed statutory standards and regulatory guidance. Many state privacy laws expressly require appropriate technical, administrative and physical safeguards connected to the sensitivity and volume of personal data, and some state laws prescribe specific controls, risk assessments, audits and governance structures particularly in financial services and critical infrastructure contexts. In addition, California will soon require certain businesses covered by COPPA to conduct cybersecurity audits and submit certifications. These state rules sit alongside — and sometimes go beyond — federal sectoral requirements, such as those under HIPAA or the Gramm-Leach-Bliley Act.

Businesses that have designed their security programs around GDPR or a single global standard should assess whether US state- or sector-specific mandates regarding encryption, access management, multifactor authentication, vendor oversight, incident response, board‑level reporting and regulatory reporting require tailored enhancements for US operations.

10. Data breach notification laws

All US states and territories have data breach notification statutes that impose obligations to notify individuals (and sometimes regulators or credit bureaus) when defined personal information is accessed or acquired without authorization, often subject to specific notification timelines and notice content requirements. These laws differ on the scope of covered entities and covered data, whether they carry risk‑of‑harm exceptions and whether delays are permitted for law enforcement needs, so multistate incidents require coordinated, state‑specific analysis.

In addition, some businesses are subject to federal breach notification rules under regimes, such as Securities and Exchange Commission requirements for reporting by publicly traded companies, HIPAA or the Gramm-Leach-Bliley Act. As such, businesses entering the US market should consider developing US-focused breach notification protocols to anticipate their response to a breach of US personal data.

11. Government and bulk US sensitive data transfer regulations

Unlike GDPR and many national data protection laws, the US has not traditionally regulated the export of personal data to other jurisdictions. In January 2025, however, the US Department of Justice finalized regulations that restrict or prohibit certain “covered data transactions” involving bulk US sensitive personal data or US government‑related data with specified “countries of concern” and “covered persons.” The rule defines “bulk US sensitive personal data” broadly to include categories like certain personal identifiers, precise geolocation, biometric identifiers, health and financial data and human genetic and molecular biological data when certain thresholds are met within a 12‑month period.

A separate law enacted in 2024 also restricts the sale or transfer of personal data by third-party data brokers to “adversary countries” or entities under their control, which could apply instead of or in addition to the DOJ regulations. Compliance with these requirements necessitates an understanding of data flows given that contractual safeguards differ depending on whether the parties involved are US, foreign or covered persons under these regulations. These measures would apply in addition to any data transfer requirements required by home-country data protection laws, such as GDPR.

12. Federal and state unfair or deceptive acts and practices laws

The FTC and state regulators have long used federal and state prohibitions on unfair or deceptive acts and practices (UDAP) to bring actions against businesses that have failed to keep their privacy and data security promises, as well as to act against businesses that engage in unfair privacy and data security practices. While businesses may overlook UDAP laws because they are broad prohibitions rather than detailed operational compliance regimes, federal and state regulators have brought hundreds of UDAP cases over the years. To avoid engaging in deceptive practices, it is important to ensure that a business’s public privacy and security promises are kept in practice. Additionally, unfairness claims do not require an unkept promise. For example, they can be brought if inadequate data security practices result in substantial injury to a consumer that the consumer could not have reasonably avoided. As a result, businesses considering US market entry should consider reviewing their privacy policies, notices and other promises and data security practices from this broader perspective in addition to more specific requirements applicable to their US operations.

Regulatory and litigation risks

Many of the privacy and security laws and regulations discussed above provide private rights of action that make the US litigation environment particularly attractive for class-action plaintiffs. Meanwhile, federal and state regulators — including the FTC, sectoral regulators, state attorneys general and specialized bodies like the California Privacy Protection Agency — actively bring regulatory enforcement actions for privacy and security violations.

Compliance with the GDPR or other non‑US data protection frameworks likely will support US compliance efforts, but it is not determinative. Even in instances where US federal and state laws share the same privacy protection goals as non-US privacy regulations, US laws can differ significantly regarding issues like scope, legal bases, consent standards, notice design and content, automated‑decision rules and, crucially, private litigation exposure. Non‑US businesses planning to enter or expand in the US market should therefore consider undertaking a targeted US privacy and data use assessment covering consumer, employee and business-to-business data flows to calibrate governance, contracting, technology and insurance strategies to this distinct regulatory and litigation landscape.

The post A Field Guide to Privacy Law for Companies Entering the US Market appeared first on Corporate Compliance Insights.

Some allegations are too sensitive for an internal team to handle credibly, particularly when they reach senior management or are likely to draw regulators’ attention. Carrington Giammittorio, Taryn McDonald and Miles Moody of Haynes Boone lay out how in-house counsel can recognize those moments and shape an independent investigation.

When allegations of serious misconduct surface within an organization, few decisions carry greater consequence than how to investigate them. While routine compliance concerns can often be handled internally, certain matters may require an independent approach. 

In-house counsel plays a critical role in recognizing when an independent investigation may be necessary, selecting outside counsel to lead it, assisting outside counsel with access to information and witnesses and safeguarding privilege throughout the process. 

When an independent investigation is warranted

While a variety of circumstances may warrant an independent investigation, the most clear trigger is when the allegations implicate senior management, including C-suite executives, board members or individuals with authority over compliance functions. In these situations, an internal team may face real or perceived conflicts of interest that undermine the investigation’s efficacy and even its credibility.

Similarly, when allegations are likely to attract regulatory scrutiny from agencies such as the DOJ, the SEC or state attorneys general, an independent investigation signals to regulators that the organization is taking the matter seriously and conducting a thorough, unbiased review.

Other situations warranting retention of independent counsel include matters involving potential financial restatements, significant whistleblower complaints, allegations of systemic compliance failures and cases where litigation is anticipated or already underway. In each of these scenarios, the perceived independence of the investigation can be as important as the substantive findings themselves. 

Structuring the investigation for credibility and effectiveness

Once in-house counsel decides to pursue an independent investigation, they must ensure that the investigation’s structure supports its objectives. Several key elements require careful consideration from the outset.

Selecting outside counsel 

Outside counsel should have deep experience in internal investigations and, if applicable, familiarity with the relevant regulatory landscape. When the investigation touches on regulatory issues, retaining a firm with credibility before the regulators’ scrutiny can pay dividends if the investigation’s findings are later presented to the government. 

Equally important is that counsel be free from conflicts of interest, not only with regard to the potential subjects of the investigation but also with regard to the company’s regular business. This means that in-house counsel may need to look beyond the company’s usual outside counsel relationships if their independence could be questioned. In-house counsel should conduct thorough conflicts checks, evaluate candidates’ relationships with the relevant regulators and ensure that the engagement terms clearly define the scope, responsibilities and reporting lines.

Establishing oversight and defining scope

In-house counsel should ensure that independent counsel reports to the board of directors, an independent committee of the board or a specially formed committee rather than to management. This reporting structure reinforces the investigation’s independence and helps insulate its findings from accusations of bias. 

In-house counsel should work with the relevant company committee to clearly define the scope of the investigation and the committee’s authority. Defining these parameters early helps prevent scope disputes and role confusion as the investigation progresses and can help streamline privilege determinations later.

The scope should be broad enough to address the core allegations and any reasonably related conduct but sufficiently focused to avoid the investigation becoming unwieldy. The scope should also be documented in writing at the outset of the investigation and revisited periodically, as new facts may necessitate expansion or refinement. Overly narrow scoping risks missing related misconduct, while an unbounded investigation can drain resources and delay resolution. 

Counsel should also ensure that the scope and engagement clearly indicate the company’s reason for the investigation, which will further assist in protecting privilege down the road. Finally, in-house counsel should establish a process for outside counsel to flag scope questions in real time so adjustments can be made promptly to avoid delaying the investigation.

Managing document preservation and collection

One of the first steps in-house counsel must take in support of an investigation is issuing a litigation hold or document preservation notice to all relevant custodians. This notice should be clear, comprehensive and promptly distributed. In-house counsel should coordinate with outside counsel and forensic vendors to oversee the collection process and ensure defensibility of the steps taken to retain relevant information. Counsel should consider and balance competing priorities: collecting and producing documents to outside counsel in a timely manner while limiting the number of individuals involved to protect privilege or safeguard sensitive information. This balance relies on the needs of the investigation and any time constraints as identified in the investigation plan.

In collecting and preserving information, in-house counsel should pay particular attention to ephemeral messaging platforms, personal devices, cloud-based repositories and AI-based programs, such as Copilot or ChatGPT, which are increasingly common sources of relevant evidence and frequent subjects of regulatory inquiry. Organizations with bring-your-own-device policies face additional complexity, as personal devices used for work purposes may contain relevant data that must be preserved and collected while navigating employee privacy expectations and any applicable agreements. 

In-house counsel is often best positioned to identify custodians, locate data sources and facilitate access within the organization. If the investigation involves extremely sensitive or confidential subject matter, such that there is a risk in broadcasting its existence even to a limited set of custodians, in-house counsel should work with internal and external IT vendors to ensure that all routine deletion is suspended from the back-end.

Conducting witness interviews

Witness interviews are the backbone of most internal investigations. In-house counsel should work with outside counsel to identify key witnesses and ensure that all relevant documents are provided before each interview session. In-house counsel plays a key logistical role in making witnesses available for interviews. In practice, witnesses are more receptive to cooperating with outside counsel when introduced by in-house counsel. Beyond facilitating an introduction, in-house counsel should assist in providing an appropriate private space for interviews to be conducted, ensuring that the setting preserves confidentiality and minimizes the risk that other employees will learn who is being interviewed. In-house counsel can also be instrumental in impressing upon witnesses the importance of not sharing the substance of the interview with other potential fact witnesses.

Some witnesses may be hesitant to work with outside counsel and may fear retaliation by the company for participating in the interview or providing honest disclosures. In-house counsel may consider including a copy of the company’s retaliation or whistleblower protection policy in its original outreach email to provide witnesses with reassurance that their rights will be protected. Additionally, these policies can help ease the hesitation some witnesses experience after outside counsel administers Upjohn warnings at the outset of every interview. While they can be uncomfortable, Upjohn warnings are necessary to inform witnesses that (1) counsel represents the organization and not the individual, (2) the conversation is privileged, but (3) the organization and not the witness holds the privilege and may choose to waive it. 

Failure to provide these warnings can create confusion, jeopardize the privilege and expose the organization to claims of improper representation. However, in determining how to deliver the warning, and who is the best conduit, due consideration must also be given to ensuring that the witness feels protected and empowered to freely and completely provide all information available to them.

Preparing the final product 

In-house counsel should work with outside counsel and the board or designated committee early in the process to determine the form of the investigation’s final work product, whether a written report, an oral presentation to the board or a combination. 

Written reports create a detailed record but also create a discoverable document if privilege is waived or successfully challenged. Oral presentations preserve greater flexibility but may be viewed as less rigorous. The choice often depends on the anticipated regulatory posture and litigation landscape. Regardless of format, in-house counsel should ensure that findings are presented with precision and supported by the evidentiary record.

Governance

AI Risk in 2026: 3 Critical Changes for the General Counsel

by Jenny Hamilton

January 20, 2026

The discipline legal ops brings — technology evaluation, vendor management, compliance monitoring — maps to capabilities required for AI governance

Read moreDetails

Privilege and confidentiality concerns

Privilege and confidentiality issues permeate every stage of an independent investigation. While outside counsel bears primary responsibility for establishing the protocols that protect these interests, in-house counsel plays an integral part in enforcing these protocols within the company.

The attorney-client privilege protects communications made for the purpose of obtaining legal advice, and the work product doctrine shields materials prepared in anticipation of litigation. To preserve both, in-house counsel should ensure that (1) outside counsel’s engagement is clearly documented as a legal engagement and includes the purpose of the investigation, (2) communications are marked as privileged and confidential where appropriate and (3) the circle of individuals with access to privileged materials is carefully limited to those necessary to the successful completion of the investigation. In-house counsel should establish clear internal protocols that separate legal communications from business communications, especially when in-house counsel often wears both a legal and a business hat. Mixing legal and business purposes in investigation communications is one of the most common ways privilege is inadvertently weakened or waived.

The tension between a desire for transparency and the preservation of privilege is often most pronounced when a government investigation proceeds alongside an internal inquiry. Regulators may request or expect full cooperation, which can include sharing the findings of an internal investigation. In-house counsel must carefully consider whether, to what extent and via what means to disclose investigation results to the government. Voluntary disclosure of privileged materials to a regulator may constitute a waiver of privilege as to third parties. In-house counsel should therefore develop a disclosure strategy in coordination with outside counsel, identifying what can be shared without waiving privilege, what requires a confidentiality agreement or common interest arrangement and what should be withheld.

Finally, beyond privilege, in-house counsel should not overlook the confidentiality expectations of employees and other stakeholders. Witnesses may have concerns about retaliation, and information leaks can compromise the investigation’s integrity. In-house counsel should establish clear protocols for information security, limit dissemination of findings on a need-to-know basis and ensure compliance with whistleblower protection laws and policies.

Reporting and self-disclosure obligations 

One of the most challenging tasks during an independent investigation is determining whether and how to report findings up the chain of command and, in certain circumstances, outside the organization. Under the Sarbanes-Oxley Act and the SEC’s standards of professional conduct, in-house attorneys who become aware of evidence of a material violation of securities laws or a breach of fiduciary duty are required to report that evidence up the ladder, beginning with the chief legal officer or the CEO. If the initial report does not result in an appropriate response, in-house counsel must escalate the matter to the audit committee, another independent committee of the board or the full board of directors. Failure to report up can expose both the attorney and the organization to significant regulatory consequences.

Beyond reporting up, in-house counsel must also evaluate self-disclosure obligations to external regulators and law enforcement. Certain regulatory regimes impose mandatory disclosure requirements or provide significant benefits for companies that self-report potential violations. For example, the DOJ’s corporate enforcement and voluntary self-disclosure policy provides concrete benefits, up to and including potential declination of prosecution, for companies that voluntarily self-disclose misconduct, cooperate fully and remediate promptly. Similar incentive structures exist at the SEC (see SEC enforcement manual § 2.5.1), CFTC (see Letter 26-15) and other federal and state agencies.

Despite the potential benefits, the decision to self-disclose is rarely straightforward. In-house counsel must weigh those potential benefits, such as cooperation credit and reduced penalties, against the risks, including triggering government investigations, waiving privilege and creating exposure for individuals within the organization. In-house counsel should work closely with outside counsel and the board or audit committee to develop a disclosure strategy that accounts for the specific regulatory landscape, the strength of the evidence or severity of the potential misconduct, the organization’s remediation efforts and the potential impact on ongoing or anticipated private litigation.

The post When Misconduct Reaches the C-Suite, Who Investigates? appeared first on Corporate Compliance Insights.

Relationships with public officials may sometimes become blurred through long-term projects and pressures of prolonging or keeping an engagement. Pei Pei Cheng de Castro and Jennifer Hopkins of Barclay Damon explain how compliance and legal units can spring to action to address these concerns.

The primary legal risks implicated by gifts, gratuities and hospitality may include federal, state and local criminal bribery and gratuities exposure, lobbying gift restrictions, procurement gift restrictions and related conflicts of interest. 

Key components of an organization’s gift-giving policy operating under a federal jurisdictional framework should also account for restrictions imposed by state and local jurisdictions. It is critical for in-house counsel and compliance officers to regularly review and ensure corporate policies are up to date, emphasizing prohibitions on quid pro quo, testing preapproval and tracking controls, instilling transparency and accurate records and implementing heightened controls for employees who regularly deal with public officials and compete for public projects. 

It is equally important for organizations to train on these topics, especially for those employees interacting with public officials.

The laws and rules

Federal law addresses giving or offering “anything of value” to public officials “for or because of any official act performed or to be performed” and separately addresses corrupt giving with intent. Federal rules for executive branch personnel permit acceptance only pursuant to ethics-office rules but expressly prohibit acceptance “in return for being influenced in the performance of any official act.” Executive branch officials and employees are generally prohibited from soliciting or accepting gifts or items of monetary value from persons or entities seeking official action, doing business with or regulated by the employee’s agency or whose interests may be substantially affected by the employee’s duties. 

Contracting officers must identify and evaluate potential conflicts of interest early and avoid, neutralize or mitigate significant potential conflicts before contract award. In addition, the FCPA prohibits giving something of value for the purpose of influencing acts or decisions of a foreign official, inducing unlawful acts or omissions or securing an improper advantage to obtain or retain business.

States and local jurisdictions also have laws prohibiting or restricting the giving of gifts to public officials, including bans on providing “directly or indirectly” gifts, entertainment, food and beverage, lodging, transportation or anything of value. This may include indirect gifts, such as donations to nonprofits made on behalf of or at the recommendation of a public official or their immediate family. In addition, gratuities — different from gifts — may also be prohibited.

FCPA

FCPA Compliance Programs Are Missing Important Nuances About How Bribery Works in the Persian Gulf

by Majid Mumtaz

April 1, 2026

Read moreDetails

Compliance policies

A compliant policy should define “gift and thing of value” broadly to include not only tangible items but also meals, entertainment, travel, lodging, transportation and other benefits, including indirect transfers. This breadth aligns with federal public-official concepts that address “anything of value” given directly or indirectly. It also aligns with the practical reality that state and local ethics laws often prohibit the direct or indirect provision of anything of value to public officials and may treat certain third-party benefits, including charitable donations made on an official’s recommendation, as prohibited gifts. Many policies do not mention or incorporate the concept of gratuities, which under certain jurisdictions may be unlawful.

A gift policy should include a clear prohibition on offering, giving or promising anything of value in exchange for influence or because of influence on an official act. The policy should also make it clear that intent to influence isn’t allowed. This is consistent with federal restrictions addressing giving anything of value “for or because of any official act” and separately addressing corrupt giving with intent. It is also consistent with the executive-branch gift framework that, regardless of ethics-office rules, prohibits accepting gifts “in return for being influenced in the performance of any official act.” Operationally, the policy should require employees to evaluate not only the item’s value but also the surrounding circumstances (timing, pending matters, recipient role and business purpose) to avoid gifts that could be construed as consideration for official action.

Heightened controls in the policies are necessary when dealing with government officials. Because executive-branch employees are generally prohibited from accepting gifts from certain sources (including those seeking official action or doing business with the agency), a company policy should impose heightened controls whenever the recipient is a public official or government employee. The policy should require preapproval or legal/compliance consultation before offering anything of value to any public official at any level of government because state and local jurisdictions may impose additional bans or stricter limits. 

Furthermore, the policy should address and provide guidelines for situations when a public official solicits the gift or gratuity. How to address solicitation by the public official is often lacking in an organization’s gift giving policy. A practical control is a mandatory permissibility check before anything of value is offered or given, including meals and event tickets, as well as indirect benefits, such as charitable donations connected to an official.

For entities that compete for or perform government contracts, the policy should emphasize related restricted contracts during blackout periods and implement controls to instill procurement integrity. Contracting officers must identify and avoid or neutralize significant conflicts before and after award. Early escalation to compliance and legal units should be incorporated when gifts, hospitality or relationships could create an appearance of impropriety or risk claims of unequal access. A practical control is a mandatory disclosure form for a vendor to disclose known or potential conflicts of interest.

If the organization interacts with foreign officials, the policy should incorporate FCPA standards: prohibiting giving anything of value to influence a foreign official’s acts or decisions, induce unlawful acts or omissions or secure an improper advantage to obtain or retain business. The policy should also address that certain expenditures, such as travel and lodging, may be defensible only if they are “reasonable and bona fide” and directly related to legitimate purposes as reflected in the statutory language. The policy should require preapproval and documentation for any travel, lodging or hospitality involving foreign officials, including a written business justification and confirmation of permissibility under applicable written local laws where relevant to the statutory affirmative defense.

Equally important is to implement targeted training for employees interacting with government officials and procurement personnel, emphasizing prohibited-source concepts, restricted contacts, solicitations, conflict of interest, gratuities and the need to avoid even the appearance of impropriety. 

The post Does Your Organization Have a Compliant Gift Policy Under Federal, State & Local Law? appeared first on Corporate Compliance Insights.

What it takes to break a deal and how boards should prepare

2026 report

Deals in Dispute: Activism Against M&A

What’s in this report from Diligent Market Intelligence and Seward & Kissel:

Contested M&A is no longer a niche concern. A new report from Diligent Market Intelligence, produced in association with Seward & Kissel, examines nearly 300 activist demands opposing the sale of US-listed companies since 2015, drawing on Diligent’s activism, voting and governance datasets. Opposition to announced deals has become a more durable feature of the public-company landscape, with activist success rates reaching their highest level in 2025 since 2018.

Some key findings:

• Proxy advisor recommendations remain a significant factor in contested deals, with the average vote in favor of an opposed merger varying dramatically depending on whether ISS recommended for or against.
• CEO tenure at target companies correlates with campaign outcomes, with oppose-sale demands proving considerably more likely to succeed against companies with shorter-tenured chief executives.
• Occasional activists accounted for the majority of oppose-sale demands examined and achieved at least partial success at a rate comparable to more established firms.

The post Deals in Dispute: Activism Against M&A appeared first on Corporate Compliance Insights.

What defined the 2026 proxy season?

2026 report

Trends & Updates From the 2026 Proxy Season

What’s in this report from Freshfields:

The 2026 proxy season was shaped by a significant shift in the SEC’s approach to shareholder proposals, widespread uncertainty around the future of Rule 14a-8 and a notable rebalancing of proposal categories. Governance proposals rose sharply to 322, up from 244 the year prior, while social proposals fell by nearly half and environmental proposals declined as well, even as support for both increased slightly. This report from Freshfields examines how those dynamics played out and what they signal heading into next year.

Some key findings:

• The SEC’s November 2025 decision to step back from its long-standing role as arbiter under Rule 14a-8 left companies and investors without clear precedent on exclusions, and at least six companies have since faced investor lawsuits over excluded proposals.
• AI-related proposals grew in number and scope, with institutional investors and proxy advisory firms also grappling with how AI is affecting their own stewardship models.
• Institutional investor influence is splintering away from a more centralized stewardship model, shifting the dynamics of shareholder engagement and how companies approach proxy solicitation.

The post 2026 Proxy Season Trends & Updates appeared first on Corporate Compliance Insights.