Over more than three decades of defending claims, litigating False Claims Act cases, and helping clients avoid suspensions and debarments, my law firm colleagues and I have learned a fair amount about risk and what makes corporate compliance programs succeed or fail.

One of the “secret ingredients” we have used over the years to drive clients toward the former and avoid the latter is a healthy mix of traditional legal principles and behavioral economics.

Richard Thaler, the 2017 Nobel laureate in economics, describes behavioral economics as economics with more realistic assumptions about human behavior. Daniel Kahneman, the Nobel laureate author of Thinking, Fast and Slow, describes it as the study of how people make decisions under conditions of uncertainty, relying on heuristics (mental shortcuts) that systematically depart from rational choice.

As many had expected since Donald Trump’s return to the White House and Paul Atkins’ return to the SEC, the commission formally announced May 29 that it had begun the process to rescind rules on certain climate-related reporting by public companies. A 60-day public comment period began June 3 and will end Aug. 3.

The climate rule, proposed in 2022 before a scaled-back version was formally adopted in 2024, would have required all SEC registrants to report certain material climate-related risks in annual reports and registration statements. It also required disclosure of greenhouse gas (GHG) emissions data by a smaller number of registrants. 

Most property and casualty insurers do not question whether creator-led marketing works. The issue is control.

The format introduces something traditional advertising lacks: lived experience. A driver describing a breakdown or a homeowner talking through a claim carries more weight than standard messaging. But insurance marketing cannot rely on implication alone. Statements about price, coverage, or outcomes sit inside a regulatory framework that becomes very real when challenged. That is where most creator programs run into trouble.

Problems usually start with language.

Global compliance programs often feature codes of conduct, policies, training, hotlines, investigations, and risk assessments. While these “seven elements” are essential, they do not guarantee an effective Ethics and Compliance (E&C) Program. Success depends on company culture and, critically, the involvement of mid-level managers whose engagement determines if these systems work in practice.

Recent observations from a multi-session Integrity Playbook, Ethical Leadership training pilot with managers in legal, IT, supply chain, communications, and operations at Azercell Telecom, the largest mobile telecom provider in Azerbaijan, reinforced a truth many compliance professionals recognize. This brings us to a core insight:

Compliance fails not because of missing policies, but when managers are unprepared to act under pressure.

Despite strong motivation among business leaders to manage risk and compliance, Gartner research suggests that only one-third feels confident in their ability to do so. Traditional approaches, such as policy distribution and annual training, are falling short of building the muscle memory organizations need to keep pace with today’s fast-changing regulatory landscape.

The traditional approach to risk management is being challenged by the increasing speed, complexity and cross-functional nature of modern risks. This shifting environment calls for compliance teams to do more than oversee controls; they must empower business, risk and control owners to work together more proactively and effectively.

In today’s increasingly complex regulatory environment, organizations across many industries face escalating scrutiny from government enforcement agencies. These agencies are no longer evaluating programs based only on whether required elements exist on paper. Instead, they are examining whether compliance programs are sufficiently operationalized to identify, assess, and address risk before issues become enforcement matters.

Industries facing increased compliance scrutiny can learn from healthcare, which deals with extremely rigid compliance enforcement from the U.S. Department of Justice (DOJ) and the Health and Human Services Office of Inspector General (OIG). As a result, many healthcare organizations are reassessing how their compliance programs are structured, supported and evaluated. Now, program effectiveness relates not only to implications for regulatory and revenue risk but also for organizational credibility with regulators, payers, and governing bodies.

When organizations evaluate an AI-powered compliance tool for their communication archive, the checklist follows a familiar pattern. Does it capture the right channels? Does it surface risk accurately? Does it integrate with existing infrastructure?

These are the right questions, but they all point in one direction: what the tool does. Very few are asking the important question of how it works.

Rapid technological developments in artificial intelligence (AI) have resulted in growing public attention to the potential benefits and challenges of these developments as they relate to health care. The Trump administration recently released A National Policy Framework for Artificial Intelligence (“AI Framework”), a set of legislative recommendations that could jump-start congressional activity on the application of AI across a variety of policy areas, not just health care. A core part of the AI Framework emphasizes establishing federal AI policy that preempts many state AI laws to reduce barriers for deploying AI applications. Preemption could nullify state consumer protections governing the use of AI in health coverage, such as prior authorization, and claims review and appeals. This Issue Brief discusses the types of consumer protections for use of AI in prior authorization and claims review, describes the Trump administration’s AI Framework, and highlights areas to watch as Congress considers AI legislation.

The Department of Justice issued an order on April 23, rescheduling state-licensed medical marijuana and Food & Drug Administration-approved cannabis products to Schedule III of the Controlled Substances Act (CSA). The order is also expected to jumpstart the stalled Drug Enforcement Administration rescheduling process for adult use marijuana, which currently remains in Schedule I. The order, therefore, narrows but does not eliminate federal prohibitions.