OECD publishes Due Diligence Guidance for Responsible AI

In February 2026, the Organisation for Economic Co-operation and Development (OECD) published its Due Diligence Guidance for Responsible AI. This guidance is designed for multinationals developing and using AI, implementing a framework that supports the OECD's responsible business conduct (RBC) and AI principles. However, it is also of broader use, providing examples of practical risk management implementation and ways to navigate risk management frameworks.

Purpose of the guidance

The guidance supports the implementation of two key OECD instruments:

• the OECD Guidelines for Multinational Enterprises on Responsible Business Conduct (the “MNE Guidelines”); and
• the OECD Recommendation on Artificial Intelligence (the “AI Principles”).

The MNE Guidelines require organisations to carry out risk‑based due diligence to identify and manage actual or potential adverse impacts, whether or not related to AI. While many national and international AI risk frameworks already exist, the OECD takes a broader “risk‑agnostic” approach. By not tying the guidance to specific metrics or categories, it can be applied across all enterprises and AI systems and remain relevant as research and regulation evolve.

The guidance is aimed at multinational organisations operating across the AI value chain, including those supplying inputs for AI development, participating in the AI system lifecycle, or using AI systems within their products and operations.

The OECD identifies four key objectives for the guidance:

• to support innovation, investment and growth by clarifying how enterprises can identify and address adverse impacts;
• to help enterprises navigate existing AI risk‑management and governance frameworks;
• to promote coherence and, where possible, interoperability between governance frameworks; and
• to serve as a common reference point for AI risk‑management frameworks across jurisdictions.

The Six‑Step Due Diligence Framework

Reflecting the structure of the MNE Guidelines, the OECD sets out a voluntary six‑step due diligence process:

1. Embed RBC into policies and management systems
2. Identify and assess actual and potential adverse impacts associated with the enterprise’s operations, products or services
3. Cease, prevent, and mitigate adverse impacts
4. Track implementation and results of due diligence activities
5. Communicate actions to address impact
6. Provide for or cooperate in remediation when appropriate.

These steps are intended to be undertaken simultaneously and continuously, forming part of an ongoing risk‑management cycle rather than a one‑off exercise.

The guidance is more detailed than we can cover in this short overview. It explains that it:

…lays out the RBC due diligence framework and practical implementation examples for enterprises involved in the development and use of AI systems. The due diligence framework presented in this guidance also features a roadmap of related provisions in existing frameworks at the beginning of each step indicating how each step of the due diligence framework is complemented by and relate to relevant provisions from related AI risk management frameworks.

For organisations looking at how to manage risks associated with AI, the guidance is one to consider alongside other methods for structuring responsible AI frameworks, to help understand what the right structure and approach is for them.

If you would like to discuss how current or future regulations impact what you do with AI, please contact Brian Wong, Tom Whittaker, Lucy Pegler, Martin Cook, Liz Smith or any other member in our Technology team.  For the latest on AI law and regulation, see our blog and newsletter.

This article was written by Zac Bourne and Sharon Osborne.

The guidance is: OECD (2026), OECD Due Diligence Guidance for Responsible AI, OECD Publishing, Paris, https://doi.org/10.1787/41671712-en.