This is Part 3 of a 3-part series on internal investigations in the age of AI. Join Michael for a webinar on September 8, 2026 on this topic — Register HERE.

Most of the conversation about AI and internal investigations focuses on AI as a tool — how investigators can use it, and how to manage the risks when they do. But there is a second wave coming, and it is already breaking on the shores of corporate compliance departments: investigations where AI is not the tool but the subject. Employee misuse of AI, AI-fabricated evidence, and whistleblower complaints about AI systems represent a new category of investigation that most companies are unprepared to handle.

Employee AI Misconduct Is Here

The scenarios are no longer hypothetical. An employee uploads confidential customer data or trade secrets to a public AI chatbot. A manager uses generative AI to fabricate supporting documentation for expense reports or regulatory submissions. A salesperson deploys AI to generate misleading marketing claims. An analyst passes off unverified AI output as original diligence work. Each scenario triggers investigation obligations — and each requires investigators to understand the technology well enough to reconstruct what happened. DOJ’s compliance guidance specifically flags the risk of AI generating false approvals and false documentation, and asks what controls companies maintain to detect and prevent exactly this conduct. If your hotline intake categories, investigation protocols, and investigator training haven’t been updated to address AI misuse, you are behind.

The Deepfake Problem Comes to the Investigation File

Investigators have always relied on documents, recordings, and communications as reliable evidence. That reliability assumption is now dead. AI can generate convincing fake emails, fabricated text message threads, synthetic voice recordings, and manipulated video. Consider the implications: a whistleblower submits an audio recording of a manager making incriminating statements — is it real? An accused employee claims the damning email chain was fabricated by a rival — can you prove otherwise? Investigation protocols must now include authentication procedures for digital evidence, chain-of-custody discipline, and access to forensic resources capable of detecting synthetic media. The investigator who accepts digital evidence at face value in 2026 is committing malpractice.

AI Whistleblowers Are a Growing Category

Employees who raise concerns about AI systems — biased algorithms, safety shortcuts, misrepresented AI capabilities in investor materials, AI-driven regulatory violations — are an emerging and legally protected class of whistleblowers. These complaints can implicate securities law exposure, internal controls issues, and retaliation risks under SOX and Dodd-Frank. And they present a distinctive investigation challenge: the subject matter is technical, the evidence lives in model documentation and system logs, and the relevant witnesses may be data scientists who speak a different professional language than your investigators. Companies need investigation teams that can bridge that gap — or protocols for bringing in expertise that can.

Compliance Action Items

– Update hotline intake categories and case management systems to capture AI-related complaints as a distinct category.

– Develop investigation protocols for employee AI misuse, including preservation of prompts, outputs, and system access logs.

– Establish digital evidence authentication procedures, including forensic resources for detecting deepfakes and synthetic media.

– Extend whistleblower protection and anti-retaliation policies explicitly to AI-related concerns, and train managers accordingly.

– Build technical fluency into the investigation function — through training, dedicated resources, or standing arrangements with outside experts.

The companies that treat AI-related misconduct as a passing novelty will learn otherwise the hard way. The full framework — DOJ expectations, AI tools and their failure modes, and AI as investigation subject — comes together in our upcoming webinar, “Internal Investigations in the Age of AI.” Registration details coming soon.