Key Takeaways

• Iran: maximum pressure, operationalized. The Office of Foreign Assets Control (OFAC) designated dozens of Iranian airlines, suspended long-standing aviation and humanitarian-adjacent general licenses, sanctioned Russia’s VTB Bank, and adopted a presumption of denial for Iran-related specific license applications.
• Cuba: a new regulatory regime. OFAC published new Cuba sanctions regulations, implementing Executive Order (EO) 14404 and amended the Cuban Assets Control Regulations (CACR) to restrict indirect dealings with Cuba Restricted List entities, eliminate the U-turn authorization, and remove group people-to-people and professional-meeting travel authorizations, all effective September 30, 2026.
• Program wind-downs and delistings. The Ethiopia program ended with the expiration of the EO 14046 emergency; OFAC amended the Terrorism List Governments Sanctions Regulations following the rescission of Syria’s State Sponsor of Terrorism designation; and selective delistings occurred under Belarus, Russia, and Democratic Republic of the Congo (DRC) programs.
• Enforcement architecture. OFAC consolidated its penalty and enforcement-procedure provisions into new Sanctions Penalties Regulations (31 C.F.R. Part 505) and removed more than 100 duplicative subparts across its chapter of the CFR.
• Russia and Venezuela licensing. OFAC continued to calibrate licensing for the Lukoil International GmbH divestiture (GL 131J) and Venezuela (GL 49B and other amended licenses).

At a Glance: Principal September Actions

Iran: Operation Economic Outcast Expands Across Â鶹ֱ˛Ą

Iran was again the dominant focus of U.S. sanctions activity in September. The Treasury framed its actions under the banner of “Operation Economic Outcast,” a Treasury-led campaign that the State Department describes as seeking to isolate the Iranian regime completely from the financial lifelines sustaining its conduct. Many designations were made under Executive Order 13902, which targets additional sectors of Iran’s economy, including its financial sector, and carries secondary sanctions exposure for non-U.S. persons.

Aviation sector designations and suspension of general licenses (September 8, 2026)

On September 8, OFAC designated a large slate of Iranian passenger and cargo carriers, including Iran Air Tour, Iran Aseman Airlines, Kish Airlines, Qeshm Air, Zagros Airlines, Taban Airlines, and many newer carriers, together with aviation-support companies in the United Arab Emirates, the United Kingdom, Turkey, Malaysia, and Kazakhstan linked to Mahan Air. Concurrently, OFAC indefinitely suspended the ITSR general licenses at 31 C.F.R. § 560.522 (overflight payments), § 560.528 (aircraft safety), and § 560.529 (bunkering and emergency repairs), as well as Iran General License J-1 (temporary sojourn of civil aircraft). OFAC issued General License DD to authorize wind-down of transactions previously authorized under §§ 560.522 and 560.529 and GL J-1 through September 23, 2026, and Counter Terrorism General License 37 to authorize wind-down of transactions involving certain persons blocked that day.

These measures build on OFAC’s August 24 suspension of the ITSR authorizations for certain educational activities, noncommercial personal remittances, conference-related services, and General Licenses F (sports) and G (academic exchanges), whose GL BB wind-down period ended September 8. Companies that relied on these authorizations, including airlines, lessors, MRO providers, ground handlers, universities, and remittance providers, should confirm that all relevant activity has ceased.

Presumption of denial for Iran-related specific licenses (September 10, 2026)

OFAC announced that, effective immediately, it will consider Iran-related specific license applications under a presumption of denial, except as required by law or in certain circumstances such as risk to life, limb, or environmental safety. This is a significant departure from prior case-by-case review. Pending applications should be reassessed, and businesses should not assume that a specific license will be available to address legacy exposure. The same day, OFAC designated Iraqi and Lebanese individuals and entities linked to Kata’ib Hizballah and Hizballah’s financial networks, including Lebanese exchange houses and a Dubai-based trading company designated under EO 13902.

Financial sector: VTB Bank and digital assets (September 14 and 17, 2026)

On September 14, the United States sanctioned VTB Bank, one of Russia’s largest financial institutions, under EO 13902. The State Department stated that VTB opened offices in Iran, built banking ties with sanctioned Iranian financial institutions, and worked to move billions of dollars in Iranian assets, and warned that governments and financial institutions considering similar arrangements face exposure to U.S. financial restrictions. On September 17, OFAC designated the Iranian digital-asset platform Bitbank and its operator, Pishtaz Simorgh Electronic Trade Company, as well as associated individuals.

Regulatory codification and continued designations (September 29–30, 2026)

OFAC amended the ITSR to implement certain provisions of EO 13902, revise an existing definition and exemption, and incorporate two exemptions from that order, effective September 30, 2026. On September 29, OFAC also designated Iranian military procurement networks alongside counter-narcotics designations of the Sinaloa Cartel’s Los Mayos faction and associated corruption networks. Separately, the State Department issued a September 22 advisory on luxury goods and wholesale club transaction risks with Iranian officials under the Foreign Missions Act.

Enforcement

On September 10, OFAC announced that an individual agreed to pay $1,427,230 to settle potential civil liability for providing management consulting and advisory services to a leading Iranian software company, receiving Iranian-origin dividends into U.S. bank accounts, and acquiring real property in Iran. OFAC determined that the apparent violations were egregious and not voluntarily self-disclosed and stated that its enforcement campaign against the U.S. and foreign persons who violate Iran sanctions will continue under Operation Economic Outcast. The case is a reminder that individuals, including dual nationals and those with family or investment ties to Iran, are squarely within OFAC’s enforcement focus.

Cuba: New Cuba Sanctions Regulations and CACR Amendments

On September 17, 2026, OFAC designated Cuban state-owned enterprises under EO 14404, including entities in the Moa and Nicaro nickel complex (such as Pinares S.A. and Ceproniquel) and defense research and development centers, along with several individuals. The State Department described the action as targeting Cuba’s mineral wealth and military modernization apparatus.

On September 29, 2026, OFAC announced a broader regulatory package that took effect upon Federal Register publication on September 30, 2026:

• Cuba Sanctions Regulations. New regulations implementing EO 14404 of May 1, 2026, “Imposing Sanctions on Those Responsible for Repression in Cuba and Threats to the United States National Security and Foreign Policy.”
• CACR amendments. Amendments that, among other things, add a prohibition on indirect financial transactions with entities or subentities on the State Department’s Cuba Restricted List, remove the authorization for “U-turn” transactions, and remove the authorizations for group people-to-people travel and professional meetings in Cuba.
• Guidance. Five new Cuba-related FAQs (1271–1275), 29 amended FAQs, and an OFAC Alert, “Expanded Sanctions Against Cuba,” highlighting increased sanctions risk for Cuba-related transactions.

Banks and payment processors should revisit Cuba-related screening logic, particularly given the extension to indirect transactions with Cuba Restricted List entities and the loss of the U-turn authorization. Travel providers, event organizers, and companies sending personnel to Cuba should reassess reliance on the eliminated travel categories.

Russia and Venezuela: Targeted Licensing Adjustments

On September 18, 2026, OFAC issued Russia-related General License 131J, authorizing certain transactions for the negotiation of and entry into contingent contracts for the sale of Lukoil International GmbH and related maintenance activities, and amended FAQs 1224 and 1225. Parties involved in the Lukoil divestiture process should review the revised terms closely, as each iteration of this license has adjusted scope and conditions. OFAC also removed certain persons from the Specially Designated Nationals (SDN) List under Russia-related authorities on September 16.

For Venezuela, OFAC issued amended general licenses on September 2, 14, and 16, and on September 28 issued General License 49B, which replaced and superseded GL 49A in its entirety effective that date. GL 49B, like its predecessor, excludes transactions involving persons in Russia, Iran, North Korea, Cuba, or China (or entities owned or controlled by or in a joint venture with such persons), the unblocking of property blocked under the Venezuela Sanctions Regulations, and transactions involving blocked vessels. Companies operating under Venezuela authorizations should confirm they are relying on the current version of each license.

Program Terminations, Delistings, and Syria

• Ethiopia. The national emergency declared in EO 14046 (September 17, 2021) expired. OFAC removed persons designated under that order from the SDN List, including the Eritrean Defense Forces, the People’s Front for Democracy and Justice, Red Sea Trading Corporation, and Hidri Trust, and withdrew program FAQs.
• Syria. On September 24, OFAC amended the Terrorism List Governments Sanctions Regulations to implement changes resulting from the rescission of Syria’s designation as a State Sponsor of Terrorism, removing and reserving a Syria-specific general license that is no longer necessary.
• Belarus and DRC. OFAC removed several Belarusian entities, including Lakokraska OAO and the Bellesbumprom timber and pulp-and-paper concern, on September 17, and removed certain DRC-related designations on September 23.

Delistings create commercial opportunity — but also compliance traps. Companies should confirm that a counterparty is no longer subject to other U.S. measures (such as export controls or other sanctions programs) and to non-U.S. sanctions regimes before resuming business.

Regulatory Overhaul: The New Sanctions Penalties Regulations

On September 24, OFAC announced new Sanctions Penalties Regulations at 31 C.F.R. Part 505 (91 Fed. Reg. 60821), consolidating previously dispersed information on enforcement procedures and penalties, including the rights of U.S. persons under investigation, into a single part. In a companion final rule effective September 30, 2026, OFAC removed duplicative penalty provisions from dozens of program-specific parts, replacing them with cross-references to Part 505, and relocated provisions on delegations of authority, recordkeeping and reporting, and the Paperwork Reduction Act to an expanded initial subpart in each part. OFAC states that these changes eliminate more than 100 subparts.

While largely structural, the reorganization means that compliance manuals, policies, training materials, and contracts that cite specific program-level penalty or reporting provisions may now contain outdated citations and should be updated.

Other Notable Developments

• On September 9, OFAC designated targets under its transnational criminal organizations and counter terrorism authorities and issued new and amended FAQs; the State Department announced actions against the Xinbi Guarantee transnational criminal organization and the terrorist designation of Los Tiguerones.
• On September 16, the State Department announced sanctions on officials of the Palestinian Authority and members of the Palestine Liberation Organization, and on September 21 announced visa restrictions on 32 individuals connected to the Prince Group TCO.
• OFAC reminded holders of blocked property of the obligation to file the 2026 Annual Report of Blocked Property and published its quarterly TSRA licensing report covering April through June 2026.

Practical Recommendations

• Rescreen and reassess Iran exposure. Update screening for the September designations, particularly in aviation, digital assets, and correspondent banking, and evaluate secondary sanctions risk for non-U.S. affiliates dealing with EO 13902 targets such as VTB Bank.
• Inventory reliance on suspended or amended licenses. Identify any activity that relied on suspended ITSR general licenses, the eliminated CACR authorizations, or superseded Russia and Venezuela licenses, and confirm wind-down periods have been observed.
• Plan around a presumption of denial. Do not build business plans that assume Iran-related specific licenses will be granted; consider whether pending applications should be withdrawn, supplemented, or reframed around the stated exceptions.
• Update Cuba controls. Revise payment-screening rules to capture indirect transactions with Cuba Restricted List entities and to remove reliance on U-turn processing.
• Refresh compliance documentation. Update citations to penalty, recordkeeping, and reporting provisions to reflect Part 505 and the September 30 reorganization.
• Validate delistings before re-engaging. Confirm that delisted parties are not subject to other U.S. or non-U.S. restrictions before resuming dealings.

How Â鶹ֱ˛Ą & Lardner LLP Can Help

Our international trade and national security team regularly advises companies, financial institutions, and investors on OFAC compliance, licensing, voluntary self-disclosures, enforcement defense, and sanctions risk in cross-border transactions. Please contact the author or your Â鶹ֱ˛Ą & Lardner LLP relationship partner with any questions about how these developments affect your business.

Please find our latest “Five Compliance Best Practices” article, which provides quick-hit compliance best practices multinational companies can implement to enhance their compliance programs and internal controls. Additional “Five Things” articles, as well as our What Every Multinational Should Know and Tariff-ied! articles, can be found in the drop-down menu on our Tariff & International Trade ResourcesĚý±č˛ą˛µ±đ. for our email list to receive future practical international regulatory compliance tips.

In the wake of the IEEPA tariff reversal by the Supreme Court, the new contours of a combination Section 232/Section 301 tariff environment is coming into focus. This renewed tariff environment requires supply chain leaders to revisit assumptions that may have guided sourcing and logistics decisions prior to 2025. Supplier concentration, lean inventory models, long-distance sourcing, and limited redundancy may all become more costly or less sustainable if tariffs potentially can expand or shift rapidly. For many importers, the issue is not merely whether tariffs will increase, but whether the supply chain is designed to adapt if they do.

Supply chain leaders accordingly should consider whether their current sourcing model is resilient enough to withstand renewed tariff pressure. Here are five best practices companies should consider when reassessing their supply chain approach in the new tariff environment:

• Reconsider Single-Country and Single-Supplier Dependence. Companies should assess whether they are overly dependent on one country, supplier, or production site for critical goods or inputs. Concentration may create unacceptable cost and continuity risk where tariffs are imposed quickly or where political measures target a particular market.
• Reevaluate the Assumption That Lowest Unit Cost Means Lowest Total Cost. A sourcing model that appears cost-efficient on paper may become significantly more expensive once tariffs, logistics disruption, compliance burdens, and lead-time risk are taken into account. Supply chain leaders should incorporate total landed cost and strategic resilience into sourcing decisions rather than relying solely on nominal purchase prices.
• Build More Regional and Flexible Supply Options. Companies should consider whether portions of the supply chain can be regionalized, diversified, or structured with backup capacity so that the business is not forced into emergency sourcing if trade conditions change. Building flexibility in advance is often less costly than reacting after tariffs take effect.
• Improve Visibility into Lower-Tier Supply Chains. Tariff risk often extends beyond direct suppliers. Companies should understand where key subcomponents, raw materials, and processing activities occur so that exposure to particular jurisdictions or trade measures can be identified earlier and managed more effectively.
• Integrate Tariff Risk into Routine Supply Chain Governance. Tariff developments and changes should not be treated as occasional outside events. Companies should incorporate tariff risk into regular sourcing reviews, supplier discussions, management reporting, and strategic planning. A supply chain that monitors these issues only after an announcement is often already behind.

Supply chain leaders that rethink concentration risk, hidden cost assumptions, and tariff exposure even from lower-tier suppliers will be better positioned to respond if a more aggressive tariff environment returns. The companies that fare best will be those that prepare before policy changes force rapid decisions.

Would you like more practical compliance tips like these? The Â鶹ֱ˛ĄÂ International Trade & National Security Team is monitoring all international trade developments, including new tariff pronouncements, which we post as they occur on our Tariff & International Trade ResourcesĚý˛ú±ô´Ç˛µ. for our email list to receive future emails and practical international regulatory compliance tips.

Our white paper on Managing Import and Tariff Risks During a Trade War outlines a 12-step plan to provide practical steps to help importers navigate the tariff and international trade risks in the current tariff and trade environment, while the companion white paper on Managing Supply Chain Integrity Risks provides practical advice to deal with heightened supply chain risks pertaining to goods imported into the United States, including the increasing use of detentions by Customs.

As detailed in Part I of this risk-assessment self-check series, we are publishing a series of self-check assessment guides covering the key regulatory and contractual risk areas for multinational companies. This article provides Part VI, which is a self-check assessment for conducting a customs compliance and tariff-risk review. Previous self-check risks assessments are found Part I (general compliance), Part II (buy-side contracts review), Part III (sell-side contracts review), and Part IV (supply chain integrity compliance self-check), and Part V (antiboycott self-check).

Import compliance failures rarely stem from a single dramatic error. More often, they encompass a series of errors, such as legacy assumptions about country of origin, stale tariff classifications, failure to track assists, or failure to keep up with changing manufacturing locations. In the current high-tariff, high-enforcement, high-penalty environment, where tariff rules can change daily, recurring issues can quickly add up and translate into large potential underpayments and penalties.

To help importers deal with their sharply increased tariff risk exposure, we are providing a checklist that importers can use to assess whether their import operations use the types of procedures that Customs and Border Protection (CBP) expects. A “no” answer does not necessarily mean noncompliance, but it likely should be treated as a red flag that warrants deeper review.

I.          Country of Origin

• Does your company determine country of origin using the correct legal test for each product (e.g., substantial transformation vs. tariff-shift rules that might apply under free trade agreements)?
• Does your company analyze the country of origin rather than just rely on supplier statements or country of origin declarations on commercial invoices?
• Does your company revalidate the country of origin after: (1) changes in manufacturing location; (2) changes in component sourcing; (3) process shifts intended to mitigate tariffs?
• Does your company track multiple origins for similar Stock Keeping Units (SKUs) produced in different facilities?

II.         Tariff Classification (Harmonized Tariff Schedule (HTS) of the United States (HTSUS))

• Does your company maintain and regularly update a Customs Classification Index and share it with your Customs brokers?
• Does your company support tariff classifications with written analysis, rulings, or reasonable care memoranda, and incorporate such backup analysis within its Customs Classification Index?
• Does your company regularly review classifications following: (1) product redesigns or (2) the addition of new models or features?
• Does your company regularly review classifications to determine how they are impacted by: (1) changes to tariff regimes; (2) changes in Section 232 steel/aluminum derivatives; or (3) eligibility for United States-Mexico-Canada Agreement (USMCA) exemptions?

III.        Customs Valuation

• Does your company have a process to ensure that declared value is based upon the correct commercial price, including all mandatory additions to value and allowable deductions?
• Does your company have a system for properly tracking and attributing assists such as tooling, molds, and dies?
• Are rebates, post-import price adjustments, or transfer-pricing true-ups handled in a CBP-compliant manner?
• If your company uses first-sale valuation, does it maintain full evidence that all requirements of the doctrine are documented?
• If your company purchases goods from an affiliate, has your organization completed a transfer pricing study that meets Customs (and not IRS) transfer pricing requirements?
• Does your company have an accurate way of determining the steel, aluminum, or copper content and its value for any Section 232 derivative products?

IV.        Preferential Trade Programs (e.g., USMCA)

• Has your company done a systematic study to evaluate which products properly can claim preferential duty status and documented the supporting rationales?
• Does your company revisit origin determinations when: (1) suppliers change; (2) bills of materials change; or (3) production locations shift?
• Does your organization revisit regional value content (RVC) calculations to ensure they are up to date?
• Does your company perform checks to ensure that it has a certificate of manufacture always available at the time of importation?
• Do you have procedures to ensure that suppliers are providing accurate information to support country-of-origin declarations?

V.         Antidumping & Countervailing Duties (AD/CVD)

• Is there a formal screening process to flag potential HTS codes for matches to existing antidumping and countervailing duty orders and then to follow up on potential matches to see if the products fall within the written scope of the potential order?
• Are suppliers vetted for: (1) country-of-origin accuracy; (2) risk of transshipment; (3) minor processing in third countries being used as a justification for an incorrect country of origin?
• Is there a process for ongoing monitoring of new AD/CVD cases to determine potential coverage of your company’s imported products?

VI.        Broker Oversight & CBP Requests

• Is there active oversight of customs brokers, including periodic entry reviews?
• Are broker instructions updated and centralized, rather than informal or ad hoc?
• Is someone in your company signed up for ACE Access and set up to receive Form 28 Requests for Information, Form 29 Notices of Action, and other CBP communications rather than relying on Customs brokers to provide such information?
• Does your company have procedures to apply the results of any Form 28s or Form 29s to all unliquidated entries?

VIII.      Corrections, Disclosures & Governance

• Does your company use post-entry checks to find and fix any errors before liquidation?
• Does your company have a defined process for handling: (1) post-Summary Corrections (PSCs); (2) protests; and (3) prior disclosures
• Is senior management periodically briefed on tariff exposure and compliance risk?

If you would like help analyzing the results of your compliance self-check, please reach out to the authors or your Â鶹ֱ˛Ą relationship attorney.

Would you like more practical compliance tips like these? The Â鶹ֱ˛Ą International Trade & National Security Team is monitoring all international trade, enforcement, and compliance developments, which we post as they occur on our Tariff & International Trade Resources blog. for our email list to receive future emails and practical international regulatory compliance tips, including our weekly Tariff-ied! This Week in International Trade and What Every Multinational Should Know articles.

Our white paper on Managing Import and Tariff Risks During a Trade War outlines a 12-step plan to provide practical steps to help importers navigate the tariff and international trade risks in the current tariff and trade environment, while the companion white paper on Managing Supply Chain Integrity Risks provides practical advice to deal with heightened supply chain risks pertaining to goods imported into the United States, including the increasing use of detentions by Customs.

Artificial intelligence (AI) is moving from the enterprise into the boardroom — helping directors research, draft, summarize, and test assumptions. That convenience carries a governance cost: a single prompt can expose material nonpublic information and privileged communications, and a fluent answer that is materially wrong can influence board decision-making. This playbook focuses on directors’ own use of AI, not management’s enterprise AI program, and provides directors with a practical framework for use that is informed, secure, reviewable, and candid.

I. Introduction

AI is now part of ordinary governance work: preparing for meetings, organizing diligence, testing assumptions, comparing scenarios, drafting questions, and reviewing public information. It can increase efficiency, but it also adds fiduciary, confidentiality, disclosure, privilege, cybersecurity, and recordkeeping risk because the prompt itself may contain information the company must protect.

The governing principle is simple: AI may assist a director’s preparation, but it cannot replace the director’s judgment, confidentiality obligations, or duty to become adequately informed. Delaware law places the corporation’s business and affairs under the board’s direction, 8 Del. C. § 141(a), and protects good-faith reliance on corporate records and appropriate information, opinions, reports, or statements when the statutory conditions in 8 Del. C. § 141(e) are met.  The objective is not to ban useful tools but to treat them as controlled boardroom instruments — not confidential advisers, independent experts, substitutes for counsel, or invisible board members.

II. A Case Study Illustration

The following hypothetical illustrates the most common risks posed by a director’s use of AI:

Sam is an independent director of ABC, Inc., a Delaware corporation listed on the NYSE. ABC is evaluating a proposed acquisition of a competitor that is not yet public. The board is reviewing detailed information about the proposed acquisition, including the competitor’s identity, valuation and financing assumptions, management projections, negotiation status, diligence findings, and potential timing. The information is confidential and includes material nonpublic information about ABC and the proposed acquisition.

While riding in an Uber to the board meeting, Sam wants to use AI to test his thinking before the discussion. The company-approved AI platform is unavailable on his phone, so he uses a personal ChatGPT account instead. He enters detailed information about ABC and the proposed acquisition — including the competitor’s identity, valuation, financing, projections, diligence, negotiations, and timing — and asks ChatGPT to identify the principal risks, assess whether the proposed acquisition appears justified, and recommend how he should approach the discussion.

ChatGPT returns a confident but materially flawed analysis. It overlooks an important diligence concern, accepts a key transaction assumption without support, and gives Sam an overly reassuring conclusion about the proposed acquisition. Sam then quotes that conclusion during the board discussion without disclosing that it was AI-generated.

During the board meeting, the board is informed of an anonymous complaint submitted through ABC’s whistleblower hotline alleging a material misstatement in ABC’s last earnings release. The board’s discussion includes speculation about the facts and who may be responsible.  During the meeting, Sam utilizes an AI program to listen to the discussion and generate a summary after the meeting. After the meeting, Sam also uses ABC’s approved AI platform to generate an analysis of the relative strengths and weaknesses of ABC’s legal position based on the board’s discussion.

Sam may believe he acted efficiently and in ABC’s interests. His conduct nevertheless creates three distinct, overlapping risks. First, he disclosed confidential information about the proposed acquisition to a personal ChatGPT account outside ABC’s controls. Second, he allowed a materially flawed AI output to influence the board process without verifying its assumptions or reliability. Third, he created exposure by entering and generating sensitive information about legal risk into an AI Platform that will be discoverable in litigation and by regulators, including the Securities and Exchange Commission (SEC) and the Department of Justice (DOJ). The first risk implicates confidentiality, cybersecurity, and disclosure controls; the second implicates an informed and candid board process; and the third implicates privilege and discovery. The sections that follow address those risks in that order and then translate the lessons into policy and oversight rules.

III. Risks Created by Sam’s Conduct

1. Confidentiality and Disclosure Controls

Sam’s disclosure of detailed information about ABC’s proposed acquisition into a personal ChatGPT account was not merely an informal use of a device. It placed ABC’s confidential information outside the approved platform and may have exposed it to retention, human access, model training, subprocessors, or a security incident. That creates confidentiality, contractual, cybersecurity, and disclosure-controls risk. ABC should assess the incident under its disclosure controls and procedures, including Exchange Act Rules 13a-15(e) and 15d-15(e), and under its incident-response process.

Sam’s use of a Personal ChatGPT Account does not place the conduct outside ABC’s governance perimeter. ABC’s code of conduct, confidentiality procedures, disclosure controls, incident-response plan, and records policies should apply, regardless of whether Sam used a personal account, personal device, or consumer service. The resulting records should be handled under the same governance framework as other company communications.

2. The Board Process Must Remain Demonstrably Informed

Sam’s materially flawed output creates a separate board-process problem. The issue is not that AI assisted his preparation; it is that he quoted its reassuring conclusion without disclosure and did not test or verify the assumptions before allowing it to shape the discussion. Delaware law permits a director to rely in good faith on corporate records and information from appropriate sources when the statutory conditions of Section 141(e) are satisfied; an undisclosed, unverified consumer-AI output should not be treated as that kind of expert input. ABC may therefore have difficulty showing that Sam’s approach to the proposed acquisition was based on a reasonable understanding of its risks. AI Use Policies should require director disclosure to the board when AI materially influences a director’s questions, recommendation, risk assessment, or vote.

3. Privilege, Work Product, and Discovery

Sam’s later query in the Approved Platform regarding the whistleblower complaint may serve a legitimate business purpose, but it is not privileged merely because he utilized a platform that was approved to request a “legal analysis.” A prompt to an AI system is not a communication with counsel. Attorney-client privilege only applies to communications between a client and their attorney for the purpose of rendering legal advice, and work product protection only applies to material produced by attorneys, or at their direction, in anticipation of litigation. Neither of those protections apply when directors ask AI for a legal assessment of information learned in a board meeting.

Sam’s use of an AI program to summarize the meeting discussion is similarly problematic. Most AI programs that summarize meetings also record and retain a complete audio recording and written transcript of the meeting. In most cases, those materials will be fully discoverable to regulators and to litigants.

AI prompts, uploaded files, and generated outputs are fast becoming common subjects of discovery requests in litigation, collection plans in internal investigations, and DOJ and SEC subpoenas. Directors should assume that prompts and outputs may be discoverable regardless of whether they use the company’s Approved AI Platform and even when the use served a legitimate purpose. Once a duty to preserve this data arises, intentional destruction of any data can create spoliation or obstruction risk, including sanctions and, in appropriate circumstances, criminal exposure.

Directors should apply the same discipline to AI activity that they apply to email, text messages, board portals, and handwritten notes: use approved systems, preserve material communications, avoid personal accounts, do not destroy records after a hold, and assume that informal communications may be reviewed outside the context in which they were created. Practical safeguards include: (i) do not paste any sensitive legal information including legal advice, investigation material, or whistleblower allegations into any AI platform; and (ii) notify the general counsel or records custodian immediately if a prompt may be responsive to a hold, investigation, subpoena, Section 220 request, or regulatory inquiry.ns.

IV. Why Directors Need an AI-Use Policy

An AI-Use Policy fills a gap that enterprise controls cannot close. A company may have an AI governance program for employees and vendors, yet directors may use personal devices, personal email, consumer applications, or tools provided by another board. Sam’s use of a Personal ChatGPT Account because the Approved AI Platform was unavailable on his phone illustrates why directors need a clear rule for what to do when the approved tool is inconvenient or inaccessible.

An AI-Use Policy also gives the director a practical process for satisfying the duty of care. It helps distinguish low-risk assistance from high-risk use involving proposed acquisitions, litigation, investigations, whistleblower reports, financial reporting, or other sensitive board matters. This risk-based approach is consistent with the Department of Justice’s Evaluation of Corporate Compliance Programs, which asks whether compliance programs are adequately resourced, capable of monitoring emerging technology, and updated as risks change. National Institute of Standards and Technology (NIST) AI Risk Management Framework 1.0 can provide a voluntary framework for governing, mapping, measuring, and managing AI risk, but it does not replace legal advice or board judgment.

The policy should be specific enough to answer the questions that matter. At a minimum, it should tell the director:

• Permitted tools, accounts, and use cases.
• Information that must never be entered.
• When human review, disclosure, escalation, or counsel involvement is required.
• What AI records must be retained and how to respond to a hold or investigation.

V. What the Policy Should Include

Section III identifies the risks; the policy must convert them into operating rules. A director’s personal AI-use policy should apply whenever a director uses AI in connection with any company business including the board, a committee, a proposed transaction, an investigation, a shareholder matter, or preparation for a board discussion.

1. Scope and definitions. Define “AI,” “generative AI,” “Approved Platform,” “board information,” “material nonpublic information,” and “AI reliance.” Clarify that the policy covers prompts, uploaded files, outputs, browser extensions, plug-ins, mobile applications, transcription tools, meeting assistants, and AI features embedded in ordinary software.
2. Approved tools and accounts. Identify the Approved Platform and limit a director’s permitted use of AI for company business to the Approved Platform. Prohibit consumer tools and applications that route prompts through unknown third parties. If the Approved Platform is unavailable on a device, defer the task, use a secure approved alternative, or contact the designated support or legal contact; do not substitute a personal AI account.
3. Prohibited inputs. Unless expressly authorized on a platform reviewed and approved by counsel and security personnel, prohibit entry of any nonpublic business information including board books, draft minutes, financial results or forecasts, litigation strategy, legal advice, work product, personal data, trade secrets, customer information, source code, credentials, security architecture, and information subject to a confidentiality agreement
4. Confidentiality, disclosure, and data security. Prohibit any use that discloses or exposes material nonpublic information, confidential board materials, privileged communications, or personal data to an unauthorized recipient. State expressly that approval of the Approved Platform does not eliminate disclosure, preservation, discoverability, or production obligations.
5. Attorney-client privilege and work product. Require consultation with the general counsel before using AI to generate any type of legal assessment or uploading any investigation material, litigation strategy, whistleblower allegations, or material prepared at counsel’s direction. Use only a platform with terms and controls approved for the relevant use case and assume that any information provided to an AI platform, even company approved AI platforms, is not privileged and will be discoverable.
6. Disclosure of material AI reliance. Require disclosure when AI materially influences a director’s recommendation, risk assessment, or vote. Distinguish material reliance from low-risk uses, such as summarizing public information. Treat quoting an AI conclusion in a board discussion without identifying its source as a material process concern when it influenced the director’s position.
7. Prompt and output retention. Adopt a retention and deletion schedule that was reviewed and approved by counsel. Specify where records are stored, who may access them, how long they are retained, and how a director must respond to a litigation hold, investigation notice, subpoena, Section 220 demand, or regulatory inquiry.
8. Personal accounts, mobile access, and public settings. Prohibit use of personal AI accounts for confidential board work. If the Approved Platform is unavailable on a mobile device, wait, use a secure approved alternative, or seek assistance rather than use a personal AI account.
9. Prohibit the use of AI to transcribe or summarize board meetings. Prohibit all uses of AI programs to transcribe or summarize board or committee meetings. Require the immediate removal of any AI participant from board or committee meetings.   
10. Vendor terms and no-training commitments. Before approving a platform, confirm the vendor’s data-use, retention, deletion, model-training, subprocessors, location, security, audit, confidentiality, and breach-notification terms. Require a contractual commitment that board data and prompts will not be used to train or improve a generally available model without express authorization, and address ownership of inputs, outputs, logs, metadata, and derived data. Confirm how records can be preserved and produced if requested by regulators or litigants.
11. Escalation. Require prompt escalation to the general counsel, chief information security officer, or designated board contact if a director enters prohibited information, discovers unauthorized access, or learns that a vendor retained or disclosed data.
12. Training, certification, enforcement, and insurance. Require annual training and a written director acknowledgment or certification. State that violations may trigger remedial training, suspension of platform access, committee review, or other action consistent with the company’s governance documents. The board should also confirm that its Directors and Officers (D&O) insurance, indemnification arrangements, and notice procedures are understood; coverage should not be assumed for conduct involving unauthorized disclosure, spoliation, or intentional misconduct.

VI. Ongoing Oversight

The board or designated committee should review the AI-Use Policy periodically — at least annually, and sooner when AI tools, director use cases, or material risks change. The review should test whether the policy remains clear, practical, and current; identify provisions that need updating as technology, security practices, and regulatory developments evolve; and confirm that any vendor or platform review supports, rather than substitutes for, policy oversight.

VII. Practical Rules for Directors’ Use of AI

These rules are designed for the moment when a director is about to open a chatbot, upload a document, or rely on an AI-generated answer. They translate the policy into simple stop-and-check actions:

1. Use only the Approved AI Platform through a company-managed or board-approved account.
2. Never enter material nonpublic information into an unapproved tool; use the Approved Platform only when the policy permits its specific use.
3. Never use an AI program to transcribe and summarize board or committee meetings. 
4. Immediately remove any AI participants from meetings.
5. Do not enter nonpublic company information into personal AI accounts.
6. Do not use public Wi-Fi, rideshare settings, shared devices, or voice assistants for sensitive prompts.
7. Use AI to organize, compare, or generate questions — not to decide whether a risk is material or how you should vote.
8. Disclose material AI reliance to the board before discussion and before a vote.
9. Do not delegate director judgment to AI; independently verify every material analysis, assumption, and source before relying on it.
10. Ask the general counsel before using AI for legal advice or uploading legal materials to an AI platform.
11. Assume everything you type into a prompt and every document you upload can be discovered by regulators or in litigation.
12. Follow the company’s retention policy with respect to the retention of any AI inputs, including prompts and uploaded documents, and AI generated outputs.
13. If a hold or investigation begins, preserve the full AI record and follow counsel’s instructions; do not self-help or selectively preserve only the favorable output.
14. Complete the required certification annually and whenever the policy, Approved Platform, or board role changes materially.

The Department of Justice’s (DOJ) August 13, 2026, establishing enforcement priorities for the newly reconstituted National Fraud Enforcement Division (the Division) deserves close attention from tax departments, chief financial officers, and legal teams in every industry. The memorandum identifies “internal revenue” as one of five principal enforcement areas and signals that DOJ intends to deploy a broader, more technologically sophisticated set of tools to detect and prosecute tax fraud.

For companies in financial services, technology, manufacturing, retail, logistics, government contracting, nonprofits, and other sectors, the message is unmistakable: tax enforcement is no longer a standalone regulatory lane. DOJ is building an integrated model in which tax violations may be charged alongside procurement fraud, benefits fraud, customs evasion, sanctions violations, false statements, and other theories of corporate misconduct. The Government Accountability Office’s estimate of $233 billion to $521 billion in annual federal fraud losses¹ underscores the momentum behind this expansion.

The Tax Enforcement Signal

The memorandum’s treatment of internal revenue enforcement is notably specific. It identifies priority targets including schemes to conceal income, the filing of falsified returns, abusive promoters who market noncompliant tax strategies, and tax violations that accompany fraud against government programs or private victims.

The memorandum also states that the Fraud Division will foster intra-division and interagency coordination to “deploy the full arsenal of criminal tax tools.” Read in context, this signals a willingness to pair Fraud Division attorneys with fraud prosecutors and to coordinate with IRS Criminal Investigation, FinCEN, the Securities and Exchange Commission, and other agencies from the outset of investigations. Companies should treat routine IRS audits as a sheep in wolf’s clothing — be curious and be cautious. There could be much more behind the audit, where an audit combined with other activity (e.g., a single suspicious activity report) could more readily escalate into a multi-agency inquiry.

Data Analytics and Earlier Detection

A recurring theme throughout the memorandum is DOJ’s investment in advanced data-driven investigative techniques. The Division intends to leverage data analytics, financial forensics, and a National Fraud Detection Center to identify tax misconduct earlier and pursue tax offenders more efficiently. For companies, this has practical consequences: anomalies in payroll tax filings, deductions, information returns, transfer pricing structures, or third-party payment reporting could surface in government databases well before a formal examination begins.

The memorandum’s emphasis on “nationwide coordination” suggests that DOJ aims to connect data points across districts, enabling pattern recognition that would be invisible in a single-jurisdiction investigation. Companies operating in multiple states or across borders should anticipate that inconsistencies between federal and state filings, or between information returns and reported income, may be flagged through automated systems before any human investigator is assigned.

Overlapping Theories and Organizational Accountability

The memorandum explicitly references DOJ policies concerning the prosecution of organizations, including principles of voluntary self-disclosure, cooperation, and remediation. This language signals that DOJ could apply these frameworks to corporate tax offenses, not solely to traditional fraud matters. Where a company’s tax noncompliance is traceable to systemic failures, pressure from executives, or deliberate concealment, DOJ may view it as corporate misconduct warranting entity-level consequences.

Equally important, the memorandum’s structure makes clear that the five priority areas are not siloed. Tax violations tied to customs fraud, government contracting irregularities, payroll schemes, or sanctions evasion could be investigated under multiple theories simultaneously. A logistics company that understates customs duties and underreports the associated income, for example, could face both trade-enforcement and tax-enforcement scrutiny in a coordinated action. The memorandum encourages precisely this kind of cross-theory approach.

What This Means for Companies Across Industries

For companies and executives in any sector — from technology and financial services to retail, manufacturing, and government contracting — this memorandum counsels heightened vigilance. DOJ’s structural investments in data, coordination, and integrated theories of liability mean that tax compliance failures are more likely to be detected early, investigated aggressively, and charged in combination with other offenses. In light of these developments, companies should consider the following practical steps:

• Conduct an enterprise-wide tax fraud risk assessment. Tax compliance risk should not reside exclusively with the tax department. Legal, compliance, internal audit, finance, and operational leadership should coordinate to identify areas where a single set of facts — such as misclassified income, inflated deductions, or unreported foreign accounts — could create exposure under multiple enforcement theories
• Pressure-test tax and financial data for anomalies. If DOJ is investing in analytics, companies should do the same. This means examining payroll tax filings, information returns (Forms 1099, W-2, K-1), withholding obligations, transfer pricing documentation, and revenue-recognition practices for outliers, unexplained variances, and patterns that a government algorithm might flag. Understanding what the data shows before the government asks about it can meaningfully reduce exposure.
• Integrate tax counsel into internal investigations early — and protect privilege. When an internal investigation surfaces potential fraud, tax counsel should be engaged at the outset to assess whether the underlying conduct carries tax exposure, to preserve applicable privileges, and to advise on remediation options before positions harden or disclosures become compelled.

• Review third-party preparers, promoters, payroll providers, and information-reporting processes. The memorandum’s focus on “abusive promoters” and falsified returns extends liability beyond the taxpayer to the ecosystem of service providers. Companies should diligence their return preparers, payroll processors, and any outside advisors marketing aggressive strategies — and document that diligence.

• Prepare for overlapping criminal, civil, and regulatory theories — and preserve records accordingly. Companies should assume that a tax issue may be framed simultaneously as criminal tax fraud, civil fraud, a False Claims Act violation, or a regulatory infraction. Document-retention policies and litigation-hold protocols should reflect that a single inquiry could generate parallel proceedings with different burdens, timelines, and disclosure obligations.

• Evaluate remediation, cooperation, and voluntary self-disclosure carefully. The memorandum reiterates DOJ’s stated commitment to reward organizations that voluntarily self-disclose, cooperate, and remediate. Whether and how to self-disclose are intensely fact-specific decisions that depend on applicable DOJ and IRS policies, the nature and scope of the conduct, the evidentiary landscape, and the company’s overall legal posture. Companies should engage experienced counsel to evaluate these options deliberately rather than reactively.

Bottom Line

DOJ’s memorandum is more than a statement of priorities. It is a structural roadmap for a more aggressive, data-enabled, and cross-cutting tax enforcement regime. Companies that treat tax compliance as a narrow, back-office function may find themselves ill-prepared for an environment in which a tax anomaly can trigger a multi-agency investigation blending fraud, false-statement, trade, and corporate-misconduct theories. Proactive risk assessment, coordinated internal diligence, and early engagement of tax-controversy counsel are the most effective responses to this evolving enforcement landscape.

On September 18, 2026, the Department of Justice (DOJ) revisions to the Justice Manual aimed at “strengthening” False Claims Act (FCA) enforcement. For FCA defense practitioners, the announcement carries a distinct sense of déjà vu, as the revisions largely reinstate policies from the first Trump administration, most notably the November 2017 “Brand Memo” and the January 2018 “” — both under the Biden administration.

The revisions to the Justice Manual focus on two principal areas: (1) limiting the use of sub-regulatory guidance; and (2) reiterated qui tam dismissal authority.

Limiting Use of Sub-Regulatory Guidance. The first revision “reinstates and builds upon” the 2017 policy that sub-regulatory guidance cannot impose legal obligations beyond those established by statute or regulation. As Associate Attorney General Stanley Woodward stated, “[t]he Department of Justice should enforce the law, not make law through enforcement.” This directly echoes the Brand Memo’s core principle: defendants cannot be held liable under the FCA for violating guidance documents that lack the force of law. As with DOJ’s 2017 policy, the reinstated policy describes multiple contexts in which sub-regulatory guidance may still be used, including as evidence of scienter or a professional standard, or when a defendant made representations of compliance with the guidance.

Reiterated Qui Tam Dismissal Authority. The second revision clarifies DOJ “should consider exercising its dismissal authority when it declines to intervene in a qui tam action” and should “revisit that assessment as appropriate during litigation.” The emphasis is on dismissing qui tam actions that “lack legal or factual merit” and that “waste taxpayer resources and impose unjustified burdens on businesses.” This, too, is a re-issue of a DOJ pronouncement — including the same seven factors that in 2018 DOJ asserted could prompt the agency to act.

Why This Matters Across Industries

These revisions carry significant implications for any industry that operates within a landscape of extensive sub-regulatory guidance. Agencies across the federal government routinely issue guidance documents, manuals, FAQs, policy statements, and informal letters that, while technically non-binding, have effectively operated as de facto compliance standards for years.

Health Care. Health care providers and life sciences companies face perhaps the most complex guidance environment. Centers for Medicare and Medicaid Service’s (CMS) Medicare Benefit Policy Manual, National and Local Coverage Determinations, Office of Inspector General (OIG) advisory opinions, and Food and Drug Administration (FDA) guidance documents long have been cited in FCA enforcement actions. The revised Justice Manual acknowledges such documents may be used as “relevant evidence” of whether procedures were medically “reasonable and necessary” but critically emphasizes “such usage does not give these documents the force of law.” For health care organizations, this distinction could be the difference between defending a meritless claim and having it dismissed or addressed outside of court.

Government Contractors. Defense contractors and other companies doing business with the federal government operate under the Federal Acquisition Regulation (FAR) and also under layers of agency-specific guidance, contracting officer interpretations, and compliance manuals. FCA cases against government contractors frequently have relied on alleged violations of guidance-level requirements. Under the revised Justice Manual, enforcement must be grounded in binding legal or contractual obligations, not agency guidance alone. Contractors facing FCA exposure should assess whether claims against them rest on actual regulatory violations or merely on guidance.

Customs and International Trade. Importers face FCA exposure when the government alleges fraud in the importation process, including misclassification of goods, undervaluation, or false country-of-origin declarations. DOJ has authority to pursue civil remedies for importation fraud under 19 U.S.C. § 1592, and FCA claims have been asserted based on alleged violations of CBP guidance regarding product classification and origin declarations. The revised Justice Manual’s principle that enforcement must rest on binding legal requirements, not agency guidance, offers importers a potential defense when FCA claims rely on non-binding CBP interpretations rather than violations of statutes or regulations.

Higher Education. Colleges and universities receiving federal funds have faced FCA exposure based on alleged noncompliance with Department of Education guidance on issues ranging from Title IX implementation to financial aid administration. The revised Justice Manual’s distinction between binding legal requirements and agency interpretation offers institutions a stronger defense against claims based solely on guidance violations.

Practical Implications for FCA Defense & What Your Organization Can Do Now

Companies facing FCA exposure — or seeking to reduce future risk — should consider the following:

• Reassess pending FCA matters. If your company is defending against an FCA claim, evaluate whether the allegations rest on violations of binding legal requirements or merely on agency guidance. The revised Justice Manual provides strong grounds for early dismissal where relators or the government rely primarily on guidance documents rather than statutes, regulations, or contracts.
• Seek dismissal of meritless whistleblower suits. The Justice Manual now instructs DOJ attorneys to “assess whether the government’s interests are served by seeking dismissal” whenever DOJ declines to intervene in a qui tam case. If your company is facing a declined qui tam, there may be an opportunity to ask DOJ to dismiss, particularly where the claims lack legal or factual merit or duplicate prior government investigations.
• Audit your compliance posture. Distinguish between compliance with binding legal requirements and voluntary adherence to agency guidance. Understanding this distinction can help your organization allocate compliance resources appropriately and strengthen your position if questions arise.
• Monitor ongoing litigation. The Justice Manual provides that even where DOJ does not initially seek dismissal, it should “revisit that assessment as appropriate during litigation.” For companies in extended FCA disputes, this creates an ongoing opportunity to seek dismissal as weaknesses in relator cases become more apparent.

For businesses operating in guidance-intensive regulatory environments, these revisions represent a return to a framework that recognizes the difference between enforcing the law as written and enforcing agency guidance that was never subject to notice-and-comment rulemaking. If your organization is facing FCA exposure — or wants to understand how these changes affect your compliance posture — Â鶹ֱ˛Ą can help you navigate this shifting landscape.

Â鶹ֱ˛Ą is here to help you address the short- and long-term impacts in the wake of change. We have the resources to help you navigate these and other important legal considerations related to business operations and industry-specific issues. Please reach out to the authors, your Â鶹ֱ˛Ą relationship partner, or to our Government Enforcement Defense and Investigations Group with any questions.

Barred from Future Federal Loans. On September 14, 2026, Vice President JD Vance announced in Kansas City that the Trump administration will suspend roughly 870,000 individuals suspected of defrauding COVID-era small business loan programs — including the Paycheck Protection Program (PPP) and the Economic Injury Disaster Loan (EIDL) program — from receiving future federal loans. The Department of Justice (DOJ) echoed in its the Vice President’s remarks in touting its “Operation No Doze,” a coordinated criminal enforcement effort by DOJ and the Small Business Administration (SBA) targeting fraud in PPP and EIDL loans issued during COVID. SBA Administrator Kelly Loeffler stated the suspensions are tied to an estimated $39 billion in suspected fraud across 45 states and territories. Combined with earlier enforcement actions, total suspensions now cover borrowers connected to roughly $49 billion in alleged fraud nationwide.

500 Prosecutors Focused on COVID Fraud Investigations. Attorney General Todd Blanche confirmed that 500 prosecutors are now focused on pandemic fraud nationwide. The SBA’s inspector general has previously estimated that more than $200 billion distributed through the PPP and EIDL may show signs of fraud. Congress created the PPP in March 2020 to keep businesses afloat during the pandemic, ultimately backing roughly 11.8 million loans totaling about $800 billion. Congress extended the statute of limitations for PPP fraud investigations to 10 years, giving prosecutors until 2030–2031 to charge criminal PPP cases. Many of the DOJ’s investigations regarding PPP fraud are referred to DOJ by data miners or insiders. In addition to criminal enforcement, DOJ’s False Claims Act (FCA) prosecutors are actively investigating FCA cases involving PPP borrowers. 

How to reduce PPP criminal and FCA risk today. For many organizations, the issue now is post-program defensibility in a potential FCA or criminal investigation. This can include:

• Reconstruct the PPP file. Gather the original application, supporting payroll documents and spreadsheets, correspondence, key emails, and forgiveness submissions.
• Interview key personnel. Try to talk to the team that actually applied for the loan to understand the decisions made at the time. Try to memorialize the company’s evidence of intent to follow the rules. Talk to the lender as well, if possible.
• Stress-test eligibility. Revisit affiliation/size and eligibility rules as they applied at the time. See if the company was nonetheless eligible under a different theory such as the alternative size test.
• Verify expenditures. Trace the monies received from the SBA to ensure that the monies were spent appropriately and document such tracing analysis.
• Prepare. Companies often learn of a PPP FCA investigation when they receive a civil investigative demand (CID) from DOJ. Others learn when a relator serves them with a complaint after DOJ declined to intervene in the case. Take the issue seriously now and retain experienced FCA counsel; FCA penalties can be high. 
• Investigate the public record. If DOJ has declined to intervene in the case, a company can potentially convince a court to dismiss the case because the FCA’s public disclosure bar precludes a case that is based on certain public information. Public PPP data available from the SBA and business entity information easily sourced online may bar the case pursuant to 31 U.S.C. § 3730(e)(4)(A). “[T]he public disclosure bar prevents a relator from merely repackaging information enumerated in the public disclosure bar for personal profit by asserting an FCA claim.”
• Repay the SBA. If, after all analysis is completed, the company determines that the money was improperly obtained and improperly spent, consider returning the money to the SBA before DOJ sends the company a subpoena or a relator files a qui tam case underseal against the company. 

Â鶹ֱ˛Ąâ€™s team can assist in these efforts. 

As detailed in Part I of this risk-assessment self-check series, we are publishing a series of self-check assessment guides covering the key regulatory and contractual risk areas for multinational companies. This article provides Part IV, which is a self-check assessment for conducting an antiboycott self-check. Previous self-check risks assessments are found in Part I (general compliance), Part II (buy-side contracts review), Part III (sell-side contracts review), and Part IV (supply chain integrity compliance self-check).

Antiboycott compliance presents a specialized but important risk for multinational companies engaged in cross-border trade. Unlike many trade controls that focus on what a company ships or where it ships, antiboycott exposure often arises from what a company is asked to say, certify, or agree to in the course of ordinary business. Prohibited requests can appear in contracts, purchase orders, letters of credit, tender documents, shipping instructions, or routine customer questionnaires, and may require a company to refuse to do business with certain countries or parties, furnish boycott-related information, or make certifications about origin, ownership, or business relationships.

In practice, the vast majority of antiboycott compliance issues encountered by U.S. companies involve requests associated with the Arab League boycott of Israel. Since the 1970s, various Arab League member states have maintained a multilateral boycott targeting Israel, and participants in this boycott have required foreign companies to furnish certifications, negative origin statements, or other assurances as a condition of doing business in the region. These requests — which may appear in letters of credit, shipping documents, or contract clauses — remain the most commonly reported category of boycott-related activity under both the Export Administration Regulations administered by the Bureau of Industry and Security and the antiboycott provisions of the Internal Revenue Code enforced by the Office of Antiboycott Compliance within the Internal Revenue Service (IRS).

These risks are often overlooked because the underlying transaction may otherwise appear commercially routine. Enforcement authorities increasingly focus on whether companies have practical controls to identify, escalate, and respond to boycott-related requests before they are accepted or acted upon.

This self-test is designed to help companies assess whether they have a functioning, risk-aligned antiboycott compliance framework. It focuses on governance, risk assessment, contract and document review, training, escalation, and response mechanisms, with an emphasis on whether boycott-related controls are embedded in day-to-day business activity. A “no” answer does not automatically indicate a violation, but it may signal a program gap that warrants further review or compliance enhancement.

I.          Risk Assessment & Program Design

• Has your company conducted a documented antiboycott risk assessment tailored to its products, services, customers, and geographic footprint?
• Does the assessment consider relevant antiboycott risk factors, including: (1) business in or involving jurisdictions where boycott-related requests may be more common; (2) use of distributors, agents, freight forwarders, or other intermediaries; (3) customer contracts, tenders, purchase orders, and letters of credit; (4) requests for certifications relating to country of origin, vessel calls, ownership, nationality, or business relationships; and (5) business functions most likely to encounter boycott language, such as sales, contracting, shipping, finance, and customer service?
• Are antiboycott risks reassessed when the business changes, including: (1) entry into new markets; (2) expansion of distributor or channel relationships; (3) new customer segments or government-related business; or (4) changes in applicable law, guidance, or enforcement activity?

II.         Policies & Practical Guidance

• Does your company maintain clear, accessible antiboycott policies tailored to its business model and transaction flows?
• Do policies go beyond general prohibitions and provide practical guidance on: (1) identifying boycott-related requests; (2) reviewing contracts, letters of credit, and shipping documents; (3) escalating questionable language; (4) handling prohibited certifications or questionnaires; and (5) reporting obligations where applicable?
• Are policies reviewed and updated periodically to reflect changes in law, guidance, business practices, and transaction risk?

III.        Contracting, Documentation & Transaction Controls

• Are contracts, tenders, purchase orders, letters of credit, shipping instructions, and other transaction documents reviewed on a risk-based basis for boycott-related language?
• Are employees equipped to identify problematic requests involving: (1) agreements not to do business with certain countries or blacklisted parties; (2) certifications regarding business relationships with certain countries or persons; (3) requests to disclose ownership, management, nationality, religion, or similar information for boycott-related purposes; and (4) shipping or routing instructions designed to support a boycott?
• Are procedures in place to reject, strike, or revise prohibited boycott-related terms before the company proceeds with the transaction?
• Are boycott-related requests and their disposition documented and retained in accordance with company procedures and legal requirements?

IV.        Training & Awareness

• Is antiboycott training provided on a risk-based basis, with enhanced focus for sales, contract management, legal, trade compliance, logistics, finance, procurement, and customer-facing personnel?
• Does training include realistic scenarios relevant to your company’s operations (e.g., boycott clauses in purchase orders, problematic letter-of-credit terms, end-customer certifications, or routing instructions tied to restricted destinations)?
• Is training tracked and documented?

V.         Escalation, Reporting & Oversight

• Do employees know when antiboycott review is required and how to escalate suspect language or requests to compliance personnel, legal counsel, or senior management?
• Is there a defined process for reviewing boycott-related requests promptly so that business teams can address them before shipment, payment, or contract execution?
• Does your company have a process for identifying and meeting applicable antiboycott reporting obligations when reportable requests are received?
• Does the company periodically test or review whether antiboycott controls are functioning in practice, including through audits or spot checks of relevant documents and transactions?

VI.        Incident Response & Continuous Improvement

• Are potential antiboycott issues investigated promptly, with appropriate documentation of the request, response, business impact, and remediation?
• Are control failures, missed escalations, or improper responses addressed through corrective action, retraining, and process improvements?
• Are lessons learned from incidents, audits, business changes, or enforcement developments fed back into risk assessments, training, and program design?
• Does the company periodically evaluate whether its antiboycott compliance framework remains aligned with its current markets, customers, and transaction patterns?

If you would like help analyzing the results of your compliance self-check, please reach out to the authors or your Â鶹ֱ˛Ą relationship attorney.

Would you like more practical compliance tips like these? The Â鶹ֱ˛Ą International Trade & National Security Team is monitoring all international trade, enforcement, and compliance developments, which we post as they occur on our Tariff & International Trade Resources blog. for our email list to receive future emails and practical international regulatory compliance tips, including our weekly Tariff-ied! This Week in International Trade and What Every Multinational Should Know articles.

Our white paper on Managing Import and Tariff Risks During a Trade War outlines a 12-step plan to provide practical steps to help importers navigate the tariff and international trade risks in the current tariff and trade environment, while the companion white paper on Managing Supply Chain Integrity Risks provides practical advice to deal with heightened supply chain risks pertaining to goods imported into the United States, including the increasing use of detentions by Customs.

This month’s by the United States Department of Justice (DOJ) of another False Claims Act (FCA) settlement with a federal contractor offers further proof that the government continues to prioritize cybersecurity enforcement. According to DOJ’s press release, government contractor Honeywell Aerospace Inc. (Honeywell Aerospace) agreed to pay over $2 million to settle an FCA matter, which arose from allegations related to the company’s cybersecurity practices with respect to its Department of Defense contracts.

The Honeywell Settlement

Honeywell Aerospace is an Arizona-based company that provides aerospace products and solutions to government and commercial customers. A former IT employee filed a qui tam complaint after she was allegedly constructively discharged by the company for raising cybersecurity concerns related to the company’s contracts with the Department of Defense.

According to the complaint, pursuant to the contracts, Honeywell Aerospace provided the government with quantum computing services. Federal defense contractors like Honeywell Aerospace are required to implement certain cybersecurity controls outlined in the National Institute of Standards and Technology Special Publication 800-171 (). But, according to this lawsuit, Honeywell Aerospace failed to meet these requirements in connection with its work on the Quantum Contracts.

The complaint alleged myriad cybersecurity failings by Honeywell Aerospace with respect to the Quantum Contracts from April 2020 through December 2023, particularly as to the company’s treatment of controlled unclassified information (CUI) hosted on its “Gray Network,” an electronic network used for its work on the Quantum Contracts. The relator alleged that Honeywell Aerospace relied on a firewall to protect the Gray Network that was simply “a smokescreen to hide its inadequate security practices,” and that the company employed inadequate malicious code protection, access control, incident testing and response, and oversight of suspicious activity. Further, the complaint alleged that the company failed to report suspected cyber incidents or breaches as required by the Quantum Contracts and federal cybersecurity requirements.

Honeywell Aerospace did not admit these allegations but agreed to pay over $2 million to settle the claims, of which the qui tam relator will receive $375,823.

Implications of the Honeywell Aerospace Settlement

This settlement serves as a reminder that the government’s enforcement work on cybersecurity issues under the FCA is alive and well. As noted by Assistant Attorney General Brett A. Shumate of the Justice Department’s Civil Division in connection with the Honeywell Aerospace settlement: “The Justice Department will continue to investigate potential violations of these cybersecurity requirements to protect this critical information.”

This case fits a pattern of other recent cybersecurity FCA settlements that involve federal defense contractors whose contracts have contractual clauses requiring compliance with the NIST SP 800-171 requirements for handling CUI. Defining what constitutes CUI and mapping the boundaries of information systems that hold CUI is notoriously challenging. The threat of FCA enforcement raises the stakes for confronting that challenge even more. 

In addition, this also highlights the risk of FCA suits arising from insiders, as the FCA is a rare statute that allows private individuals to file suit on behalf of the United States. Just like multiple other recent cyber FCA settlements, the relator in this case was an IT employee of the company who allegedly had raised concerns about the company’s cybersecurity compliance.  

Recommendations

Government contractors and other recipients of federal funds should consider the following steps to enhance cybersecurity compliance and reduce FCA risk:

1. Catalogue and monitor compliance with all government-imposed cybersecurity standards. Ensure your organization has a comprehensive list of all cybersecurity requirements and covered systems in your organization. These requirements may come not only from prime government contracts but also subcontracts, grants, or other federal programs. This includes not only ongoing knowledge of the organization’s contracts but also diligently classifying the types of information the organization handles (such as CUI) and which systems process that information. This also includes continuously monitoring and assessing the organization’s cybersecurity program to identify and patch vulnerabilities and to assess compliance with those contractual cybersecurity standards. This assessment should also consider third-party relationships, including vendors and service providers.

• Develop and maintain a robust and effective compliance program that addresses cybersecurity issues. In many companies, the compliance program and information security functions are not well integrated. An effective compliance program will address cybersecurity concerns and encourage employees to report such concerns. When concerns are identified, it is critical to escalate and investigate them promptly — the allegations in the Honeywell Aerospace complaint serve as a cautionary tale highlighting the potential consequences of not effectively responding to employees’ concerns. And companies should take care to ensure that there is no retaliation against employees who report concerns in good faith. It may often be beneficial to involve counsel in the investigation of concerns as early intervention is key to assessing and minimizing risk.

• Where non-compliance with cybersecurity standards is identified, organizations should evaluate potential next steps. This includes whether to disclose the matter to the government and cooperate with government investigators. Organizations should work with experienced counsel in this regard. Proactively mapping out a strategy for investigating and responding to potential non-compliance can instill discipline to the process and streamline the organization’s approach. And a proactive approach may mitigate the impact of consequences down the line.

If you have questions about cybersecurity or the False Claims Act, reach out to the authors or your Â鶹ֱ˛Ą & Lardner attorney.