Privacy & Cybersecurity Law Blog

On February 19, 2026, the Organisation for Economic Co-operation and Development (the “OECD”) published new guidance aimed at supporting organizations in the implementation of the OECD Guidelines for Multinational Enterprises and the OECD AI Principles (the “Guidance”). The Guidance is designed to provide a structured, practical approach for organizations to manage AI-related risks and uphold responsible business conduct (“RBC”) in line with international standards.

The Guidance outlines the six-step “RBC due diligence framework,” which is a voluntary due diligence framework introduced in the OECD Guidelines for Multinational Enterprises, and provides practical tips on its implementation. The six-step framework includes:   

• embedding RBC into policies and management systems;
• identifying and assessing actual and potential adverse impacts;
• ceasing, preventing, and mitigating adverse impacts;
• tracking implementation and results;
• communicating actions to address impacts; and
• providing for or cooperating in remediation when appropriate.

The Guidance includes a roadmap at the beginning of each step that links related provisions from existing AI risk management frameworks, illustrating how the due diligence framework complements and relates to these standards. The list of related AI risk management frameworks references various examples, such as the ASEAN Guide on AI Governance and Ethics, the European Union AI Act, and the Korean AI Basic Act. Practical examples are provided to demonstrate ways to implement and adapt supporting measures and the due diligence process. These examples are not exhaustive and may not be suitable for every situation; organizations may identify additional useful measures depending on their circumstances.

The Guidance notes that by applying recommendations from existing AI risk management frameworks, organizations can fulfil many expectations of the RBC due diligence approach. According to the OECD, in some instances, the due diligence framework can offer additional clarity and address gaps in other frameworks, particularly regarding stakeholder engagement and remediation, which may not be comprehensively covered elsewhere.

Read the Guidance here. Read the press release here.