A code of conduct is a written statement of the behavior and ethical standards an organization expects from its directors, officers, and employees. For privately held employers it is largely a management tool, but for publicly traded companies, federal securities law and stock exchange rules dictate that one exists, what it must cover, and when changes have to be disclosed. Federal labor law shapes what the document can say to every employer, public or private.
Is a Code of Conduct Legally Binding
Whether a code carries legal weight depends on how it is written and whether a court treats it as an implied employment contract. Without clear disclaimer language, employees have argued the code promised them specific protections, such as progressive discipline before termination, and courts in several states have been willing to treat handbook language as enforceable commitments. Most employers address this by placing a prominent disclaimer near the front of the document, and again on the acknowledgment form, stating that the code does not create a binding agreement and that employment remains at-will.
Federal labor law puts a separate limit on what the code can say. Section 7 of the National Labor Relations Act guarantees employees the right to engage in “concerted activities for the purpose of collective bargaining or other mutual aid or protection,” which includes talking with coworkers about wages and working conditions.1Office of the Law Revision Counsel. 29 USC 157 – Right of Employees as to Organization, Collective Bargaining, Etc A code written broadly enough to discourage those conversations can be struck down by the National Labor Relations Board.
The NLRB currently treats a workplace rule as presumptively unlawful if a reasonable employee who depends on the job could read it as restricting protected activity. Once a rule is flagged, the employer must show it is narrowly tailored to a legitimate business interest and that no less restrictive wording would work. Vague confidentiality clauses and blanket social media bans are the usual casualties. Every restriction in a code should be tied to a specific, defensible business reason rather than written as a blanket prohibition.
What Public Companies Are Required to Include
For publicly traded companies, a code of ethics is not optional. The Sarbanes-Oxley Act requires public companies to disclose whether they have adopted a code covering the principal executive officer, principal financial officer, and principal accounting officer, and to explain publicly if they have not.2eCFR. 17 CFR 229.406 – (Item 406) Code of Ethics The required code must promote honest and ethical conduct, accurate public disclosures, compliance with applicable laws, prompt internal reporting of violations, and accountability for following the code.
Stock exchanges layer their own obligations on top. Nasdaq Rule 5610 requires every listed company to adopt a code of conduct covering all directors, officers, and employees, make it publicly available, and include an enforcement mechanism. Any waiver granted to a director or executive officer must be approved by the board and disclosed within four business days, typically by filing a Form 8-K with the SEC.3Nasdaq Stock Market. Nasdaq Rule 5610 – Code of Conduct The NYSE imposes substantially similar requirements. Companies that fail these governance standards risk losing their listing.
The four-business-day clock for disclosing a waiver or amendment starts when the event occurs. If that date falls on a weekend or federal holiday, the count begins on the next business day.4U.S. Securities and Exchange Commission. Form 8-K – General Instructions Missing the deadline draws regulatory scrutiny well out of proportion to the waiver itself.
What a Code of Conduct Typically Covers
Conflicts of Interest and Gifts
A code should define when private interests conflict with professional duties: holding a financial stake in a competitor, hiring a family member, taking outside employment in the same industry. Most codes require employees to disclose potential conflicts in writing so the organization can evaluate them, rather than banning the underlying activity outright.
Gift policies set dollar limits on what employees can accept from vendors, clients, or anyone doing business with the organization. Thresholds vary. For reference, federal ethics rules cap gifts to government employees at $20 per occasion and $50 per year from any single source, and the gift cannot be cash or an investment interest.5eCFR. 5 CFR 2635.204 – Exceptions to the Prohibition for Acceptance of Certain Gifts Private-sector codes often set higher thresholds but follow the same logic: keep the value low enough that no reasonable person would see the gift as an attempt to influence a decision.
Anti-Bribery and the FCPA
Companies with any international exposure need explicit anti-bribery language. The Foreign Corrupt Practices Act makes it a crime to offer money or anything of value to a foreign government official to win or keep business.6Office of the Law Revision Counsel. 15 USC 78dd-1 – Prohibited Foreign Trade Practices by Issuers “Anything of value” is read broadly and can reach travel expenses, charitable donations made at an official’s request, or internships offered to an official’s relatives. A strong code gives concrete examples of what to watch for and lays out a pre-approval process for any spending that could touch a foreign official.
Harassment
Harassment provisions typically reference the standards under Title VII of the Civil Rights Act, which prohibits unwelcome conduct based on race, color, religion, sex, or national origin. Sexual harassment includes unwelcome advances, requests for favors, and other verbal or physical conduct that creates an intimidating or hostile work environment.7U.S. Equal Employment Opportunity Commission. Fact Sheet – Sexual Harassment Discrimination Effective codes go beyond listing protected characteristics and describe specific behaviors that cross the line, because most people who violate harassment policies do not think of their behavior as harassment until someone spells it out.
Confidentiality
Confidentiality provisions define what the organization treats as proprietary: technical data, customer lists, pricing models, unreleased product plans, and similar information that is not publicly available. A well-drafted section makes clear that these obligations survive the end of the employment relationship. Labeling information “confidential” is not enough on its own. The code should describe the categories specifically enough that an employee can distinguish protected information from general industry knowledge.
Social Media
Social media policies are one of the most common places where codes collide with federal labor law. Employees have the right under Section 7 to discuss working conditions, pay, and benefits with coworkers on social media, and those conversations are protected even when critical of the employer.8National Labor Relations Board. Social Media A blanket policy prohibiting “negative comments about the company” will not survive NLRB scrutiny.
Not everything posted online is protected, though. An employee who makes statements they know to be false, posts egregiously offensive content, or disparages company products without connecting the complaint to a workplace concern loses the shield of protected activity.8National Labor Relations Board. Social Media The drafting problem is writing a rule narrow enough to survive legal review while still protecting legitimate interests in reputation and confidentiality.
Generative AI
A growing number of codes now address how employees may use generative AI tools such as ChatGPT or Copilot. The core concern is data leakage: anything entered into a public AI tool may be stored, used for training, or surfaced to other users. These provisions typically prohibit uploading confidential business information, personal data about employees or customers, and material marked proprietary. They also require IT approval before any AI tool is integrated with internal systems. One rule of thumb some organizations include: treat every prompt as if it will become public, attributed to you and the company.
Reporting Channels and Whistleblower Protections
A code of conduct is only as good as the reporting infrastructure behind it. Employees who witness misconduct need a clear path to report it without fear of retaliation, and federal law backs that up with real teeth.
Internal Channels
Most organizations offer multiple options: a direct supervisor, an ethics hotline, an online portal, or a compliance officer. Anonymous reporting is standard. Codes that bury reporting instructions in an appendix or force complaints through the employee’s direct manager tend to suppress reporting rather than encourage it.
Federal Protections
The Sarbanes-Oxley Act prohibits publicly traded companies from retaliating against employees who report conduct they reasonably believe violates securities laws, SEC rules, or federal fraud statutes. Protected reports include complaints to federal regulators, members of Congress, or a supervisor inside the company. Retaliation covers firing, demotion, suspension, threats, and harassment.9Office of the Law Revision Counsel. 18 USC 1514A – Civil Action to Protect Against Retaliation in Fraud Cases
The Dodd-Frank Act adds a financial incentive. When a whistleblower’s original information leads to an SEC enforcement action with sanctions above $1 million, the whistleblower is entitled to an award of 10 to 30 percent of the money collected.10Office of the Law Revision Counsel. 15 USC 78u-6 – Securities Whistleblower Incentives and Protection Dodd-Frank also prohibits retaliation and allows anonymous filings. In fiscal year 2025, the SEC paid out more than $170 million to whistleblowers.11U.S. Securities and Exchange Commission. Annual Report to Congress – Whistleblower Program, FY 2025
A code cannot include language that effectively waives these protections. Clauses requiring employees to exhaust internal reporting before contacting a regulator, or confidentiality terms that penalize employees for cooperating with government investigations, can violate federal law. The SEC has specifically targeted companies whose codes or separation agreements contained language that could discourage whistleblower reporting.
Deadlines for Retaliation Claims
Employees who experience retaliation face strict filing windows. OSHA handles complaints under various whistleblower statutes, and the deadline ranges from 30 to 180 days from the date of the retaliatory action, depending on which law applies.12Occupational Safety and Health Administration. OSHA Online Whistleblower Complaint Form Under Dodd-Frank’s anti-retaliation provision, the outer limit is six years from the violation or three years from when the employee knew or should have known about it, capped at ten years.10Office of the Law Revision Counsel. 15 USC 78u-6 – Securities Whistleblower Incentives and Protection Missing these deadlines can forfeit the claim entirely.
Acknowledgment, Investigation, and Discipline
Writing the code is the easier half. The harder part is making sure every person in the organization has read it, understood it, and formally acknowledged it. New employees typically review the code during onboarding and sign an acknowledgment before their first day ends. A signed acknowledgment, whether electronic or on paper, creates a record that the employee received the code and agreed to follow it, and that record becomes evidence if the organization later needs to defend a discipline decision.
When a report comes in, the organization assigns an investigator to gather evidence: emails and digital communications, financial records, witness interviews, and an interview with the person accused. The subject should be given an opportunity to respond before any decision is made.
Union-represented employees in the private sector have an additional right during investigatory interviews. Under Weingarten rights, if an employee reasonably believes an interview could lead to discipline, they can request that a union representative be present. The employer is not required to remind the employee of this right, but continuing to question someone who has asked for a representative and been denied one is an unfair labor practice under the NLRA.1Office of the Law Revision Counsel. 29 USC 157 – Right of Employees as to Organization, Collective Bargaining, Etc Non-union employees do not have this right, a distinction many employers miss when writing their investigation procedures.
Most codes follow a progressive discipline model: verbal warning, written warning, unpaid suspension, termination. The tiers, and the flexibility to skip steps for serious misconduct, should be spelled out. Vagueness invites inconsistent enforcement, which invites discrimination claims when two employees who committed similar violations receive different punishments. Every step of the investigation and every disciplinary action should be documented in writing and kept in the employee’s file. If the organization cannot produce a paper trail showing it followed its own procedures, the code becomes a liability rather than a shield.
Codes also need periodic review. There is no mandated cycle, but annual reviews tied to the fiscal year are common, with off-cycle updates triggered by new legislation, a significant internal incident, expansion into a new country, or the arrival of new technology like generative AI. Every revision should be re-communicated and re-acknowledged through the same process used for the original.