How to Align an AI Governance Program with Both DOJ and SEC Expectations

Overview

Commission examine corporate AI practices for different reasons. DOJ looks for governance that prevents deliberate or reckless misuse of AI that could lead to criminal liability. The SEC scrutinizes whether public statements about AI are accurate and not misleading to investors. These are related but distinct inquiries. A governance framework that is explicit about AI risks, controls, human oversight, accountability, and training can serve both enforcement concerns.

What DOJ looks for

Under the DOJ's Evaluation of Corporate Compliance Programs (ECCP), prosecutors will test whether a company has processes to assess risks introduced by AI and controls to prevent illegal misuse. The ECCP frames concrete questions that a company should be able to answer, including:

• How the company assesses the potential impact of new technologies such as AI on its ability to comply with criminal laws.
• Whether management of AI risks is integrated into enterprise risk management (ERM).
• The company's governance approach for AI in commercial business and in the compliance program.
• How the company curbs negative or unintended consequences and mitigates deliberate or reckless misuse, including by insiders.
• Whether controls exist to ensure AI is used only for intended purposes and that the technology is trustworthy and reliable.
• The baseline of human decision-making used to assess AI, and how accountability over AI use is monitored and enforced.
• How employees are trained on the use of emerging technologies such as AI.

Companies that use AI in business or compliance should be prepared to answer these questions fully and specifically when prosecutors evaluate their program.

What the SEC focuses on

The SEC's priority is investor protection and truthful disclosure. The SEC's Division of Examinations included "AI washing" among its examination priorities for fiscal 2026. AI washing covers material misstatements or exaggerations about AI capabilities. This includes outright false claims about using AI and overstating the level of automation where human operators play a substantial role.

SEC Chairman Paul Atkins emphasized the agency's continued enforcement against false, misleading, or exaggerated AI claims at a March 2026 FSOC roundtable. The SEC's enforcement posture concentrates on fraudulent conduct that could harm investors.

Practical alignment points for a single program

Although DOJ and SEC inquiries differ, they overlap on a few practical points a governance program can address:

• Risk assessment and ERM: Document how AI risks are identified, evaluated for legal and compliance impact, and integrated into enterprise risk processes.
• Controls and intended use: Maintain technical and process controls that limit AI to intended purposes and monitor for misuse.
• Human decision-making baseline: Define and document the threshold for human involvement in processes described publicly as automated.
• Accountability and monitoring: Assign oversight roles, enforce policies, and log governance activities to demonstrate active management.
• Training: Provide role-specific training on lawful and compliant use of AI tools.
• Disclosure discipline: Ensure public statements about AI accurately describe capabilities, limitations, and the role of humans to reduce risk of AI washing.

Bottom line

DOJ's ECCP and the SEC's focus on AI washing are distinct but reconcilable. A governance program that documents risk assessment, control measures, human oversight, accountability, training, and truthful disclosure can respond to both agencies' priorities and reduce legal and investor-relations risk.