Understanding the Disconnect
Many compliance teams have turned to AI tools for gap analysis and policy automation to meet new regulations, such as the EU Anticorruption Directive. This directive sets minimum penalties for corporations, including fines of at least 3% of global revenue or €24 million, with higher penalties for severe offenses. While AI tools effectively identify policy gaps and flag risks, they can't prevent violations alone. Investigations still uncover issues like undocumented payments and undisclosed conflicts of interest. The problem? Technology spots the gaps, but humans need to close them.
The Ongoing Challenge
This isn't a one-time incident but a recurring issue that unfolds in phases:
Phase 1: Regulation Announcement
Compliance teams learn about new requirements, such as the EU Anticorruption Directive's standards and whistleblower protections.
Phase 2: Technology Deployment
AI tools conduct gap analysis, suggest policy updates, and flag high-risk third parties.
Phase 3: Paper Compliance Achieved
Policies go live, and training modules are translated. Documentation appears solid.
Phase 4: Operational Reality
Employees continue risky practices, and conflicts go unreported due to a lack of trust and understanding.
Phase 5: Violation Surfaces
An investigation or whistleblower report reveals the gap between documented controls and actual behavior.
Identifying the Real Issues
The controls themselves didn't fail; the implementation did.
Third-party Risk Management Redesign: AI identified risky intermediaries, but the payment approval process wasn't redesigned to fit actual workflows, leading employees to bypass it.
Conflict of Interest Disclosure: While analytics tools can route conflicts for review, employees won't disclose issues if they don't trust the system or understand its importance.
Training and Messaging: AI translated policies, but employees need to understand why exceeding minimum standards is crucial.
Culture Shift: The failure becomes evident when management and employees lack a clear explanation of why higher conduct standards are necessary. AI can't deliver this message; only a compliance officer can.
Meeting Standards Effectively
The EU Anticorruption Directive allows credit for an effective compliance program. "Effective" means more than just documented policies. Standards like ISO 37301 and ISO 37001 require:
- Operational Integration: Controls must fit into existing workflows.
- Competence and Awareness: Employees must understand both the "what" and the "why".
- Culture and Leadership: Management must show commitment through actions.
- Continuous Improvement: Programs must adapt based on real-world outcomes.
The Federal Sentencing Guidelines for Organizations also emphasize communication, monitoring, and enforcement. These elements need human judgment to align with your organization's unique dynamics.
Action Steps for Your Team
1. Let AI Handle Documentation; You Handle Adoption
Use AI for analysis and translation, but focus on engaging with managers and operations teams to ensure processes fit their workflows and explaining the cultural importance to leadership.
2. Test Controls with Real Employees
After AI suggests a process, walk through it with employees. Ask them where it might fail and redesign based on their feedback.
3. Build Trust Before Building Disclosure Systems
If disclosure rates are low, assess how you've demonstrated that the process is safe and fair. Trust is built through consistent, fair outcomes.
4. Articulate the "Why" in Plain Language
Explain to employees why your organization adopts certain standards. Discuss the impact of corruption on customers, reputation, and communities.
5. Measure Behavior Change, Not Policy Completion
Focus on metrics like the decrease in undocumented payments and increase in conflict disclosures, rather than just policy updates.
6. Reserve Your Credibility for Hard Conversations
AI can't convince skeptical leaders or negotiate with unions. Save your influence for these crucial discussions.
The EU Anticorruption Directive is here, and AI can help you respond quickly. But only you can ensure that your compliance efforts are effective and lasting.
