Whistleblower program compliance
Whistleblower program compliance in the Technology, AI and Competition sector is under active scrutiny from multiple directions, with the U.S. Securities and Exchange Commission's whistleblower program imposing specific requirements on how firms handle internal reporting channels, and the U.S. Department of Justice's Corporate Enforcement Policy creating direct incentives for companies to self-disclose before a whistleblower beats them to it. The European Commission's Whistleblower Protection Directive, now transposed across EU member states, extends mandatory internal reporting obligations to technology firms operating in Europe, including those handling AI systems flagged as high-risk under the EU AI Act. Compliance teams at technology companies are currently auditing their internal reporting procedures against these overlapping regimes, particularly where antitrust conduct, algorithmic decision-making, and data handling create novel disclosure questions.
Watch
- DOJ Corporate Enforcement Policy: self-disclosure credit vs. whistleblower filing timing
- EU Whistleblower Protection Directive national transposition gaps still unresolved in several member states
- SEC Rule 21F-17: enforcement pattern targeting NDAs that chill protected reporting
- AI Act Article 87 whistleblower protections for reporting non-compliant high-risk AI systems
- FTC noncompete rule interaction with whistleblower retaliation claims in tech workforce disputes
Recent material activity in Technology, AI & Competition
A selection of recent published briefs; this is not a complete archive.
US CISA Cybersecurity release pending Cresthaven Analytics full analysis: KEV addition: CVE-2026-87902 — WordPress Core (WordPress Core Remote File Inclusion Vulnerability)
US CISA Cybersecurity published a regulatory release titled 'KEV addition: CVE-2026-87902 — WordPress Core (WordPress Core Remote File Inclusion Vulnerability)'. Cresthaven Analytics' full intelligence brief is pending r…
Read a full sample brief →CISA adds Microsoft SharePoint code injection flaw to Known Exploited Vulnerabilities catalog with federal remediation deadline of September 28 2026
CISA added CVE-2026-65660, a code injection vulnerability in Microsoft SharePoint, to its Known Exploited Vulnerabilities catalog on September 25, 2026. The addition triggers mandatory remediation obligations for federal…
Read a full sample brief →CISA adds MikroTik RouterOS behavioral-workflow vulnerability to Known Exploited Vulnerabilities catalog with federal remediation deadline of September 28 2026
CISA added CVE-2026-67279, an improper enforcement of behavioral workflow vulnerability in MikroTik RouterOS, to its Known Exploited Vulnerabilities catalog on September 25, 2026. The vulnerability permits an unauthentic…
Read a full sample brief →Canada Competition Bureau release pending Cresthaven Analytics full analysis: Competition Bureau to publish a call for information on pricing rules in retail grocery
Canada Competition Bureau published a regulatory release titled 'Competition Bureau to publish a call for information on pricing rules in retail grocery'. Cresthaven Analytics' full intelligence brief is pending re-analy…
Read a full sample brief →UK CMA Competition release pending Cresthaven Analytics full analysis: Macquarie Asset Management / Energy Assets Group merger inquiry
UK CMA Competition published a regulatory release titled 'Macquarie Asset Management / Energy Assets Group merger inquiry'. Cresthaven Analytics' full intelligence brief is pending re-analysis; see the source link below …
Read a full sample brief →CMA publishes interim market study update on early years education and childcare services in England
The CMA published a market study update on September 25, 2026, covering evidence gathered since the study launched on July 1, 2026. The update sets out findings to date and signals how the CMA's analytical thinking is de…
Read a full sample brief →China's SAMR publishes antitrust penalty decisions against two Chongqing municipal gas distributors for cartel conduct
The State Administration for Market Regulation published administrative penalty decisions by the Chongqing Municipal Market Supervision and Administration Bureau against two piped-gas enterprises in Jiangjin District. Th…
Read a full sample brief →China's SAMR publishes five administrative penalty decisions against Tibet concrete firms for cartel conduct
The Tibet Autonomous Region Market Supervision and Administration Bureau concluded a monopoly-agreement investigation against five concrete enterprises, including Linzhi Lantian Concrete Co. Ltd. The investigation opened…
Read a full sample brief →CISA adds Adobe Commerce and Magento authorization flaw to Known Exploited Vulnerabilities catalog with federal remediation deadline of September 27 2026
CISA added CVE-2026-71362, an incorrect authorization vulnerability in Adobe Commerce and Magento, to its Known Exploited Vulnerabilities catalog on September 24, 2026. The vulnerability allows unauthenticated privilege …
Read a full sample brief →CISA adds WSO2 path traversal vulnerability to Known Exploited Vulnerabilities catalog with federal remediation deadline of September 27, 2026
CISA added CVE-2026-5430 to its Known Exploited Vulnerabilities catalog on September 24, 2026. The vulnerability is a path traversal flaw affecting WSO2 API Control Plane, API Manager, Traffic Manager, and Universal Gate…
Read a full sample brief →