Part 1 of this series laid out why the risk landscape around generative AI, confidentiality exposure, hallucination risk, and vendor risk, makes a written AI Acceptable Use Policy an urgent priority rather than a nice-to-have. In Part 2, I want to walk through what actually needs to be in that policy for it to function as a real governance tool rather than a document nobody...

Reuters reported this week that the Federal Trade Commission has opened an antitrust investigation into Epic Systems, the dominant electronic health records vendor based in Verona, Wisconsin. The report, citing two sources familiar with the matter, says the FTC has already sent investigative demands to other companies in the health technology industry, seeking information about how Epic controls access to patient data. The agency has...

The Bureau of Industry and Security’s Fiscal Year 2025 Annual Report to Congress is not a routine bureaucratic filing. It reads more like a mission statement, and the numbers inside it back up the rhetoric. Export control enforcement has escalated dramatically over the past year, and companies operating in semiconductors, aerospace, defense, dual-use technology, and cross-border trade more broadly need to understand exactly how much...

The State Department’s Directorate of Defense Trade Controls just handed down a $36 million penalty against BAE Systems, Inc., resolving more than 100 alleged violations of the International Traffic in Arms Regulations and the Arms Export Control Act stretching from 2019 through as recently as March 2025. This is Part 1 of a two-part series on the case. Here, we walk through the settlement structure...

OFAC’s settlement with Rice Lake Weighing Systems is a small-dollar case, just $60,764, but it is an unusually instructive one, because it captures almost every classic failure mode in how U.S. companies manage sanctions compliance at their foreign subsidiaries: a license that got revoked, an instruction that didn’t translate into real understanding, and a subsidiary that kept dealing with a sanctioned country indirectly after being...

The Justice Department rarely hands compliance officers a document that spells out its enforcement priorities this directly, but that’s essentially what Assistant Attorney General Colin McDonald did this week in a memo to staff of the newly formed National Fraud Enforcement Division. The memo is worth reading in full, because it functions less like an internal org chart announcement and more like a public roadmap...

Veloxis Pharmaceuticals, the maker of the kidney transplant immunosuppression drug Envarsus XR, has agreed to pay more than $46 million and submit to years of enhanced compliance oversight to resolve civil and criminal allegations that the company ran a sustained kickback scheme to drive prescriptions of its drug. This case is worth a close read for compliance officers well beyond the pharmaceutical industry, because it’s...

The Treasury Department rolled out a significant escalation of its Iran sanctions program on August 24, and this one is worth immediate attention from any organization with even indirect exposure to Iran-related activity, because it combines two things that don’t usually arrive together: a large batch of new designations and a suspension of general licenses that companies may have been relying on for years to...

BIS just settled with Container Manufacturing, an Ohio-based maker of tops for aluminum beverage cans, for $1 million over ten violations of U.S. export controls tied to Russia. On the surface, this looks like a modest regional manufacturer case involving unglamorous industrial spare parts. Underneath, it’s one of the clearest illustrations I’ve seen this year of a principle every compliance officer needs to internalize: a...

The Commerce Department’s Bureau of Industry and Security announced a settlement with Plexon Inc., a Dallas-based neuroscience company, over eight unlicensed exports of brain-computer interface equipment to a Chinese research institute with direct ties to the People’s Liberation Army. This case deserves attention well beyond the neuroscience and export control communities, because it illustrates exactly how emerging technology controls are catching companies that may not...