This is Part 1 of a 3-part series on internal investigations in the age of AI. Join Michael for a webinar on September 8, 2026 on this topic — Register HERE.

Every compliance professional knows the drill — the Justice Department speaks, and compliance programs adjust. When DOJ updated its Evaluation of Corporate Compliance Programs (ECCP) to address artificial intelligence and emerging technologies, most companies focused on the obvious question: how do we govern AI in our business operations? Fair enough. But there is a second question buried in the guidance that too many companies are ignoring — what does DOJ expect from your internal investigation function in an AI-driven world?

The answer, as it turns out, is quite a lot. And companies that treat AI as someone else’s problem — an IT issue, a product issue, anything but a compliance issue — are setting themselves up for a painful conversation with prosecutors.

DOJ’s Two-Sided Test

The ECCP now directs prosecutors to examine AI from two directions. First, prosecutors will ask how a company assesses the potential impact of AI on its ability to comply with criminal laws, whether the company has conducted a risk assessment of the technologies it uses, and what controls exist to prevent “deliberate or reckless misuse.” Second — and this is the piece that reaches directly into the investigation function — prosecutors will examine whether the compliance function has adequate access to data, analytics tools, and resources to do its job effectively.

Read those two requirements together and the message is unmistakable. A company that ignores AI tools in its investigation function risks falling behind DOJ’s data analytics expectations. A company that adopts AI carelessly — without governance, validation, and human oversight — creates a new category of misconduct risk. You are exposed if you don’t, and exposed if you do it badly. The only safe path runs through deliberate, documented governance.

What Prosecutors Will Ask After the Next Incident

Imagine the post-resolution presentation to DOJ. Prosecutors reviewing your investigation of the underlying misconduct will want to know: Did you use AI tools in the investigation? Were those tools validated? Who reviewed the AI’s output before decisions were made? Was the technology monitored to confirm it functioned as intended and consistent with your code of conduct? If your investigators used a generative AI tool to summarize witness interviews or review documents, can you demonstrate that a human checked the work?

Companies that cannot answer these questions will find their investigation results — and their remediation credit — under attack. DOJ has made clear that it expects companies to monitor and test technology, maintain a baseline of human decision-making, and document risk mitigation efforts. An investigation record built on unvalidated AI output is an invitation to second-guessing.

The Resource Question Cuts Deep

The ECCP’s data-access requirements deserve special attention. Prosecutors will compare the resources and technology available to compliance against what the business side enjoys. If your sales team runs sophisticated AI analytics while your investigators work with keyword searches and spreadsheets, that disparity tells DOJ a story about your company’s priorities — and it is not a flattering one.

Compliance Action Items

– Conduct a documented AI risk assessment covering both business use of AI and the investigation function’s use of AI tools.

– Update your investigation protocol to address when AI tools may be used, what approval is required, and what human review is mandatory.

– Inventory the data analytics resources available to compliance and benchmark them against resources available to commercial functions.

– Establish testing and validation procedures for any AI tool used in investigations, and document the results.

– Train investigators on AI capabilities, limitations, and the governance requirements that apply to their work.

The companies that get this right will not just survive DOJ scrutiny — they will run faster, better investigations. In Part 2 of this series, we examine the practical failure modes when AI meets internal investigations, and how to avoid them.