In this episode of Corruption, Crime and Compliance, Michael Volkov breaks down why the EU AI Act has moved from a future planning exercise to an actively enforced regulatory regime, with the European Commission’s AI Office holding full investigative and fining authority since August 2026, having already opened its first formal investigations in June 2026 into hiring tools, credit scoring systems, and student monitoring applications. He walks through the Act’s fragmented compliance timeline, prohibited practices enforceable since February 2025, general-purpose AI obligations running since August 2025, and live chatbot transparency requirements, alongside the significant deadline relief the Digital Omnibus gave specifically to high-risk AI systems, pushed to December 2027. The episode closes with a clear warning: companies that read the Digital Omnibus as a blanket delay of the entire AI Act are making a costly mistake, since the tracks carrying real, current enforcement exposure, including fines up to 7 percent of global turnover, remain fully active today.

September 30, 2026, 12 Noon EST

Sign Up HERE

___________________________________________________________________________

Building an Effective Ethics and Compliance Program in the Age of AI

October 14, 2026, 12 Noon EST

Sign Up HERE

____________________________________________________________________________

Part 1 of this series looked at what the Teligent and Regions Financial cases teach about escalation and response under Delaware’s Caremark doctrine. In Part 2, we turn to the most significant recent Caremark development, the 2026 Boeing dismissal, and what the emerging doctrine means in practice for compliance officers building or defending an oversight program.

Boeing 2026: The Counterweight to Caremark’s Expansion

The most significant recent Caremark development arrived in August 2026, in a new round of Boeing litigation. This case arose from the January 2024 Alaska Airlines 737 MAX 9 incident, in which a door plug separated from the aircraft mid-flight. Stockholder plaintiffs alleged that Boeing’s directors and officers ignored numerous red flags involving manufacturing quality and airplane safety while pursuing production targets inconsistent with adequate safety and regulatory compliance. Given Boeing’s well-documented history with Caremark litigation following the earlier 737 MAX crashes, this looked, at least on its face, like a compelling case.

The Court of Chancery dismissed it anyway. The reasoning is the single most important part of this decision for anyone tracking Caremark doctrine: the question Caremark asks is whether fiduciaries consciously disregarded their oversight responsibilities, not whether their oversight efforts actually succeeded in preventing harm. The record showed extensive board and committee involvement in safety and quality issues, dedicated committees with responsibility for the relevant compliance risks, regular reporting to the board and its committees on safety, manufacturing, and quality, repeated director-level discussion of these issues, and ongoing management reporting on remediation efforts. Given that record, the court concluded the allegations simply didn’t support a reasonable inference of bad faith.

That’s a genuinely important distinction to sit with. A board can make mistakes. Remediation efforts can turn out to be inadequate. Compliance systems can fail to prevent serious misconduct, and serious regulatory violations can still happen. None of that, standing alone, establishes Caremark liability. The doctrine requires something more specific: an intentional dereliction of duty or a conscious disregard of known responsibilities. The 2026 Boeing decision functions as a real counterweight to the doctrine’s expansion over the past several years, and it’s a decision every board and compliance function should understand in detail.

If Everything Is a Red Flag, Nothing Is

Boeing also teaches a related and increasingly important lesson: there’s a growing tendency in Caremark litigation to characterize every negative piece of information a board receives as a red flag, and that approach threatens to collapse the distinction between oversight and day-to-day management entirely. Boards routinely receive information about operational problems, compliance weaknesses, audit findings, employee complaints, regulatory inquiries, and emerging risks as a matter of course, and the mere existence of that information often demonstrates that the reporting system is actually working as designed, not that it’s failing.

The Caremark question is more demanding than simply asking whether a board received negative information. It asks whether that information alerted directors to actual misconduct or a serious compliance threat requiring action, and whether directors then consciously disregarded that specific warning. A yellow flag isn’t automatically a red flag, and evidence that management is actively investigating and responding to a problem can actually undermine, rather than support, an inference of bad faith.

The Emerging Framework

Read together with Teligent and Regions Financial from Part 1, these cases sketch out a more mature and more precisely calibrated Caremark doctrine than existed even a couple of years ago. Marchand and the earlier Boeing litigation established that boards must build meaningful oversight of mission-critical risks. McDonald’s extended that oversight obligation to senior officers within their areas of responsibility. Teligent shows the real danger when mission-critical regulatory compliance systems allegedly break down at both the board and officer level simultaneously. Brewer highlights why meaningful action after serious allegations of illegality reach the board matters as much as the escalation itself. And the 2026 Boeing decision supplies the essential other half of the equation: when directors build real reporting mechanisms, actually receive the information those mechanisms generate, devote genuine attention to the relevant risk, and oversee responsive remediation efforts, Delaware courts will not impose Caremark liability simply because the company later experiences another crisis. Caremark is not becoming a generalized negligence standard for corporate governance, and if anything, recent decisions are sharpening rather than blurring the line between inadequate performance and actual bad faith.

What This Means for Compliance Officers

These decisions carry direct, practical implications for how compliance programs should be designed and documented. Mission-critical legal and regulatory risks need to be affirmatively identified and assigned clear ownership, and reporting protocols need to specify exactly what information reaches management, the relevant board committees, and the full board, and on what cadence. Serious allegations, particularly whistleblower complaints, regulatory findings, recurring violations, and evidence of potentially systemic misconduct, need defined escalation procedures that don’t stop at the moment of escalation.

Just as importantly, escalation needs to trigger genuine follow-up. Boards need to be told not merely that a problem exists, but what’s actually being done about it, whether the remediation is working, and whether the underlying risk is increasing or decreasing over time. And the corporate records documenting that entire process, board minutes, committee reports, management updates, matter enormously. Stockholders increasingly use Delaware’s Section 220 books-and-records demand process before ever filing a Caremark claim, and as the 2026 Boeing decision shows, detailed records demonstrating sustained, genuine board engagement can become the single most powerful evidence against an inference of bad faith.

The Bottom Line

Caremark litigation isn’t going anywhere, and the range of risks that can generate it keeps expanding: cybersecurity, artificial intelligence, sanctions, anti-corruption, healthcare regulation, consumer protection, product safety, and workplace misconduct all present potential oversight exposure depending on a company’s specific business. But Delaware courts are not treating Caremark as strict liability for directors and officers whenever misconduct occurs somewhere in the organization. The doctrine that’s emerging points toward a practical, achievable governance standard: identify your company’s genuinely critical legal and compliance risks, build systems that reliably surface those risks, make sure the material information actually reaches the people responsible for acting on it, investigate credible warning signs, respond meaningfully to what you find, monitor whether remediation is actually working, and document the entire process along the way. Caremark does not demand that directors prevent every corporate failure. It demands a good-faith effort to oversee the risks that genuinely matter, and it demands that boards not consciously look away when serious compliance problems are staring them in the face.

I wasa honored to appear recently on Greg Rasner’s Third Party Threat Hunters Podcast to discuss Third-Party Sanctions Risk.

You can listen to it HERE.

Thanks to Greg and his incredible team.

Delaware courts have spent the last several years wrestling with one of the hardest questions in corporate governance law: at what point does a board’s failure to prevent corporate misconduct stop being ordinary bad management and start being an actual breach of the fiduciary duty of loyalty? That question sits at the center of Caremark doctrine, and a run of recent decisions, involving Teligent, Regions Financial, and Boeing, gives boards, senior executives, and compliance officers real, current guidance on where that line actually falls in 2026. This is Part 1 of a two-part series. Here, we look at what Teligent and Regions Financial teach about escalation, investigation, and response. Part 2 will cover the pivotal 2026 Boeing decision and what it means for the doctrine going forward.

A Quick Refresher on What Caremark Actually Requires

Caremark liability flows from the duty of loyalty and its underlying obligation of good faith, and it has never been a simple negligence standard. A plaintiff can establish bad faith one of two ways: showing that fiduciaries utterly failed to implement any reporting or oversight system at all, or showing that fiduciaries implemented such a system but then consciously failed to monitor it or act on the risks it surfaced. That second category, commonly called a “red flags” theory, is where the vast majority of meaningful litigation now happens. The critical word in both formulations is bad faith. Negligence, an underperforming compliance program, poor judgment, even a serious corporate crisis, none of that alone establishes Caremark liability. That distinction has only become more important as the doctrine has matured.

Teligent Shows What Happens When Officer-Level Oversight Breaks Down

The Delaware Court of Chancery’s decision in Giuliano v. Grenfell-Gardner, decided in September 2025, involved Teligent, a pharmaceutical manufacturer whose entire business depended on FDA compliance. Teligent ran into serious manufacturing and regulatory problems, and the complaint alleged that both directors and officers failed to build and maintain adequate systems for monitoring that compliance, then failed to respond as the regulatory problems piled up.

The procedural posture here is unusual and worth understanding: after Teligent entered bankruptcy, its plan administrator pursued these claims directly through the company’s successor, which meant the plaintiff didn’t have to clear the usual derivative demand hurdle and had full access to the company’s internal books, records, and communications. With that access, the court denied dismissal against the directors and two officers, while dismissing the claims against the CFO specifically.

Teligent matters for three reasons. It reinforces that identifying mission-critical regulatory risk is central to Caremark analysis, and for a pharmaceutical manufacturer, FDA compliance isn’t a peripheral concern, it’s foundational to the ability to operate at all. It also confirms that officer-level Caremark obligations, established in the McDonald’s decision, are being applied in practice: officers who own areas carrying significant legal and regulatory risk can’t simply assume oversight is exclusively the board’s job. And it underscores that a compliance system only has value if material information actually moves upward to the people responsible for acting on it. The litigation remains active, with the court declining in August 2026 to allow an early summary judgment motion because the factual record still needs further development, which makes this a case worth continuing to watch.

Regions Financial: The Investigation Isn’t the Finish Line

Brewer v. Turner offers a different but equally important lesson. The case grew out of Regions Financial’s overdraft fee practices. In 2019, the company’s former general counsel sent the board a draft whistleblower complaint alleging, among other things, that he’d been terminated partly for raising concerns about allegedly illegal practices used to inflate consumer overdraft fees. The board responded by hiring an attorney to investigate. But Regions didn’t actually stop the challenged practices until 2021, and the Consumer Financial Protection Bureau later investigated and reached a 2022 consent order under which Regions paid $191 million in fines and consumer redress, while denying wrongdoing.

A stockholder brought derivative Caremark claims, and in September 2025 the Court of Chancery allowed the red-flags theory to proceed against directors who served during the relevant period, finding the plaintiff had adequately pleaded particularized facts supporting a substantial likelihood of liability. The Delaware Supreme Court declined to hear an interlocutory appeal in December 2025, a procedural rather than substantive ruling, but one that leaves the Chancery decision and the underlying litigation in place.

The real lesson in Brewer isn’t that receiving a whistleblower complaint automatically creates liability, and it isn’t that hiring an investigator automatically eliminates it either. The question that actually matters is what happens after the investigation: did the board genuinely understand the substance of the allegations, oversee an appropriate investigation, evaluate what it found, ensure real remediation happened, and document that entire process. An investigation that becomes a procedural box-checking exercise, disconnected from any actual response to continuing misconduct, doesn’t satisfy Caremark’s good-faith requirement. For chief compliance officers and general counsel, this case is a clear reminder that escalation is only half of an effective compliance system. Response is the other half, and it’s the half that actually gets tested in litigation.

Part 2 of this series takes up the 2026 Boeing decision, which supplies the essential counterweight to these two cases: what happens when a board’s oversight efforts are genuinely robust, and a serious incident happens anyway.

OFAC fined an unnamed U.S. consultant just over $1.4 million for Iran sanctions violations tied to advisory work provided to a leading Iranian software company, and this case deserves careful attention because it demolishes a defense I still hear surprisingly often: the idea that providing remote advice, strategic guidance, or consulting services to an Iranian business, without physically operating in Iran or directly running the company, somehow falls outside the reach of U.S. sanctions. It doesn’t, and OFAC’s enforcement order makes that point in granular, almost instructive detail.

The Backstory

This case has an unusual origin story. The consultant founded an Iranian software solutions company back in 1987 while living in Iran, and in 2011 created an Iran-incorporated holding company to preserve an ownership interest in that business. Over the decades, the software firm grew into one of Iran’s leading providers of financial, administrative, human resources, logistics, and management software, serving a wide range of Iranian industries and state-owned entities. At some point, the consultant relocated to the United States and, per OFAC’s finding, became a U.S. person subject to the same sanctions compliance obligations as any other American, a status that didn’t disappear just because the underlying business relationship in Iran predated the move.

What the Consultant Actually Did

Despite that changed status, OFAC found the consultant maintained active connections to both the software firm and the Iranian holding company for years, including a period between 2019 and 2023 during which the consultant provided management consulting and advisory services through virtual meetings with the companies’ senior officials. These weren’t passing courtesy calls. OFAC’s order describes substantive engagement: discussions covering corporate transactions, asset management, sales, marketing, accounting, human resources, corporate governance, and overall company strategy. In some instances, the consultant drafted the meeting agendas outright. In others, the consultant provided what OFAC called substantive advice, analysis, and information.

This is the core lesson of the case. Providing strategic or operational consulting services to an Iranian company, even entirely remotely, even without ever setting foot back in Iran, constitutes a service to Iran under the Iranian Transactions and Sanctions Regulations. There’s no carve-out for advice delivered over a video call rather than in person, and there’s no meaningful distinction between actively managing a business and simply advising the people who do.

The Money Trail

Alongside the advisory violations, OFAC found the consultant arranged, between June 2019 and August 2020, for dividend payments from the two Iranian companies to be wired into U.S. bank accounts. Those payments didn’t move directly from Iran to the United States; they transited first through banks in third countries, including Turkey, the United Arab Emirates, and Singapore, before landing in the consultant’s U.S. accounts. In total, the consultant received $713,615 in dividend payments through this structure. Routing payments through intermediary countries before they reach a U.S. account is a pattern OFAC and other sanctions enforcers have flagged repeatedly across unrelated cases, precisely because it’s a common technique for obscuring the true origin of funds from correspondent banks that would otherwise flag a direct Iran-origin transfer.

The consultant then used some of those dividend proceeds to purchase four real estate properties in Iran for relatives around or after 2021, adding a distinct property-acquisition violation on top of the underlying dividend transfers themselves. The consultant eventually abandoned ownership interest in both Iranian companies in 2022, but by that point the violations, spanning the advisory services, the U.S. bank processing of Iran-origin dividends, and the real estate purchases, had already accumulated across several years.

Why OFAC Called This “Egregious”

OFAC’s characterization of this case as egregious rested on a combination of factors that compliance officers should study closely, because they illustrate exactly what separates a garden-variety violation from one that draws this level of penalty and public condemnation. The consultant didn’t voluntarily disclose any of this conduct to OFAC. When OFAC issued a subpoena in January 2025 seeking information about the alleged violations, the consultant’s initial response was incomplete; only after OFAC sent a second subpoena specifically citing the deficiencies in that first response did the consultant provide a complete answer.

OFAC also found the conduct was willful, meaning the consultant knew the activities in Iran were prohibited and nonetheless engaged in a multi-year pattern of violations, understanding both that the services were being provided to companies in Iran and that the dividends being received originated from Iran. OFAC even pointed to a 2000 newspaper article the consultant co-authored about Iran’s digital revolution and the challenges the Iran sanctions program posed to Iran’s information technology sector, using it as direct evidence that the consultant was personally, demonstrably aware of the sanctions regime and its implications for exactly the kind of business at issue here. That’s a striking piece of evidence to see cited in an enforcement order, a defendant’s own published writing used to establish knowledge and intent years before the violations even began.

On the mitigating side, OFAC credited the consultant with having no OFAC enforcement history in the prior five years, having stopped the violative conduct before receiving the subpoena, and OFAC also factored in the consultant’s inability to pay a larger settlement amount, a mitigating consideration that isn’t always publicly acknowledged in OFAC orders but appears to have meaningfully shaped the final penalty figure here.

Two Broader Principles OFAC Wanted to Emphasize

OFAC used this case to reinforce two points that extend well beyond this one consultant. First, U.S. sanctions apply to all U.S. persons, a category that explicitly includes lawful permanent residents, not just citizens, wherever they happen to be located in the world. Someone who becomes a U.S. person, whether through citizenship or permanent residency, takes on the full weight of U.S. sanctions compliance obligations from that point forward, regardless of business relationships or ownership interests established years earlier while living abroad.

Second, and more broadly, OFAC stated plainly that U.S. persons who help manage the affairs of a commercial business in Iran, or any other jurisdiction subject to comprehensive sanctions, are almost certain to violate sanctions. That’s about as direct a warning as OFAC issues, and it should register with any U.S. person, executive, board member, consultant, or even informal advisor, who maintains any ongoing involvement with a business operating in a sanctioned jurisdiction, no matter how that involvement is characterized or how limited it may seem in scope.

The Cooperation Lesson

OFAC also used this settlement to reinforce the value of prompt, complete cooperation with its investigations. The agency was explicit that timely and thorough cooperation demonstrates an investigative subject understands the seriousness of their compliance obligations, and that it saves OFAC time and resources in completing an investigation efficiently. Conversely, OFAC warned that failing to cooperate in a complete and satisfactory manner doesn’t just forfeit potential mitigation credit; it can generate standalone penalties under OFAC’s own Reporting, Procedures and Penalties Regulations. The consultant’s initially deficient subpoena response is precisely the kind of conduct that pushed this case toward the higher end of OFAC’s penalty framework, independent of the underlying sanctions violations themselves.

Part of a Broader Campaign

OFAC explicitly tied this case to its Operation Economic Outcast campaign targeting Iran sanctions evasion, stating the agency will aggressively pursue enforcement against anyone violating U.S. sanctions against Iran. The investigation was coordinated with the FBI’s Los Angeles Field Office, underscoring that these matters increasingly involve interagency law enforcement coordination rather than OFAC acting alone on a purely civil administrative basis.

What This Means for U.S. Persons With Any Iran Connection

This case carries a clear message for anyone in the U.S. compliance community with clients, family members, or personal connections that touch Iranian business interests. Any U.S. person, citizen or lawful permanent resident, who provides advisory, consulting, or strategic services to an Iranian company, even entirely remotely and even without direct operational control, is providing a service to Iran under U.S. sanctions law and needs a license or a clear regulatory exemption before doing so. Dividend or other payment flows connected to Iranian business interests should be treated as sanctions-prohibited by default, regardless of how many intermediary jurisdictions the funds pass through before reaching a U.S. account, since routing through third countries does not launder the underlying prohibition and, as this case shows, OFAC is fully capable of tracing that path. And perhaps most importantly, when OFAC issues a subpoena, the only sound response is complete, prompt cooperation the first time; an incomplete initial response doesn’t just delay the inevitable, it becomes an independent aggravating factor that can meaningfully increase the eventual penalty.

The Justice Department announced a settlement with Honeywell Aerospace requiring the company to pay $2,042,518 to resolve allegations that it violated the False Claims Act by failing to meet cybersecurity requirements built into a Department of Defense contract. This case adds to a growing body of enforcement actions confirming that DOJ’s Civil Cyber-Fraud Initiative is not slowing down, and it’s a useful reminder that cybersecurity compliance failures don’t need to result in an actual breach to generate significant False Claims Act exposure.

What the Government Alleged

According to DOJ’s announcement, the allegations cover the period from April 2020 through December 2023, during which a business unit of Honeywell International submitted claims for payment while failing to comply with the cybersecurity requirements specified in NIST Special Publication 800-171, as applied to one of the company’s networks. NIST SP 800-171 is the federal cybersecurity standard that governs how contractors must protect controlled unclassified information, and compliance with it is a standard contractual and regulatory requirement built into defense contracts handling that category of government data. The government’s theory here follows the now-familiar False Claims Act framework applied throughout the Civil Cyber-Fraud Initiative: when a contractor certifies or represents that it meets required cybersecurity standards in order to obtain payment under a government contract, and that representation turns out to be false, the resulting claims for payment can themselves become actionable false claims, independent of whether any actual data breach or security incident ever occurred.

It’s worth being precise about what DOJ’s press release does and doesn’t say here. The claims resolved by the settlement are allegations only, and DOJ’s release explicitly notes there has been no determination of liability. Honeywell Aerospace, now a standalone public company as of June 29, was previously a business segment of Honeywell International, and the settlement is being announced under Honeywell Aerospace’s name even though the underlying conduct occurred while it operated as part of the larger Honeywell International structure.

The Whistleblower’s Role

This case originated from a whistleblower lawsuit filed under the False Claims Act’s qui tam provisions, which allow private citizens with knowledge of fraud against the government to bring suit on the government’s behalf and share in any resulting recovery. The whistleblower here, Rachel Tenney, a former Honeywell employee, will receive $375,823 as her share of the settlement, just under 20 percent of the total recovery. That relator’s share sits within the typical range courts and DOJ award in qui tam matters and reflects a now well-established pattern in cybersecurity-related False Claims Act cases: these matters are frequently surfaced not through government audits or external security assessments, but through insiders, often IT, security, or compliance personnel, who have direct visibility into gaps between what a contractor represents to the government about its security posture and what its systems actually look like in practice.

Why This Case Fits a Clear Enforcement Pattern

DOJ’s public statements accompanying this settlement make the enforcement priority explicit. Assistant Attorney General Brett Shumate stated that government contractors obtaining defense information while administering their contracts must follow required cybersecurity standards, and that the department will continue investigating potential violations of these requirements to protect that information. U.S. Attorney Russ Ferguson for the Western District of North Carolina reinforced the same point, noting that cybersecurity requirements exist specifically to protect government systems and prevent unauthorized access to government data, and that companies profiting from government contracts have an obligation to ensure that sensitive data is actually protected, not just formally certified as protected on paper.

This case was handled jointly by DOJ’s Civil Division Commercial Litigation Branch, the U.S. Attorney’s Office for the Western District of North Carolina, and the Defense Criminal Investigative Service, a coordination pattern that reflects how seriously the government now treats cybersecurity compliance failures tied to defense contracting: not as a narrow contractual or IT issue, but as a matter warranting the same interagency law enforcement coordination applied to other significant fraud matters.

What This Means for Government Contractors

The Honeywell Aerospace settlement reinforces several lessons that should already be familiar to any organization holding defense contracts involving controlled unclassified information, but that bear repeating given how frequently they continue to generate enforcement action.

First, cybersecurity compliance representations made in connection with government contracts are being treated as material to the government’s payment decision, meaning a gap between actual network security practices and required NIST SP 800-171 controls can generate False Claims Act liability even absent any breach, data loss, or known compromise. Contractors should not assume that the absence of an actual security incident insulates them from liability for underlying compliance gaps.

Second, this remains a whistleblower-driven enforcement area. Organizations holding defense contracts with cybersecurity compliance obligations should assume that internal personnel, particularly those with direct technical visibility into network security posture, are a realistic and increasingly common source of enforcement referrals, which means internal reporting channels and genuine responsiveness to raised security concerns matter as much as the underlying technical controls themselves.

Third, the multi-year window covered by this settlement, spanning nearly four years from 2020 through 2023, illustrates how these compliance gaps tend to persist quietly across many billing cycles before surfacing through litigation, which underscores the value of periodic, genuinely independent verification of NIST SP 800-171 compliance status rather than relying on point-in-time attestations that may not reflect a network’s actual, current security configuration.

Any organization holding, or seeking to hold, a Department of Defense contract involving controlled unclassified information should treat this settlement as confirmation that DOJ’s Civil Cyber-Fraud Initiative remains an active, well-resourced enforcement priority, and that closing the gap between documented cybersecurity compliance and actual network security practice is not a discretionary IT project. It’s a genuine False Claims Act exposure that continues to generate multimillion-dollar settlements years after the underlying conduct occurred.

OFAC is skeptical of cosmetic restructurings designed to look like change while control remains the same.

Practically, petitions can take many months to over a year, and you’re often arguing against evidence you’ll never fully see, since designations can rest on classified information.

If OFAC denies or ignores your petition, you can challenge it in federal court, but courts defer heavily to the executive on sanctions, so litigation is a last resort, not a strategy.

If you’re designated, get experienced OFAC counsel immediately, do a real internal investigation, build your remediation story, and manage expectations. It takes time.

The best strategy is never needing this. Build a sanctions program rigorous enough that you never end up on the list at all.

The Ethics and Compliance Q and A show is produced by One Stone Creative.

In this episode of Corruption, Crime and Compliance, Michael Volkov examines how Delaware’s Caremark doctrine has matured through a recent run of decisions involving Teligent, Regions Financial, and Boeing, all centered on the question of when a board’s failure to prevent corporate misconduct crosses from ordinary mismanagement into an actual breach of the duty of loyalty. He walks through Teligent’s officer-level oversight failures in FDA compliance, Regions Financial’s lesson that a whistleblower investigation without genuine follow-through and remediation doesn’t satisfy Caremark’s good-faith standard, and the pivotal 2026 Boeing dismissal, where extensive board and committee engagement on safety protected directors even after another serious incident. The episode closes with practical guidance for compliance officers on identifying mission-critical risks, building real escalation and follow-up procedures, and documenting board oversight, since Caremark, as these cases confirm, does not demand perfection, only a good-faith effort to oversee the risks that genuinely matter.

KPMG just released its 2026 Global Chief Ethics and Compliance Officer Survey, drawing on responses from 725 CCOs, and the framing KPMG chose for the report tells you most of what you need to know before you even get to the data: “Feeling the pressure: A new reality for compliance leaders.” That’s not marketing language. It reflects a genuine shift in what the compliance function is now expected to deliver, and the survey results back it up with real numbers worth unpacking.

Why Operational Resilience Has Moved to the Center

The core finding driving this year’s report is that interconnected cyber, third-party, and regulatory risks have made operational resilience a top priority for compliance leaders, not an adjacent concern owned by IT or business continuity teams. Three-quarters of CCOs surveyed, 75 percent, identified cybersecurity and data privacy as key areas for additional investment, and 77 percent named data analytics as a primary investment driver going forward. That pairing is telling. Cybersecurity investment without the analytics capability to actually monitor, detect, and respond to emerging risk in real time is incomplete, and compliance leaders appear to understand that these two investment categories function together rather than as separate line items competing for budget.

Regulatory pressure remains a distinct challenge layered on top of this. A third of respondents, 33 percent, cited new regulatory requirements as their top compliance challenge over the next two years, which tells you that even as compliance functions expand into operational resilience and cyber risk territory, the traditional core mandate, tracking and responding to a shifting regulatory landscape, hasn’t gotten any easier. If anything, it’s competing for the same limited attention and budget that resilience investment now demands.

Cross-Functional Collaboration Is the Real Story Underneath the Numbers

What I find most significant in this survey isn’t the investment figures on their own. It’s what those figures say about how compliance functions now have to operate structurally. Sixty-seven percent of CCOs surveyed reported confidence in assessing compliance synergies across legal, HR, investigations, internal audit, and operations, a genuinely broad set of functions to be coordinating with effectively. Even more notably, 81 percent expressed confidence collaborating specifically with cybersecurity teams, and 68 percent with resiliency and business continuity teams.

That level of confidence in cross-functional collaboration reflects something important about how compliance’s mandate has evolved. Operational resilience isn’t something a compliance function can build on its own, sitting in its traditional lane of policy, training, and monitoring. It requires genuine partnership with the teams that actually own network security, incident response, and business continuity planning. A CCO who treats cybersecurity as someone else’s department, to be consulted only when a breach or incident actually occurs, is no longer positioned to do the job KPMG’s survey respondents describe themselves as doing. The compliance function increasingly has to sit inside the operational resilience conversation from the planning stage forward, not get looped in after the fact when a risk has already materialized into an incident.

AI in Compliance: Real Adoption, Measured Enthusiasm

The survey’s findings on AI use inside compliance functions are worth their own attention, because the tone is notably calibrated rather than either dismissive or overly enthusiastic. Sixty-eight percent of CCOs described their view of AI use as “mixed, leaning positive,” reporting that they’ve seen more benefits than challenges so far. That’s a meaningfully different posture than blanket AI optimism, and it reflects a compliance function actually grappling with AI’s real tradeoffs rather than adopting it reflexively because it’s the technology of the moment.

The specific use cases where AI is gaining traction inside compliance functions are instructive. Fifty percent of respondents reported using AI for compliance risk assessment and management, the single most common application. Data visualization and predictive analytics, and employee training and awareness, each came in at 44 percent. That combination suggests compliance functions are gravitating toward AI applications where the technology’s strengths, pattern recognition across large data sets and scalable content delivery, map cleanly onto tasks compliance teams already struggle to do manually at scale: sorting through transaction or communication data for risk signals, building visual risk dashboards for leadership and the board, and delivering consistent training content across a large, distributed workforce.

What This Means for Compliance Leaders Building Their 2027 Priorities

A few practical implications follow from this survey that compliance officers should be translating into actual planning conversations now.

If your compliance function’s investment planning for the next budget cycle doesn’t include a meaningful allocation to cybersecurity, data privacy, and the data analytics capability needed to make that investment actually functional, you’re planning against a materially different reality than the one 75 percent of your peer CCOs are already investing against. Operational resilience investment isn’t optional anymore, and treating it as a lower priority than traditional compliance program elements risks leaving your function meaningfully behind where the field is actually heading.

Structural collaboration with cybersecurity and resiliency teams needs to be built into your compliance function’s actual operating model, not treated as an ad hoc relationship that activates only during an incident. The CCOs reporting high confidence collaborating with these teams didn’t develop that confidence by accident; it reflects deliberate investment in cross-functional processes, shared risk assessment frameworks, and regular touchpoints well before any specific risk event forces the collaboration into existence under pressure.

And on AI specifically, the survey’s findings suggest the most productive path forward isn’t broad, undifferentiated AI adoption across every compliance function, but targeted application to the specific use cases where compliance teams are already seeing real value: risk assessment and management, predictive analytics and visualization for reporting up to leadership and the board, and training delivery at scale. Compliance leaders evaluating AI tools should be asking whether a proposed use case maps onto one of these proven categories, rather than adopting AI capability generically and hoping a use case emerges afterward.

The broader message from this survey is one I’d encourage every compliance officer to sit with directly: the function’s mandate has genuinely expanded, from risk mitigation toward resilience and measurable value creation, and that expansion isn’t optional or temporary. It’s the new baseline expectation for what a modern compliance program actually needs to deliver.