Key Takeaway: AI for compliance monitoring is like placing a magnifying glass in the hands of compliance. It enables teams to detect and prevent risk with a high degree of certainty as close to real time as possible while meeting regulatory expectations. In essence, teams quickly identify the proverbial “needle in the haystack.”

With the stakes as high as ever for companies’ compliance function, compliance organizations need to begin to leverage the capabilities of AI for an entirely new approach to preventing and detecting risk, far beyond what is achievable with traditional monitoring using eDiscovery tools.

The US Department of Justice and state attorneys general ramping up price-fixing scrutiny of an array of industries (from gasoline supplies to egg producers, fertilizer makers, and many more) contributes to this sense of urgency. Regulators, both in the US and beyond, increasingly expect companies to institute risk-based, data-driven compliance programs that are capable of detecting misconduct before it becomes a significant problem.

AI for monitoring enables a resource-stretched compliance team to deliver insights in as close to real time as possible and with greater certainty. Matches allow organizations to coach employees regarding expectations or to create an escalation for further investigation. Teams also integrate anonymized findings into training and communications. This raises the relatability factor that compliance teams strive to deliver. 

Risk assessments are beneficiaries as well. They add data-driven evidence to traditional questionnaire and interview responses, bolstering reliability. Additionally, the results unlock a new dataset for stakeholder reporting, providing evidence that the compliance program is fulfilling its remit.

The Evolution of Regulatory Expectations

As of recent, regulators worldwide are adopting the view that compliance programs must shift from a one-size-fits-all, “check-the-box” approach to one that tailors to risk, is data-driven, and focuses on spotting concerns before they become causes for concern. For example, the US Department of Justice's Evaluation of Corporate Compliance Programs (ECCP) most recent update repeatedly emphasizes the importance of continuous improvement and access to data, testing, and monitoring. Prosecutors must evaluate whether compliance personnel have sufficient access to relevant data and whether organizations use that data to identify and mitigate risk.

Importantly, regulators rarely prescribe specific technology. Instead, they focus on outcomes:

• Can the company identify misconduct?
• Can it detect violations early?
• Can it adapt to emerging risks?
• Can it demonstrate that its monitoring efforts are effective?

Many organizations currently rely on periodic, keyword-based reviews to meet these standards. That approach may satisfy baseline expectations. But as newer technology, particularly AI, advances rapidly, reactive reviews of electronic communications will increasingly fall short of what newer technology can achieve.

The Inherent Limitations of eDiscovery Monitoring for Compliance

As its name indicates, the design center of eDiscovery technology isn't a comprehensive communications monitoring solution. However, it proves adaptable to that role through the compliance process of identifying a population of higher risk employees based on role, geography, job level, business unit, or prior concerns. It collects communications from a sample of those employees and conducts keyword and time-intensive human review for signs of misconduct where the majority of matches are false positives. 

The features and speed of eDiscovery tools make it vastly superior to the incumbent labor-intensive, manual processes in uncovering inappropriate communications, policy violations and antitrust concerns, including conflicts of interest, and other forms of misconduct. As technology advances, AI delivers unparalleled precision and accuracy.




The differences between AI and traditional eDiscovery workflows come into sharper focus with a real-world example. In this case, one company evaluates their communications to identify specific high-risk behaviors over a six-month period.

Move From Monitoring Events to Monitoring Risk

AI facilitates a powerful paradigm shift that is perhaps the most significant difference between eDiscovery and AI monitoring. That distinction aligns closely with the direction regulators have been moving in for years. As noted at the outset, the DOJ increasingly emphasizes leveraging data, technology, and analytics to proactively identify risk and continuously improve compliance program effectiveness. With AI, the most effective compliance programs are not simply investigating misconduct more efficiently. Rather, they are identifying risk earlier, intervening faster, and preventing violations from occurring in the first place. These capabilities are making AI compliance monitoring the new standard against which compliance programs will be measured.

That said, compliance leaders should not view this as a choice between eDiscovery and AI; both have essential roles. The question is where each tool belongs. The value of eDiscovery for organizations remains, whether conducting investigations or responding to regulators. It provides teams the ability to understand what has happened. AI is indispensable in eliminating misconduct by enabling organizations to understand what is happening.

Meeting the New Compliance Standard Requires AI

Evolving regulator expectations, increasing data volumes, and technological advances mean that relying solely on periodic reviews of sampled data is increasingly difficult to defend as a leading practice. This is especially apparent as organizations continuously analyze communications, transactions, and third-party activity in real time. 

Moreover, while organizations that continue to rely exclusively on periodic document reviews may technically satisfy a monitoring requirement, they risk missing opportunities to prevent violations altogether. Compliance AI is not just becoming a must-have to root out possible malfeasance and mitigate the fallout from government scrutiny. The risks of not using it also make adopting compliance AI an operational necessity.

Learn more about Epiq Compliance Advisory and Technology.


Jerry Kral, Compliance Advisory Leader
At Epiq, Jerry Kral leads the Compliance Advisory and Technology Practice, based out of the Epiq Chicago office.

For over 25 years, Jerry has served as a trusted advisor to General Counsel and Chief Compliance Officers, helping establish, enhance, and optimize risk-based compliance programs and infrastructure.
 

Erin Toomey, Vice President and Leader, Antitrust and Global Investigations Practice Group
Erin has over 17 years of experience in eDiscovery, with specific expertise in antitrust and global investigations. She has advised and partnered with antitrust and global investigation clients in negotiations directly with the DOJ and FTC related to productions standards, provisions for TAR compliance, foreign language translation, and timing agreements. During her career, Erin has managed client services and delivery for complex eDiscovery matters, including strategy advisory for document collection and processing, TAR, complex multi-tiered review workflows, and productions.