Less than 10% of company leaders confident in managing labor relations and AI

Only 9% of top company officials believe their organizations are very prepared to handle labor relations issues brought up by the adoption of AI, a survey by Littler found.

The survey of 665 in-house lawyers, HR professionals and business executives also found that about 70% reported being moderately to somewhat prepared and 20% reported not being prepared at all.

That lack of confidence comes as leaders recognize significant changes AI can make in their workforce. The survey found that 87% of respondents expect unions to use employee fears about AI displacing or changing jobs to fuel organizing interest in the next year. A notable portion also believes that increased AI use will reshape job responsibilities (67%), redistribute work across teams (42%) and reduce entry-level roles (30%).

More than half (58%) of unionized organizations have already heard concerns about job displacement and workforce reduction in union discussions, and 56% said concerns from workers about AI-related shifts in job responsibilities or productivity expectations have emerged.

Almost 90% of companies experienced a cyberattack this year

Nearly nine out of 10 multi-location companies were victims of cyberattacks in the past 12 months, according to a survey by VikingCloud.

The survey of 200 security and IT decision-makers at US and European companies with locations across the globe found that 86% reported having a cyberattack recently. More than three-quarters (77%) said the attack spread beyond where it started to other brand locations, corporate systems or shared vendor relationships.

More than half of respondents (51%) mandated a cybersecurity policy across all locations, but 33% of companies allowed for discretion in implementing corporate guidelines while 15% left cybersecurity policy to the individual locations. 

Almost nine out of 10 (88%) reported that ransomware attacks originating at individual locations or spread out from them have more frequent, more severe or both, and nearly an identical percent (87%) said that AI-generated phishing and deepfakes targeting location managers and frontline staff have gotten worse.

C-suite diverge in disruption-readiness assessments

Divides are brewing in the C-suite over companies’ disruption readiness. 

More than half of CEOs are confident their firms could handle a major disruption compared to less than a third of CIOs, according to a survey by Highspring of 1,137 c-suite executives and VPs of US and Canadian companies that asked the officials about their ability to overcome disruption of 10 core business functions, such as supply chain, cybersecurity, compliance or workforce disruptions.

Of the CEOs surveyed, 52% said they were very confident that their companies could handle a major disruption in the functions. Among CIOs, only 30% reported high levels of confidence in being able to tackle a major disruption.

The survey also found that CFOs were twice as likely to consider their companies’ core business functions to be exposed than CEOs with about 8% of CFOs calling core functions exposed vs. about 4% of CEOs on average across the 10 functions.

CEOs and CFOs also disagreed about how well their companies stay aligned during uncertain conditions with 8% of CEOs saying leadership doesn’t stay aligned and 15% of CFOs reporting non-alignment when conditions become uncertain.

The survey also found that a vast majority of leaders (95%) reported that business was disrupted by something outside company control in the last year and 67% felt such disruptions twice or more.

The post Company Leaders Wary Over AI-Related Labor Issues appeared first on Corporate Compliance Insights.

At this week’s SCCE Compliance & Ethics Institute, WorldCom whistleblower Cynthia Cooper told attendees her hands shook as she pursued the audit questions that would help bring down the company. CCI’s Jennifer L. Gaskin reports on the courage it takes to speak up and the values that hold when profit pulls the other way.

Cynthia Cooper didn’t set out to implode one of the world’s largest telecom companies, Wall Street and business media darling WorldCom. But as she made her way from office to office in the summer of 2002 seeking answers about what “prepaid capacity” meant in the company’s balance sheet, WorldCom’s vice president of internal audit was helping set in motion a chain of events that would send the company into bankruptcy and its CEO to prison.

This year marked 25 years since the collapse of Enron (followed the next year by WorldCom) and, coincidentally, featured the 25th annual Compliance & Ethics Institute hosted by SCCE, where Cooper detailed a whistleblowing journey that would pit her against WorldCom’s CFO and the chair of its audit committee.

Cooper didn’t describe herself as fearless; in fact, quite the opposite. 

“I can’t tell you I was this pillar of strength through this entire process. I wasn’t,” she told a session of conference attendees. In fact, at times, she says, her hands shook and her heart pounded. But she knew she had to find a way to push through.

The fear of speaking truth to power is one compliance professionals know, too, Cooper said, recalling advising a young compliance professional who reported being intimidated by executives with assertive and aggressive personalities: “You walk through that fear. You just do it anyway. And you ask the questions even if your voice is shaking.”

What carried Cooper through, she said, were her personal values, including her mother’s admonition to never feel intimidated. 

Values were a theme in a general session earlier in the day, when Piergiorgio Pepe, former compliance and ethics director at AbbVie in Paris, argued that values matter in all types of corporate situations but often are obfuscated or (as in the example of WorldCom) totally ignored in the pursuit of profit.

He pointed to the rapidly evolving, or de-volving as the case may be, state of corporate DEI, which is quickly falling out of favor. What other conclusions should employees draw, given that just a few years ago, leadership was crowing about inclusion being a corporate value, he asked?

“You cannot tell me that this was a fundamental value and all of a sudden it’s disappeared from the code of conduct. How trustworthy are you as a leader?”

Ethics

Business Ethics Is a Discipline, Not a Disposition

by Vera Cherepanova

September 23, 2026

What does a board director need beyond a moral character? Plenty, writes Ask an Ethicist columnist Vera Cherepanova, who says we should start with understanding the roles business leaders play in society.

Read moreDetails

Durable values in a negotiable world

The retreat from DEI is part of a broader shift in the business world from one that centers a variety of stakeholders to one in which “rules are flexible if inconvenient,” Pepe said, and where the short term is more important than the long term.

Compliance has sometimes played into the problem, Pepe argued, by focusing too much on making the case that compliance is a business advantage. True, he said, but only useful insofar as it helps open doors to more substantive conversations. It can’t be the final message, Pepe said.

The final message, he said, must be: “Doing the right thing is the right thing to do regardless of whether it makes money or not.”

For compliance and ethics practitioners, that means not simply explaining what the rules are but why they exist, Pepe said. People who understand the underlying reasoning, linked to the company’s values, will begin to operate as if the reasoning is their own.

It also means elevating values to the same level as other mission-critical terms like financial targets — not relegating them to the bottom of the slide deck — and making sure leaders’ actions match their messaging. A year-end note about integrity rings hollow if two weeks later, a manager known for mistreating subordinates gets a shiny new promotion.

Mostly, though, making sure companies actually live up to their values is uncomfortable work, so E&C professionals need to be OK with that, Pepe said.

“There’s no ethical work without discomfort, my friends,” he said.

What whistleblowers need

Cooper shared the stage with Jane Norberg, a former chief of the SEC’s whistleblower office, and Carrie Penman, now an executive at software company NAVEX, who was the first ethics officer at Westinghouse. Penman recalled answering the company’s hotline calls herself early in her career and hearing the fear in reporters’ voices.

“It is a very, very difficult decision for somebody to come forward and raise an issue,” Penman noted, urging session attendees to remember that when they engage with possible whistleblowers.

One of the biggest reasons employees don’t come forward, research has shown, is the fear of retaliation, but what companies do in the earliest moments can be everything. The first touchpoint with a reporter can “make or break the entire rest of the relationship,” Norberg said. She recommended acknowledging reports within 24 to 48 hours, thanking the reporter and, in cases where their identity is known, interviewing them before anybody else.

She also warned against a common corporate reflex: immediately sending the complaint to the person the complaint is about. Once the accused knows about the report, later actions regarding the reporting party can appear retaliatory, even if they’re not, Norberg said.

Still, Cooper said the negative consequences for whistleblowers are nearly universal in her experience, and she urged E&C teams to keep in close contact with people who come forward.

“Empathize with the person. Independence or confidentiality doesn’t mean that there should be no communication with the whistleblower,” she said. “So don’t isolate them.”

The post ‘There’s No Ethical Work Without Discomfort’ appeared first on Corporate Compliance Insights.

A performance review, warning or promotion decision can later become evidence in a discrimination dispute — and AI compliance analysts Hekim Colpan and Phillip Wikes warn that AI-assisted drafting can leave a record looking more polished than the evidence behind it.

The story of an employment decision does not end when a manager makes the call. A performance evaluation, warning, promotion decision or termination memorandum may later become evidence through which someone asks whether the stated reason was legitimate, consistently applied and supported by what was known at the time.

When AI helps draft that evaluation, warning or memo, the risk is not simply that the prose contains an error but that the record looks more polished than the evidence supporting it.

We call that gap “decision reconstruction risk”: a condition in which a consequential record can no longer show, on its own, why a decision was made. In employment matters, this is consequential because discrimination disputes can turn on the reasons an employer gives and the evidence surrounding them.

McDonnell Douglas Corp. v. Green established a burden-shifting framework. Where it applies, an employer may articulate a legitimate, nondiscriminatory reason for an employment action and the plaintiff may seek to show that reason is pretextual.

The US Supreme Court in that case did not hold that documentation quality determines whether discrimination occurred. Documentation can matter when the stated reason is tested against contemporaneous evidence, prior records and the consistency of the employer’s explanation.

Consider a file where the underlying history includes emails, attendance records, completed work and prior feedback, while the final document contains a polished narrative that does not clearly connect its conclusions to those materials. 

An employer in that position can articulate its reason, but what it may not be able to do is show the reason was the one it actually applied.

The pattern may appear only across employees

A single record is reviewed on its own terms. A workforce of records is reviewed together. That is where AI-assisted drafting introduces a risk most organizations do not currently measure.

AI-assisted drafting often reproduces language across performance reviews, disciplinary records and promotion decisions. A phrase that appears neutral in one file may take on a different significance when it recurs across a group. The reason this happens is straightforward: A drafting tool may reproduce phrasing when prompted with prior records, while a reviewer approving one record at a time may have no vantage point from which to notice the pattern.

Examples include “cultural fit,” “executive presence,” “not adaptable,” “communication style” and “struggles with change.” The issue is what happens when subjective language is repeatedly used to describe employees who share a protected characteristic and the organization cannot identify the evidence behind those descriptions.

Side-by-side review asks two questions: whether the same subjective standards are being applied across employees and whether the organization can identify the evidence supporting them. Disparate treatment and disparate impact remain distinct theories with different elements and proof structures. Recurring language can become relevant evidence when combined with surrounding facts, employment outcomes and decision history.

And banning particular phrases achieves little. What helps is requiring subjective conclusions to be connected to identifiable evidence before the record becomes final and reading across records rather than only at each one.

HR Compliance

Your Compliance Dashboard Can’t Tell You Everything About Employee Relations

by Deb Muller

May 28, 2026

The first signal that you have a compliance problem is retaliation allegation rates

Read moreDetails

What a defensible employment record should show

A consequential employment record should allow an independent reviewer to answer four questions:

• What happened?
• What evidence supports the characterization?
• Why did those facts matter?
• Was the same reasoning applied consistently?

“Not a strong cultural fit” is a conclusion. A record identifying specific conduct, dates, expectations and prior feedback gives a reviewer something that can be examined.

Before: “Attendance issues affecting the team.”

After: “Missed nine scheduled shifts between January and March. Attendance expectations were discussed in documented feedback on two occasions.”

Before: “Lacks professionalism.”

After: “Missed client deliverable deadlines on March 3, March 10 and March 17. Feedback was provided after each occurrence.”

The second versions make the basis of the judgment visible and give a later reviewer evidence against which the stated reason can be tested.

A pre-finalization control can close the gap

The control does not require a new platform or a wholesale redesign. It can be a structured review before a consequential employment record becomes final.

At minimum, the review should require the organization to:

1. Identify the human author and any AI tools used in drafting.
2. Preserve source evidence supporting material conclusions.
3. Link conclusions to verifiable source evidence rather than AI-generated assertions alone.
4. Document who reviewed the record, when and what substantive changes were made.
5. Define what drafting-layer material is preserved for consequential records and under which legal-hold triggers.
6. Review records across employees for recurring subjective language or inconsistent standards.
7. Confirm that the final explanation is consistent with documented history that existed before the decision.

The organizing principle is preservation rather than retention — enough evidence to reconstruct and defend the record when its author is no longer available to explain it.

A note for organizations operating in Europe

In Europe, the same employment-record problem sits at the intersection of data protection and AI governance. GDPR’s accountability principle requires controllers to comply with the data-protection principles and to be able to demonstrate that compliance. It does not require every prompt or draft to be retained. But where personal data support an AI-assisted evaluation, warning, promotion or termination record, gaps in provenance, factual verification or human review can undermine the organization’s ability to demonstrate compliance with the applicable data-protection principles.

Article 22 adds a distinct safeguard where a decision is based solely on automated processing and produces legal or similarly significant effects. An employment record does not become an Article 22 case merely because AI helped draft it. That distinction makes meaningful human review more important; formal approval is weak evidence of human judgment if the reviewer cannot identify the underlying facts, verify material conclusions or explain why the AI-assisted characterization was accepted.

Employment is also an area the EU AI Act treats expressly as sensitive. Annex III covers certain AI systems intended for recruitment and selection, decisions affecting promotion or termination, task allocation based on individual behavior or personal characteristics and worker monitoring or evaluation. 

Whether a system falls within the high-risk regime depends on its intended purpose, not simply on AI appearing in the drafting process. Under Regulation (EU) 2026/1744, the relevant high-risk requirements for Annex III systems are deferred until December 2027. Many employment-drafting workflows may therefore fall outside that regime. 

But the governance question remains: when AI-assisted language becomes part of a permanent employment record, can the organization still show what evidence supported the characterization, what AI contributed, what a human verified and whether the same standard was applied consistently across employees?

The employment record is part of the decision

For compliance and HR leaders, the practical question is not whether AI should write employment records but whether the organization has any controls at the point where AI-assisted language becomes part of the permanent record.

A defensible record lets someone who was not present reconstruct the reasoning and test whether the stated explanation matches the documented history.

When employment records are reviewed side by side, the question may shift from an individual employee’s wording to whether the organization’s records reveal standards that were subjective, inconsistently applied or difficult to defend.

We use the shorthand “right to know why” for that governance principle. It is not a legal doctrine and not a claim of any new entitlement. How the drafting happens has changed, but the standard the record has to meet has not.

The post That AI-Drafted Termination Memo Could Become Evidence appeared first on Corporate Compliance Insights.

The frameworks and safeguards that make boards feel AI risk is handled usually leave out the one defense that actually holds the line: employees. Social scientist Caterina Bulgarella explains why the uncertainty and job insecurity AI provokes erode the very resources that keep people vigilant and honest, making an ethically engaged workforce a strategic priority.

The job apocalypse many predicted may be postponed, but AI is on pace to reshape both work and the workplace. Call it co-intelligence, hybrid execution, integration or human-in-the-loop, the use of machines to replace, complement or, at best, supplement human performance is a vision that merely lacks scale. The only fuzzy point? Employees’ role in it. 

Amid shiny promises and alarmed safety calls, AI is already bringing change, not only to how people work but also to the values they share — each new prompt a rewrite of the human code we used to hold. The urgency of disruptive technology may shape the business agenda, but it doesn’t erase the need for alignment, not only between AI and what defines humanity but between humans and their moral compass. Even if senior leaders defer the question of what principles their business stands for, a business without an ethical core is only as capable as an algorithm generating output it cannot understand. 

Philosophy aside, it’s AI’s behavior that demands a full-court risk-and-ethics posture. In equal parts dangerously wondrous and disruptive, “artificial” intelligence hallucinates, fabricates, cheats, breaks rules and gets out of control. Putting in place governance frameworks, implementing technological safeguards, even waiting for machines to control machines may give boards and organizations the impression that risk is under control. But without employees acting as the first line of defense, businesses’ exposure remains too high.  

If anything, in the AI era, creating an ethically engaged workforce is not only desirable but a top strategic priority. For without people discerning and anticipating the ripple effects of today’s change, no business moat can fill the gap of what we don’t yet know. 

So, what does it take to build ethical engagement?  

At a time of weak shared values, eroding trust, dwindling attention and scarce empathy, organizations must start by managing the emotional blind spots, cognitive risks and cultural gaps weighing on employees.  

Mitigating the emotional toll of change

Three factors keep depleting people’s emotional resources: uncertainty, job insecurity and fear of irrelevancy. Technological change is unfolding against the backdrop of broader geopolitical, economic and societal shifts. This means that, while AI is forcing people to constantly second-guess changes to their jobs and work environment, macro uncertainty is fueling a state of generalized anxiety. Among Gen Z, the newest entrants to the workforce, the toll couldn’t be higher — low well-being combined with increasingly pessimistic career expectations.  

Uncertainty doesn’t simply consume employees’ emotional resources; it also reduces their ability to remain vigilant, discerning and willing to do the right thing. Studies show that uncertainty shifts attention to the short-term and heightens self-concern, two crippling conditions that increase the risk of unethical behavior.  

Even more dangerously, job insecurity creates emotional exhaustion, a form of depletion that, both directly and indirectly, boosts the risk of misconduct. On a different level, fear of becoming unemployed and/or potentially unemployable triggers not only shame but a genuine sense of unfairness, making it easier for employees to rationalize unethical conduct.  

When job insecurity is fueled by fear of irrelevancy — such as the loss of career prospects or the need for a career change — the perception of unfairness grows even deeper. Take, for example, reports that Gen Z employees have started sabotaging AI in the workplace. These statistics are not only a mirror of the negative emotions spreading across the workforce; they also document a willingness to break rules and norms at odds with organizations’ need for ethical engagement. 

Though companies cannot control external sources of uncertainty, they have a plethora of tools to manage the emotional toll of change. They can use dialogue to build a climate of transparency and honesty. They can choose to stay away from promises they are unable to deliver. They can invest in behavioral integrity — showcasing how they walk the walk. They can structure the employee experience to help people navigate and manage change, from regular check-ins to effective feedback channels and design initiatives. Finally, they can help employees develop and practice new skills, transition into new roles and feel valued for their problem-solving and initiative-taking.  

These actions may not fully heal the negative consequences of change, but they can mitigate them, thereby rebuilding emotional resources. More importantly, they turn the employer from antagonist into ally, helping employees form a genuine sense of attachment and ownership toward the organization. 

Ethics

From CEO’s Heinous Killing, a Window Into the Perils of Unfairness When People Crave Leadership

by Caterina Bulgarella

January 29, 2025

The broad-daylight killing of UnitedHealthcare CEO Brian Thompson was stunning not just for its brazenness but for the public response, which in some corners seemed to celebrate Thompson’s murder. Social scientist Caterina Bulgarella explores the long-simmering dynamics that turned a murder on the streets of

Read moreDetails

Preparing for AI’s cognitive risks

As AI keeps scaling across business, the cognitive risks of continued and sustained AI use present organizations with both an ethical and talent dilemma. From an ethical standpoint, the long-term question is whether business should be held responsible for AI’s potentially harmful effects on employees. As of today, known risks include hallucinations, cognitive offloading and linguistic homogeneity. Worse, as AI use becomes further entrenched in the workplace and scientific research advances, we may discover that its cognitive toll is far greater than currently understood.  

From a talent standpoint, AI’s negative cognitive effects not only represent a threat to business competitiveness but also run at odds with the goal of building workforce capacity, including ethical engagement.   

While the impact of hallucinating and cognitive offloading on ethical awareness and moral engagement is intuitive, linguistic and stylistic homogeneity pose risks as well. On the one hand, they create the appearance of rule-abiding conduct — irrespective of actual conduct. On the other, they may numb attention to language and behavior, two critical indicators of conduct risk.  

Unlike other challenges, organizations do not yet have a toolkit to address AI’s cognitive risks. What’s more, the solutions that have been floated so far not only fail to mitigate the threat but raise additional ethical questions. Take, for example, the suggestion that demonstrating intellectual curiosity is a precondition for surviving AI’s cognitive toll, or the proposition that some jobs should be reserved for humans.  

While both approaches assume that selectively preserving human value is a good enough solution, neither one is a tested mitigation strategy for cognitive risk. Nor does either proposition address the fact that continuing to expose entire swaths of the workforce to AI’s potentially harmful effects creates talent constraints, opens the door to new business risks and raises difficult ethical questions, starting with who should be in the cognitively preserved group — and why. 

So, how can organizations manage AI’s cognitive risks at scale while entrenching AI use deep and wide into their operations? Instead of looking merely at workflows, companies should focus on the cognitive processes through which people engage with, consume and use information, problem-solve, experience authorship, learn and develop. Redesigning these aspects of work may not only prove the more effective way to put cognitive safeguards in place, but it may be the only way to ensure ethical AI adoption. 

Re-writing the psychological contract

In introducing a technology that reshapes nearly everything, businesses must do more than tinker at the edges of the old psychological contract. Redesigning organizational processes and workflows is important, but it is not sufficient. What’s changing today is not only how we work but — more fundamentally — the expectations around work.  

Prognostications about who will and will not survive professionally in the age of AI are mere distractions and part of a faulty calculation. Before making any transfer to technology, organizations should first figure out the value of today’s human moat, whether and how they want to invest in human capital and what type of relationship they want to build with employees. In short, they should re-write the old psychological contract well ahead of the awaited job apocalypse.  

This is not a purely ethical or philosophical stance. As firms may increasingly discover, unlike past change cycles, AI adoption is poised to unleash a level of resistance proportional to its disruption, with costs for both business operations and corporate culture. Consider the need for employee engagement, including ethical engagement, and the implications of failing to reframe the psychological contract first become immediately clear — from escalating tension between self and organizational interests to an increased risk of corporate failure.  

Indeed, for today’s organization, the question of whether the business can survive and thrive is deeply intertwined with its workforce, whether senior leaders want to acknowledge it or not.  

The post AI Governance Frameworks Won’t Save You, but an Ethically Engaged Workforce Might appeared first on Corporate Compliance Insights.

A company that’s bad at cybersecurity isn’t really complying with any of the policies it works so hard to enforce — that’s the case federal investigators made to compliance leaders at this year’s SCCE Compliance & Ethics Institute, CCI’s Jennifer L. Gaskin reports.

Compliance officers are accustomed to being labeled as their organizations’ internal cops (or much worse). Josh Goldfoot, a deputy assistant attorney general in the DOJ’s Criminal Division, sees them differently: as “advisers and architects that are creating systems that help your organizations follow the law, behave ethically and head off problems.” That’s why he recommends they make sure they’re taking up a particular agenda item: cybersecurity.

“If your organization is bad at cybersecurity, then ultimately, is it really complying with any of the policies you sought to enforce?” Goldfoot asked attendees this week at SCCE’s 2026 Compliance & Ethics Institute in Orlando, the organization’s 25th annual event.

The question is becoming more urgent as fraudsters increasingly use AI-enabled tools to scale their reach and improve their tactics. In 2025, the FBI’s Internet Crime Complaint Center logged more than 1 million complaints for the first time, up from about 860,000 the year before, with losses of nearly $21 billion.

Gone are the days when antivirus protection would suffice, even for companies that don’t think of themselves as exposed, Goldfoot said. 

“If you have money, and you’re connected to the internet, you are of interest to sophisticated hacking groups,” he told the assembled crowd of compliance leaders.

AI is erasing the warning signs

Much of the acceleration the FBI’s cybercrime data highlights is being driven by AI, said Jason Cromartie, special agent in charge of the FBI’s Cincinnati field office, who opened the general session Monday. Phishing remains a leading way attackers get into networks, and generative AI tools have made messages appear more sophisticated than in years past. Bad grammar and spelling aren’t dead giveaways anymore. 

“These tools reduce the traditional warning signs and allow attackers to exploit trust at a whole new level,” Cromartie said.

Deepfakes are becoming more realistic, and voice cloning is on the rise. Cromartie described an FBI investigation involving a Fortune 500 company that lost $1 million after an employee acted on a cloned voicemail from the CFO, who was overseeing a merger at the time. 

The next frontier is agentic AI, he said. AI agents can search for information, select targets, create believable personas and attempt exploitation continuously, making attacks harder to detect and disrupt.

“We’re all trying to play catch-up to the rapid advances in the technology,” Cromartie said.

IBM’s 2025 annual report on the cost of a data breach indicated that about one in six data breaches involved attackers using AI, most often via AI-generated phishing and deepfake impersonation attacks.

The role of compliance

AI may be amplifying the problem, but it didn’t create the root cause of the issue, which often comes down to the human element. Organizations have spent years trying to train their way out of this problem. Annual cybersecurity modules and simulated phishing emails are standard fare across companies and organizations of all sizes and industries. 

Still, business email compromise is the second-costliest category in the FBI’s 2025 report, accounting for more than $3 billion in losses. And IBM found that phishing was the most common attack vector, accounting for 16% of all data breaches in their report.

“Humans do not always make the best decisions,” Cromartie said. “Threat actors are often using that as a vector.” And it doesn’t take much: “One person, one click can cause a lot of damage.”

For Goldfoot, that makes cybercrime an ethics and compliance issue: “How are the interests that you work for, the values and ethics that you want your organizations to uphold, how is that affected by the new cybercrime threat?” he asked.

Consider the checks and balances an organization builds around protecting patient information, he said. How much is that work worth if an attacker simply walks off with the data? That leads to a harder question about compliance’s place in the organization. How much influence, and how much oversight, should compliance have over cybersecurity practices? And if the organization isn’t assessing the threat correctly, is that something compliance can help fix?

Cromartie suggested compliance leaders are well positioned to try. “You have the responsibility to understand almost every aspect of the business operations that you’re with,” he said. “You have to see the big picture, you have to see what’s around the corner as well as over the horizon.”

That includes AI. Cromartie urged organizations adopting AI tools to establish governance with cross-functional ownership, map who uses the technology and what data it touches, measure for security flaws and bias and deploy firm guardrails, including routine human audits. He also recommended bringing in as many stakeholders as possible, including the CIO, the chief security officer, legal counsel and subject-matter experts.

Cybersecurity

Why CISOs and Boards Must Speak the Same Language on Cybersecurity

by Monica Landen

February 4, 2025

Translating cyber risks into boardroom terms is essential for resilience

Read moreDetails

Why call the feds

Despite the growing threat, many victims still don’t pick up the phone. When the FBI infiltrated the Hive ransomware group a few years ago, investigators could see which companies the group was attacking, Goldfoot said. They warned targets and, in some cases, handed over decryption keys. They could also see how many victims had already contacted law enforcement on their own: only about 20%.

That is mirrored in IBM’s report, which found that among organizations that had a ransomware attack, the share of those contacting relevant authorities actually fell from 2024 (52%) to 2025 (40%).

Companies have reasons for hesitation, to be sure: embarrassment and reputational damage, namely, and many pay the ransom demand and hope the crisis ends there. But it often doesn’t end there. A 2025 CrowdStrike survey found that 83% of organizations that paid a ransom demand were attacked again anyway, and 93% had data stolen.

The message from both Cromartie and Goldfoot is clear: Don’t pay.

“Blackmail does not end until the victim of the blackmail decides that it ends,” Goldfoot said. Cromartie agreed: Even after a second payment, “there is nothing that prevents them from having that data they’ve taken, selling it.” Goldfoot added that some ransomware groups are under US sanctions, which makes a payment a legal risk of its own.

Coming forward, by contrast, doesn’t put a company in the crosshairs, Goldfoot said. Law enforcement treats those who report as crime victims, not suspects: “You don’t go to a crime victim and start lecturing the crime victim about all the things they could have done to prevent being a crime victim.”

Investigators work through a company’s own forensics firm and receive only what the company agrees to share, he said. Court filings identify victims anonymously, and information stays in the criminal investigative file. “We’re not regulators,” Goldfoot said. He urged companies to build those relationships before an attack, including through the FBI’s InfraGard program.

Goldfoot closed with a reminder that law enforcement can’t solve the problem alone. Every type of policing, he said, “only works when we have the support of the community that we’re trying to protect. And in our case, that means protecting everyone with a computer.”

“We’ve struck fear in the hearts of some ransomware actors,” he said. “But I want to do more of that.”

The post Feds: Cybercrime Is Getting Worse & Compliance Can’t Treat It Like Someone Else’s Problem appeared first on Corporate Compliance Insights.

Two Mexican business owners were sanctioned this summer by US authorities who say they helped a drug cartel smuggle fuel across the border. Combined with last year’s designation of cartels as terrorist groups, traditional due diligence may not cut it anymore in Mexico, write Alejandro Ortega, Miguel Salcedo and David Williams of FTI Consulting.

In June, the Office of Foreign Assets Control (OFAC) targeted and sanctioned two individuals and seven companies in Mexico for facilitating the Cartel Jalisco Nueva Generación (CJNG), a cross-border fuel smuggling network. The designated companies included a financial services company, freight and transportation firms and a real estate company, all owned or controlled by the same individual. None of the sanctioned individuals or companies had previously appeared on OFAC’s specially designated nationals and blocked persons list prior to the June 30 action.

This highlights a broader challenge for companies conducting business in high-risk environments: Criminal networks increasingly rely on legitimate commercial structures and supply chains to facilitate illicit activity. In today’s Mexican regulatory environment, the question is no longer, “Is this company sanctioned?” but rather, “Should this company be doing the business it claims to perform and who ultimately benefits from it?”

Why traditional Know Your Client checks falls short

Conventional due diligence practices are built primarily around sanctions and watchlist screening procedures conducted during an onboarding procedure. Historically, these methods were designed to identify counterparties that have been named by a regulator or law enforcement agency. However, they were not designed to detect facilitators before that designation occurred, or to identify relationships between counterparties that appear unrelated.

One of the two individuals designated controlled six Mexican companies in three sectors, including one based in the UK. Viewed individually, none of the designated companies would have appeared to be connected. It was only by examining the ultimate beneficial ownership of these companies that the individual emerged as the common link connecting the network.

The man was designated by OFAC for providing services, material and financial assistance to CJNG. Through his role, he facilitated fiscal fuel theft schemes by using a network of companies. In a traditional Know Your Client (KYC) review, none of these characteristics would have been identified through standard sanctions and watchlist screening because, in part, before the June 30 designation, neither he nor his companies appeared on the OFAC’s sanctions list, and their operations were dispersed across different industries and jurisdictions, giving little indication that they formed part of the same network. The common link appeared only when the companies were viewed collectively through their ownership structure rather than as independent legal entities.

This illustrates the fundamental limitation of traditional due diligence: Screening can identify counterparties that have already been designated, but it is far less effective at revealing commercial networks, ownership structures and facilitators that remain hidden. The need for a more comprehensive approach is reinforced by the evolving US enforcement landscape.

The June designations came just over a year after six Mexican cartels, including CJNG and Sinaloa, were designated as foreign terrorist organizations (FTOs), which means that companies with Mexico-related business activities operating in or with exposure to high-risk sectors face legal, regulatory and reputational risks associated with commercial relationships that may directly or indirectly benefit designated organizations.

Reliance on basic sanctions screening alone may no longer provide a sufficient understanding of counterparty risk, and organizations operating in Mexico should instead adopt a risk-based approach that considers the nature of the industry, the jurisdictions in which a counterparty operates, the complexity of its ownership structure, its regulatory authorizations and the broader supply chain. Depending on the level of exposure, companies should also evaluate whether enhanced due diligence measures are needed to identify hidden risks before they become regulatory, financial or reputational liabilities. 

FCPA

FCPA Changes & Terrorist Designations for Cartels Create Dangerous New Math in Latin America

by Matteson Ellis, James Tillen and Maria Lapetina

March 19, 2025

As the Trump Administration takes aim at Latin American cartels with foreign terrorist organization designations, the legal landscape for businesses has dramatically shifted.

Read moreDetails

Why beneficial ownership matters more than ever

This case underscores why the beneficial ownership analysis is no longer a secondary step in Mexican due diligence. Screening a company’s registered name, listed directors or filing address may not reveal whether the same individual ultimately owns or controls multiple entities operating across different sectors or jurisdictions. 

Mexico provides a significant amount of publicly available corporate information, but accessing that information is not the same as retrieving a complete ownership structure from a centralized commercial database. Corporate records are maintained through the Public Registry of Commerce, whose offices operate locally across Mexico’s states and jurisdictions. The availability and format of historical filings can vary, and reconstructing ownership may require reviewing multiple corporate acts over time rather than relying on a single current record. Where shareholders, affiliates or related entities extend beyond Mexico, the analysis may also require consulting foreign corporate registries and tracing ownership across different disclosure regimes.

For companies conducting due diligence, the implication is significant: Identifying beneficial ownership is not simply a matter of confirming the names disclosed by a counterparty. It may require piecing together corporate records across jurisdictions, identifying common shareholders or controllers and assessing those relationships collectively. This type of analysis can reveal connections that conventional KYC screening may overlook and, in higher-risk environments, help companies understand not only who their immediate counterparty is, but the broader network behind it.

But a company’s name and ownership are a part of the picture. Even where beneficial ownership is fully mapped, a due diligence review can still miss a company that is operating outside the bounds of its own regulatory authorization, simply because that information sits in a different place entirely; not a corporate registry but a sector-specific regulator.

Every regulated industry in Mexico has its own authority, and its own disclosure requirements. For example, non-bank financial companies (SOFOMes) are supervised by the National Banking and Securities Commission (Comisión Nacional Bancaria de Valores or CNBV), and publicly listed companies are subject to disclosure requirements through both the CNBV and the Mexican Stock Exchange (Bolsa Mexicana de Valores or BMV). In each case of these industry examples, the relevant information exists and is often publicly accessible but only if the reviewer knows which regulator governs that specific industry.

Knowing where to look in a high-risk jurisdiction

The cases of the sanctioned individuals illustrate that due diligence can no longer be limited to confirming that a counterparty does not appear on a sanctions list. Regulatory information in Mexico is frequently fragmented across multiple government repositories and published in formats that are not easily searchable or structured for commercial databases. Therefore, identifying the relevant permits, registrations or enforcement actions often requires more than a simple database search. It requires an understanding of Mexico’s regulatory framework, familiarity with the authorities overseeing each industry and the ability to interpret the significance of the information in the context of a due diligence review.

Effective due diligence in high-risk jurisdictions like Mexico requires organizations to understand who ultimately owns a business, whether it operates within its regulatory authorizations and how it fits into a broader commercial network. As criminal organizations increasingly use legitimate business structures, this broader perspective helps organizations identify potential legal, financial and reputational risks before they become enforcement issues.

The post Standard Due Diligence May Not be Enough in Mexico appeared first on Corporate Compliance Insights.

Past experience with the cost and risks of technology modernization projects is driving boards and executives to be more selective about allocating capital and has increased the emphasis on the certainty of delivering tangible value. Protiviti’s Jim DeLoach offers 10 questions to guide these tough conversations.

Technology modernization is a topic that has found its way into every C-suite and boardroom. In recent years, significant investments have been made by companies recognizing a need to modernize to avoid losing market share to “born digital” entrants to the market. Banks and insurers, for example, were concerned that failure to modernize would result in loss of market share to fintechs — indeed, a competitive threat that framed a potential winner-take-all scenario.

More recently, however, the narrative has shifted, with less emphasis on hype and FOMO (fear of missing out). In financial services, the “winner takes all” view has softened as fintechs carved a role in the market that did not crowd out incumbents, largely because they did not want to be regulated. Their choice to coexist with incumbent financial institutions lessened the threat. More broadly, for companies across all sectors, the initial return on investment (ROI) associated with new technologies underdelivered, elevating healthy skepticism. And, most importantly, the cost of capital has gone up, raising the hurdle rate for all investments.  

Thus, CEOs, executive teams and boards are now faced with evaluating investments in transformation programs amid a new narrative. Proponents of technology modernization, digital transformation and strategic IT initiatives need to articulate a stronger, more compelling business case for delivering value with less risk. 

Of course, there are costs associated with failing to modernize. A global survey of more than 1,000 CIOs, CTOs, CISOs and other technology executives and leaders revealed that 70% of organizations view technical debt as a major drag on their ability to innovate. Over time, this leads to inability to execute strategy, increased operating costs, lost revenue, poor customer experience, inability to retain and attract top talent and the attendant effects of losing competitive advantage, market share and shareholder value. Thus, both sides of the coin are relevant.

10 important questions about technology investments

Accordingly, an evaluation of the organization’s framework for navigating technology investments relative to other business priorities is in order. What is needed is a framework that emphasizes maximizing value and minimizing financial risk. Nothing new about that, but leaders and directors may benefit from considering the following questions that underpin a practical framework that is fit for purpose in today’s investment climate:

1. Do we have a clear understanding of the lessons learned from our modernization investments over the past five years? 

Understand the extent to which promised returns were delivered and, most importantly, why or why not. What is working, what is not? Can we do better? Over and over, management must examine and adapt. Best practices and mistakes should be identified through a post-mortem and improvements made to the business case development process and project management approach.

2. Have we balanced our long- and short-term perspectives? 

The long-term narrative should define the direction of IT investments, address emerging technologies that could create a need for modularity and flexibility and envision what the enterprise is expected to look like in, say, five years. It provides a contextual framework for evaluating whether proposed modernization initiatives and technology partnerships are directionally compatible with the strategy and vision going forward. In the short term, management should articulate principles that enable business agility and continuous modernization, such as modular architecture for ease of updates, support for agile deployment, real-time and event-driven processes to enhance responsiveness, scalable and secure architecture, a unified data repository to establish a single version of the truth, a seamless customer experience-driven environment and compliance sensitivity.

3. Do we have the right partners? 

Senior leaders and directors should consider being more selective in evaluating whether the technology in question fits a use case for modernization and how that decision is supported. Most importantly, they should understand how and why a particular vendor is selected. For example, the company may have a single cloud provider or a hybrid environment. Many organizations have discovered — some the hard way — that choosing among cloud providers like Amazon Web Services, Microsoft Azure and Google Cloud Platform can be a complex task, as each offers unique advantages and has different approaches with respect to similar issues. Because they may or may not align with a company’s specific needs and strategic objectives, it is important to understand these differences and, importantly, what specific services the company needs. The key is to balance a vendor’s innovation path with the company’s overall strategy. If they are incompatible, a change in vendors is needed.

Featured

Bored Directors? How to Make Sure Board Materials Are Contributing Value

by Jim DeLoach

August 26, 2026

Read moreDetails

4. Do we have the right skills, and are we connecting with the business? 

Building capabilities without the skillsets needed to leverage modernization investments and maximize their value over time is a common issue. Internal resources are especially important when embracing a tailored approach for modernization. Global capability and delivery centers can be useful in deploying the organization’s entire technology talent pool so that there is cost-effective collaboration across geographies. Transforming the company to a product- or platform-centric organization can break down silos and facilitate resource mobility. Large-scale reskilling and training programs may be necessary. External resources can be hired to bring to bear specialized knowledge that address internal gaps. As for connecting with the business, one study noted that 74% of organizations that have started a legacy system modernization project failed to complete it and that one of the largest obstacles to a successful modernization project is a disconnect of priorities between technical and leadership teams. It is imperative that this issue be ironed out before commencing a tech modernization project.

5. Do we buy, build or deploy a hybrid approach? 

When it comes to modernizing infrastructure, the decision to buy or build is a critical one. Beyond the obvious factors like the organization’s specific needs, resources, skills and strategic objectives, other considerations include cost, extent of required customization, scalability of design, ongoing maintenance and support and speed to market. In addition, the decision isn’t always either/or. In many cases, a hybrid approach combining purchased and custom-built solutions offers the best balance of cost, flexibility and speed.

6. Can we break down massive investments into discrete components? 

Much less willing to cut the $100 million check, companies are leaning more into discrete investments to generate value from smaller increments of work. Breaking down complex projects into more manageable components within the context of the longer-term plan enables project teams to learn and fail fast, focus on the customer, build a superior user experience, invest for flexibility and speed, and think modular and agile. It also helps avoid wasted effort. For example, the physical hardware of the iPhone needed to exist before developers could create apps specifically designed to run on it. Accordingly, technology infrastructure investments must be appropriately sequenced.

7. Do we have the data we need to sustain a strong customer focus? 

Companies have learned that to put the customer first, they need real-time data. Without it, how can management know whether the customer experience is achieving the expected results? This is the hard part of fostering sustainable change and must be addressed to avoid making small adjustments in one part of the process that create undesirable impacts on the customer experience in other parts of the process.

8. Are we thinking creatively? 

Fostering internal competition among candidate projects encourages creativity and out-of-the-box thinking on framing how and why projects should be undertaken. Stepping out of the confines of the traditional sandbox in which technology executives play can make a difference. For example, some organizations may see the benefit of starting from a digital-first, clean slate to deploy new infrastructure based on modern technologies — separate and apart from the legacy environment — to support new products or markets. This strategy may entail establishing a new legal entity because the complexities of the legacy enterprise may make achieving the full architectural vision too difficult. Some companies that try to transform their legacy infrastructure are losing hundreds of millions of dollars. 

9. Have we raised the business-case bar to the right level? 

It’s not enough to pursue technology modernization based on the allure of new features and functionality. If decision-makers fail to see clear, measurable value from investments in new tech capabilities, they should select other opportunities that are more likely to deliver value for customers and shareholders. This makes it incumbent on the company’s technology modernization leaders not only to present to the board a compelling business case for a project but also to execute it with precision and a strong focus on delivering to expectations. Business-case development should begin with the premise that an organization (and its investors) can earn attractive rates with an inflation-adjusted bond with minimal risk, and the business case must present the rationale why the ROI expected from the proposed technology investment will exceed these minimal-risk returns. Thus, the business case supporting selected use cases must help answer the why, when and what questions:

• When is the right time to invest? Why do we need to make this investment now? Why not six months, 12 months, 18 months from now?
• What is the opportunity cost of moving forward at this moment?
• Is there an external event driving the proposal? Does it involve an innovation that presents an attractive market opportunity?
• What is the expected outcome and projected ROI, and how long will it take to realize the expected value?

10. Are we undertaking the best approach to modernize? 

Once the value proposition is defined and the business case approved, navigating the technology modernization journey requires a meticulously charted course that incorporates due diligence, discovery and the establishment of waypoints to ensure key milestones are achieved. The technology modernization process often involves adopting a standardized approach that addresses specific organizational needs while remaining flexible enough to integrate various solutions. The most common components of a standardized technology modernization process are upgrading to new versions or features of existing software, building new applications from scratch, acquiring new software and migrating data and processes and acquiring another company with a modernized application stack.

With the longer-term strategic narrative and ROI the primary focus for go-forward decisions on technology modernization projects, it is critical to focus on four interrelated drivers that can deliver the expected value — lowering costs, gaining more flexibility and power in deals with strategic vendors, overcoming the inability to build new functionality into current applications and meeting regulatory compliance requirements. These drivers are fundamental to defining and communicating a clear value proposition to executive management and the board.

A tough conversation

Technology modernization can present a tough strategic conversation in the C-suite and boardroom. The discussion boils down to the opportunity cost of allocating capital, a cost that is as high as it has been in 15 years. Consistent with their responsibility to company shareholders, senior management and directors should ensure that the organization defines the overall investment objectives clearly, specifies opportunities for improvement, identifies the right technologies and lines up the necessary resources to undertake the project successfully.

Most importantly, proposed investments in selected use cases presented to the executive team and board must be supported by a compelling business case demonstrating that value and ROI will be delivered, all within the context of a longer-term journey explained in plain English.

The post 10 Questions for Focusing Your Technology Modernization Investments appeared first on Corporate Compliance Insights.

New products & platforms

Dow Jones launched the WSJ Geopolitical Risk Council, an invitation-only executive community to support corporate decision-makers as they prepare for geopolitical risks.

Communications compliance platform Casepoint announced new agents for Casepoint IQ, including the Relevance Determination Agent and the Issue Coding Agent, the first of a set of forthcoming specialized AI agents for government, legal and compliance teams.

Sustainability intelligence platform Sweep unveiled an expansion of its agentic AI Sweepy, which allows it to run sustainability workflows across compliance, risk and performance reporting.

Cloud Range, a cyber readiness and validation system, launched AI Validation Range and Cloud Range AI Readiness Framework to put AI models and agents through SOC scenarios and cyberattacks in a contained environment before making them operational.

Infrastructure management provider meshIQ released AgentIQ, which can govern AI agents across enterprises and give visibility and control over agents as well as create audit records.

Bizora, a tax research platform, launched Audit Research, which answers questions across PCAOB, AICPA, GASB standards and the GAO Yellow Book with citations to source text.

AI insurance claims platform CLARA Analytics launched Agentic Intelligence for its CLARAty.ai system to examine insurance claim files and surface litigation risk and potential fraud.

Personnel

Ethyca, a runtime governance company, appointed Danny Weitzner, the Obama Administration’s deputy CTO for internet policy, as chief strategy officer.

Fintech and financial services consultant FS Vector named Mike Santoro to the newly created role of chief growth officer.

Partnerships & integrations

GRC software provider Onspring announced an integration with Trustero, an AI compliance platform, bringing autonomous AI for evidence management and control testing into the Onspring platform.

The post GRC Business Roundup: Dow Jones, Casepoint, Onspring, Ethyca, Sweep & More appeared first on Corporate Compliance Insights.

Just 1 in 10 UK organizations could meet proposed breach reporting standards

Only 10% of UK enterprises are confident they could meet cyber breach reporting deadlines proposed in a bill working its way through Parliament, according to a survey by VinciWorks.

The survey of 156 IT, compliance and security professionals found just one in 10 organizations were confident they could meet the Cyber Security and Resilience Bill’s 24-hour and 72-hour breach reporting deadlines, a duty that would fall on managed service providers and data centers.

The bill is in a House of Lords committee, and if it becomes law, in-scope organizations would be required to send an initial notification to their regulator within 24 hours of becoming aware of a reportable cyber incident followed by a full report in 72 hours.  

Most organizations surveyed believe they could meet the deadlines, but that confidence hasn’t been tested yet. Almost two-fifths (38%) of compliance and security professionals said they would meet the 24-hour and 72-hour deadlines in theory, but had never actually tested the process. Just over a quarter (26%) said they weren’t sure if they could meet those reporting requirements, while 17% said they were working toward it. About 9% admitted they could not currently meet the deadlines.

“Cyber incidents rarely happen in office hours, on a good day, with everyone available,” Nick Henderson-Mayo, head of compliance at VinciWorks, said in a statement. “An escalation process that has never been tested under real pressure is only a guess about what will happen when an incident actually strikes.”

The survey also found that 68% of organizations said they were fairly to very concerned about cyber attacks disrupting business, and 51% reported staff must complete cybersecurity training once a year.

Vast majority of companies don’t assess all third parties

Nearly nine in 10 companies don’t look into every third party they work with in a time when not doing such examinations is the most perilous, according to a survey by security software provider Drata. 

In a survey of 309 IT and security leaders and practitioners in the US, UK and Canada, 87% reported that they don’t assess all third parties, and staffing and tools play a big role.

More than three-quarters (78%) reported they have limited capacity to complete thorough assessments on all third parties. About half (49%) rated their ability to cover all third parties as less than good. That limited capacity comes as 85% reported that their companies experienced at least one third-party incident in the past 12 months, and 75% said their concern about third-party risks has increased over the past two years.

A large proportion of the third-party assessment issues for companies is a lack of people, with 59% citing insufficient staff as the greatest obstacle to effective third-party risk management (TPRM). The survey also revealed a contradiction. More than two-thirds (69%) expanded their third-party risk management teams but are still having trouble keeping up, while only 11% said they plan to add to their headcount in the next year, despite insufficient staffing ranking as the most significant barrier to examining risk with third parties.

Evidence highlights that more people and assessments help companies manage third-party risks. Of the companies that experienced six or more third-party incidents, 90% agreed that people or tool limits are constraining their assessments, compared to 60% that had no third-party incidents.

The post Only 10% of Companies Could Live up to UK Bill’s Hack Reporting Rules appeared first on Corporate Compliance Insights.

The EU’s new anti-greenwashing rules turn sustainability claims into a matter of legal exposure, governance and corporate reputation. Compliance leaders should ensure that environment-related communications can be substantiated before they reach the market, writes Andreas Pyrcek of EY Germany.

For years, the European sustainability debate has centered primarily on reporting. Companies have focused on what they must disclose, which data they must collect and how evolving requirements may affect their ESG reporting obligations. The EU’s Empowering Consumers for the Green Transition Directive, commonly referred to as EmpCo or sometimes ECGT, takes a different approach. Rather than determining what companies must report, it regulates what businesses may say to consumers about the environmental and social characteristics of their products, services and operations.

EmpCo amends the EU Unfair Commercial Practices Directive and the Consumer Rights Directive. Its provisions are intended to address misleading environmental claims, unreliable sustainability labels and other practices that may prevent consumers from making informed purchasing decisions. EU member states were required to transpose the directive by March 27, 2026, and must apply their national implementing rules from Sept. 27, 2026.

This makes EmpCo a landmark in European sustainability regulation, introduces explicit anti-greenwashing rules into EU consumer law and identifies specific sustainability practices that may either be prohibited outright or assessed as misleading based on their context. 

Greenwashing has become more than a reputational concern; it is now a defined legal and compliance risk in the European Union.

What the new rules require

EmpCo does not impose one general obligation to obtain advance approval for every environmental statement. Instead, it combines specific prohibitions with broader rules governing misleading commercial practices.

Some practices will be added to the EU’s “blacklist” of commercial practices considered unfair in all circumstances. Other claims will be assessed case-by-case, including whether they contain false information, deceive the average consumer or materially influence a purchasing decision.

One of the most significant changes concerns generic environmental claims. Broad expressions like “environmentally friendly,” “eco-friendly,” “green,” “climate-friendly,” “sustainable” or “responsible” may no longer be used merely because a company can point to some positive environmental activity. A generic environmental claim must be supported by recognized excellent environmental performance that is relevant to the claim. Alternatively, the company must clearly and prominently specify the claim on the same medium, such as the packaging, advertisement or online sales interface.

This distinction is important. A statement like “climate-friendly packaging” may be regarded as a generic environmental claim. A more specific statement explaining that all energy used to produce the packaging comes from renewable sources may fall outside that particular prohibition, although it must still be accurate and must comply with the general rules against misleading practices.

EmpCo also prohibits companies from presenting an environmental benefit relating to only one aspect of a product as though it applied to the entire product or business. A company should not, for example, create the impression that a whole product consists of recycled material if only its packaging does. Similarly, an isolated sustainability initiative cannot be used to imply that the company’s overall operations meet the same environmental standard.

Further, under the directive, companies may not claim that a product has a neutral, reduced or positive impact on the environment in terms of greenhouse-gas emissions when that claim is based on offsetting. The EU legislature considers such statements misleading because they can create the impression that the product itself, or its production and supply, does not have an adverse climate impact.

Companies may continue to communicate investments in environmental initiatives or carbon-credit projects, provided that the information is presented in a way that is not misleading. The critical requirement is that those investments must not be used to make a prohibited product-level neutrality claim.

And where companies compare products based on environmental or social characteristics, durability, repairability or recyclability, consumers must be given information about the comparison method, the products and suppliers included and the measures used to keep the comparison current.

The objective is to ensure that comparisons are based on products serving the same function, use a common methodology and address material and verifiable characteristics.

This means that claims like “greener,” “more sustainable” or “better for the environment” require more than an internal assessment. Companies must understand what is being compared, whether the methodology is consistent and whether the comparison remains accurate over time.

These requirements are all meaningful for compliance teams. A statement does not need to be entirely false to create legal risk. A factually correct statement may still be misleading if its presentation, scope or context creates an inaccurate overall impression. And the rules around climate neutrality create a significant review obligation for businesses that have integrated neutrality language into packaging, product descriptions, websites or advertising campaigns. Compliance teams will need to distinguish carefully between communications about corporate climate initiatives and claims about the environmental impact of a specific product.

Governance

The Greenwashing Reckoning Isn’t About Marketing

by Sandhya Sabapathy

August 24, 2026

A bold public target and a cautious financial model can contradict each other inside the same annual report

Read moreDetails

Future promises & sustainability labeling

EmpCo also addresses forward-looking claims, including commitments to achieve climate neutrality, net zero or another environmental objective by a future date.

Such claims may be considered misleading if they are not supported by clear, objective, publicly available and verifiable commitments and targets. A company must have a detailed and realistic implementation plan showing how the targets will be achieved, including the allocation of resources. Progress must also be verified regularly by an independent third-party expert whose findings are made available to consumers.

This requirement has implications well beyond marketing. An environmental promise may depend on investment decisions, technological developments, operational transformation and emissions reductions across several business units. Examine not only the wording of the claim but also whether the organization has a sufficiently credible plan, ownership structure, resources and monitoring process to support it. A corporate ambition should not be presented to the market as an achievable commitment if the underlying organization has not established a realistic route to delivery.

EmpCo also tightens the rules governing sustainability labels. Companies will generally be prohibited from displaying a sustainability label unless it is based on a certification scheme or has been established by a public authority.

A qualifying certification scheme must satisfy minimum standards of transparency and credibility. This includes objective monitoring by a competent third party that is independent of both the scheme owner and the company using the label. The relevant conditions of the scheme must also be publicly available.

This provision is particularly relevant to proprietary green labels and self-created environmental symbols. A company cannot establish its own sustainability mark and use it to imply independent environmental quality if the mark is not supported by a qualifying certification framework.

Review not only the wording of written sustainability claims but also seals, icons, logos, color schemes and other visual devices that may communicate an environmental message.

Legal consequences extend beyond regulatory fines

The consequences of noncompliance arise through the consumer-protection and unfair-commercial-practices regimes into which EmpCo is integrated. The precise procedures and sanctions depend on national implementing law, but companies can face orders to stop using a claim, removal or amendment of advertisements and packaging, claims brought by competitors or consumer organizations, consumer redress and financial penalties.

For widespread infringements with an EU cross-border dimension, the existing European consumer-law enforcement framework requires member states to provide for maximum fines of at least 4% of the trader’s annual turnover in the member states concerned. Where turnover information is unavailable, national law must provide for a maximum fine of at least €2 million. The application of sanctions in an individual case remains subject to the relevant national implementation and enforcement process.

The economic exposure may extend well beyond a fine. A prohibited claim may require a company to stop a campaign, revise websites and sales materials, change product packaging or defend litigation across several jurisdictions. Misleading claims may also create disputes with customers and business partners and increase scrutiny of related sustainability disclosures.

Reputational consequences can be even more severe. Greenwashing allegations directly challenge the credibility of the organization. If a company cannot support a public sustainability promise, stakeholders may question not only the claim itself but also the reliability of management, the effectiveness of internal controls and the integrity of the broader sustainability strategy.

Why EmpCo belongs on the compliance agenda

Sustainability communications are often developed across marketing, corporate affairs, product management, legal and sustainability teams. Without a common governance framework, no single function may have a complete view of the claims being made, the evidence supporting them or the assumptions on which they depend.

That is where compliance can add value.

Compliance does not need to become the technical owner of every environmental data point. It should, however, help establish the governance through which claims are identified, risk-assessed, substantiated, approved and monitored. The relevant control framework should cover statements on packaging, websites, advertising, social media, investor-facing materials and other consumer communications.

Before publication, the organization should be able to demonstrate what evidence supports a claim, whether the wording accurately reflects the scope of that evidence, who has approved it and how changes in data or business performance will be monitored. Higher-risk claims, particularly climate-neutrality statements, future targets, generic environmental language and comparative claims, should receive enhanced scrutiny.

This is not merely a documentation exercise. It is a question of whether the company can defend the claim if it is challenged by a regulator, consumer organization, competitor or court.

EmpCo marks an important development for compliance and ethics leaders. It brings sustainability communication firmly into the legal accountability framework. Environmental claims can no longer be treated as aspirational messaging that sits outside the company’s compliance management system.

The central question is no longer simply whether a sustainability statement is attractive or broadly consistent with corporate ambitions. The question is whether it is legally permissible, factually supportable and capable of withstanding external scrutiny.

The post With New EU EmpCo Rules, Greenwashing Moves From Reputation Risk to Compliance Risk appeared first on Corporate Compliance Insights.