The Department of Justice (DOJ) recently updated the Evaluation of Corporate Compliance Programs (ECCP) to direct prosecutors who are considering charges or resolutions to assess how a company addresses, among other topics, disruptive technologies and AI, self-disclosure initiatives, and the compliance function's access to corporate data. This enhanced guidance follows a pattern for ECCP amendments and reveals a trend toward an expectation of more proactive compliance efforts as a predicate for credit from prosecutors. Compliance stakeholders, therefore, can use this update as a blueprint for high-value program enhancements.

Since 2017, the ECCP has been prosecutors' formal tool to judge compliance program adequacy. Largely presented as questions rather than prescriptions, the original ECCP provided "some important topics and sample questions that the [DOJ] … has frequently found relevant in evaluating a corporate compliance program." In 2019, the DOJ reorganized the ECCP into three topics—program design, implementation, and efficacy—and better aligned the questions with policies and priorities. In 2020, the DOJ substantively expanded the ECCP to address the compliance function's data use, role in M&A, and resourcing. In March 2023, the DOJ made two significant changes to address the data preservation and corporate compensation programs.