In the following guest post, Ed Whitworth, the Head of Financial Lines at Inigo, Millie Refalo, Senior Underwriter at Inigo, and Yera Patel, Head of Casualty & Financial Lines Claims and Analytics at Inigo, summarize the results of a recent survey Inigo conducted of U.S. securities litigation defense counsel. The original of the survey summary previously was published on Inigo’s blog, here. We would like to thank Ed, Millie, Yera, and Inigo for allowing us to publish the report summary on this site.

********************

Inigo are excited to publish the findings from our 2026 Defense Counsel Survey.

This is the fifth iteration of the US Securities Litigation review, asking the top US Securities Defense Attorneys for their opinions on the hot topics right now. We cover some familiar subjects, whilst exploring some new and emerging trends.

In this year’s survey we ask if this is one of the hardest times in history to run a public company, whether Securities Class Actions are likely to rise and the possible consequences of deregulation. We also look at the future of AI litigation and the impact of the SB21 reforms in Delaware. The chapters are as follows:

How hard is it to run a public company today?

Securities class actions – Will uncertainty drive more filings?

Federal deregulation – Help or hindrance?

AI litigation – the new normal?

Delaware – Has SB21 helped?

We asked our survey respondents 49 questions, augmented by interviews and follow-ups, with fast-paced developments in Federal regulation and Securities filings to keep on top of. We highlight some of the key findings here but as ever, much more detail can be found in the survey.

Tough challenges for public companies likely to lead to more securities class actions, Inigo survey finds

Global turbulence, seesawing stocks and AI are keeping CEOs up at night, according to the Inigo Defense Counsel Survey 2026. Two-thirds of our respondents believe it is harder to run a company today than it was only a couple of years ago. The price of getting it wrong is being hit with a securities class action lawsuit.

Defense counsel told us they are fielding more calls than ever from worried executives asking their advice on what to say in earnings statements because they’re finding it so difficult to accurately predict their companies’ earnings in such a volatile climate. CEOs now, more than ever, risk being punished if they’re either too optimistic or pessimistic in their forecasts.

Making IPOs great again?

More respondents expect the number of securities class actions to be higher over the next 12 months than in the previous period, despite President Trump’s stated aim to make CEOs’ lives easier.

Under him, the SEC has proposed dropping quarterly and ESG reporting requirements, among other efforts at cutting red tape, while the regulator is now focused on making it more attractive to be a public company. It has also dropped dozens of actions and investigations against crypto firms, with the new SEC head Paul Atkins stating the regulator will now concentrate on protecting investors and safeguarding markets, rather than regulation through enforcement.

But relaxing reporting requirements is likely to create a gray zone, in which the regulators require companies to provide less information while analysts and investors want them to be as transparent as they were before, if not more. Several companies have already been sued by stockholders for skipping votes on ESG policy issues.

President Trump’s trade and physical wars have also given CEOs headaches, not least by sending their stocks on a rollercoaster ride. Market turbulence tends to trigger more securities class actions, while settlement values may rise because plaintiff’s attorneys and now institutional investors are becoming more aggressive, our survey found.

Mandatory arbitrations unlikely to lead to lower payouts

The SEC’s landmark decision to drop its decades-long opposition to companies about to float opting for mandatory arbitration provisions was also a topic of debate. Although champions of the move argue arbitrations will lead to public companies saving money through lower payouts and litigation costs, the defense counsel we surveyed aren’t convinced. A majority believe companies will not spend less in legal costs if they opt for arbitrations – and may even spend more; they were also evenly split over whether settlement values would come down.

Fears over federal judges being increasingly political are overblown, at least in the corporate law realm, defense counsel told us. Most said it was the quality of the brief that would be the decisive factor in whether a judge would grant a motion to dismiss in a case, while their experience and know-how mattered more than their political leanings. But we did gather anecdotal evidence that some circuits are regarded as being more challenging to defend actions in than others.

AI – threats and opportunities abound

The number of securities class actions citing issues related to AI have risen steadily in recent years and we predict they are set to grow further over the next 12 months. Two-thirds of respondents told us it was still useful to track AI cases as a separate category because the underlying facts in these actions are different from other litigation. Most thought that AI washing allegations will form the biggest number of class actions this year, followed by missed guidance due to AI disrupting their business. But a vocal, albeit small, minority believe that more companies will be held to account by their investors for heavy AI investment that didn’t lead to the sales boom promised by their leaders. “Mark my words, the AI infrastructure boom is the next Railway Mania” one attorney we surveyed told us. If the AI boom fails, the plaintiff’s bar will be waiting.

The Dexit hype has failed to materialise, with only a small number of companies moving their headquarters to other states. The sweeping reforms to Delaware’s corporate law contained in SB21 have helped companies, by reducing the scope, and therefore the cost, of books and records discovery requests – a bug bear for many companies – defense counsel told us. But the state’s Chancery Court judges are viewed to be politically polarised, if not overtly friendly to plaintiffs. The erosion of the Caremark ruling has made it easier to file derivative suits against companies in the state, which will be harder for companies to defend, our survey found.

For further insights, predictions, and the complete findings from our interviews with top US securities practitioners, read the full Defense Counsel Survey here .

A newly filed securities class action lawsuit against AI computing company Blaize Holdings is an example of how a lawsuit involving an AI company may have little or nothing to do with artificial intelligence.

The lawsuit filed against Blaize on August 4, 2026, in the Central District of California, alleges that the company misled investors about major customer contracts, improperly recognized revenue, and created a false impression of growth (Blaize SCA). While Blaize markets itself as an edge AI infrastructure company, the allegations reflect a traditional securities fraud theory rather than claims involving AI governance, AI safety, or AI-related regulation.

As discussed below, the case offers a classic securities fraud fact pattern and may offer important takeaways for D&O underwriters of AI companies.

A copy of the complaint can be found here.

The Blaize SCA

Blaize describes itself as a provider of programmable, energy-efficient edge AI computing solutions, with products designed to support computer vision, multimodal AI, and other AI inference workloads across industries including smart cities, industrial automation, telecommunications, logistics, retail, and defense. Its shares trade on Nasdaq under the symbol BZAI.

The Blaize SCA names Blaize Holdings, CEO and co-founder Dinakar Munagala, and CFO Harminder Sehmi as defendants and is filed on behalf of investors who purchased the company’s securities between July 18, 2025 and April 28, 2026. The complaint centers on Blaize’s public statements concerning two purportedly significant business relationships.

First, the complaint challenges the company’s July 2025 announcement of a collaboration with Starshine Computing Power Technology Limited, which Blaize described as carrying a minimum revenue value of $120 million over an 18-month period. According to the complaint, Starshine lacked meaningful business operations and did not appear to have proprietary products supporting the scope of the announced arrangement.

Shareholder plaintiffs also question Blaize’s statements regarding NeoTensr. In April 2026, the company announced a contract expected to generate up to $50 million in revenue and stated that it had already recognized more than $20 million in revenue from a NeoTensr order in the fourth quarter of 2025. According to the complaint, NeoTensr was a newly formed company with limited capital and insufficient resources to support transactions of that magnitude, calling into question Blaize’s revenue projections and reported revenue recognition. The complaint further alleges that NeoTensr and Starshine displayed rebranded third-party products on their websites and that Blaize similarly overstated its technological capabilities.

According to the plaintiffs, the truth was revealed on April 28, 2026, when short seller Pelican Way Research published a report questioning the legitimacy of the NeoTensr relationship. The report asserted that NeoTensr’s website had been registered only months before the announced transaction, that the company had limited capital, and that it lacked the apparent resources to support a purported $20 million transaction shortly after its formation. The report also claimed that products displayed on NeoTensr’s website appeared to be third-party products rebranded with NeoTensr and Blaize logos and drew parallels to Blaize’s previously announced Starshine arrangement.

Plaintiffs allege that immediately following publication of the Pelican Way report, Blaize’s share price declined 12.03%, falling from $2.16 to $1.90 per share. The Blaize SCA alleges violations of Sections 10(b) and 20(a) of the Securities Exchange Act of 1934 and SEC Rule 10b-5 against the company and certain of its senior executives.

Discussion

At first glance, the Blaize securities class action might appear to be part of the growing wave of AI-related securities litigation involving companies such as Tempus AI and Innodata. However, unlike those cases, the Blaize complaint does not allege that the company engaged in “AI washing,” overstated the capabilities of its AI technology, failed to disclose AI-related risks, or misled investors about AI governance or regulation. Nevertheless, because the allegations arise from the company’s AI-focused business and operations, the suit can fairly be characterized as AI-related securities litigation, bringing the total number of such actions filed in 2026 to 18.

Instead, the complaint advances a much more traditional securities fraud theory. The plaintiff alleges that Blaize created a misleading impression of growth through transactions with counterparties that allegedly lacked the operational capacity and financial resources to support the reported business opportunities, while also improperly recognizing related revenue. In that sense, the lawsuit arguably fits within the category of AI-adjacent securities litigation. Although Blaize operates in the AI sector, the allegations do not concern the company’s AI capabilities, AI governance, or AI-related disclosures. Rather, they involve familiar securities litigation issues relating to customers, revenue recognition, and growth projections.

Nevertheless, the case remains noteworthy because it illustrates how investor enthusiasm for artificial intelligence can amplify disclosure risk. According to the complaint, the challenged transactions helped support a narrative of rapid growth in the AI infrastructure market. When questions later arose regarding those transactions, the resulting scrutiny from investors, analysts, short sellers, and plaintiffs’ lawyers was heightened by the market’s intense focus on AI-related companies.

The Blaize securities class action may also offer lessons for D&O underwriters of AI companies. One important takeaway is that evaluating AI-related risk involves more than assessing a company’s technology, AI capabilities, or AI-related disclosures. Traditional underwriting considerations, including the quality of key customers and business partners, the financial strength of counterparties, revenue-recognition practices, the collectability of receivables, and the sustainability of reported growth, remain critical. Notably, the allegations in the Blaize complaint focus almost entirely on these traditional business and financial reporting issues rather than on any alleged shortcomings in the company’s AI technology itself.

Ultimately, the Blaize SCA underscores an important point about the evolution of AI-related securities litigation. Although the company operates in the AI sector, the allegations involve customer, revenue-recognition, and disclosure issues that long predate the current AI boom. The case also serves as a reminder that, even for AI companies, traditional D&O underwriting fundamentals can be just as important as the underlying technology.

For many years, cybersecurity-related issues have been recognized as a potential source of D&O claims and liability. More recently, other D&O claims concerns, including artificial intelligence (AI), geopolitical issues, and even market manipulation allegations, have become more conspicuous, and cybersecurity-related issues have been less prominent. However, a securities suit filed earlier this month against Israeli-based web data collection company Alarum Technologies highlights that cybersecurity-related issues remain an important potential source of D&O claims and also shows how cybersecurity-related concerns continue to evolve. A copy of the August 5, 2026, complaint against Alarum can be found here.

Background

Alarum is a web data collection services provider. The company’s American Depositary Shares (ADSs) trade on Nasdaq. The company operates a subsidiary called NetNut that manages a web data collection service. The complaint alleges that during the class period, Alarum detailed NetNut’s and Alarum’s “competitive advantages,” including, among other things, the security and safety of the company’s services.

On July 2, 2026, Reuters published an article entitled “Google disrupts NetNut proxy network used in malware operations,” (here), which stated, among other things, that Google had weakened a network of internet-connected devices being used to conceal and route malicious online traffic, acting against the NetNut residential proxy operator.” The article stated that the proxy networks were being used to mask the origin of the traffic and to bypass security defenses, in a way that is “frequently exploited for cybercrime.” 

Another media story published the same day, entitled “FBI Probes whether Alarum Unit is Behind Co-Opted Home Devices,” stated that for more than a year, the FBI had been investigating whether the NetNut unit’s network “had a role in linking customers’ home internet devices without their consent into a network that people can use to disguise their locations.” The article quoted one commentator as saying that “most users may not even notice the uninvited proxy internet squatters until the police come to their door investigating cybercrime coming from the home.”

In response to these reports, the company paused traffic through the relevant networks, in a way that significantly reduced the company’s services and that the company said was likely to have a material adverse impact on the company’s operations and financial results. According to the securities complaint, the price of the company’s ADSs declined by more than half on this news.

The Lawsuit   

On August 5, 2026, a plaintiff shareholder filed a securities class action lawsuit in the District of New Jersey against Alarum and certain of its executives. The complaint purports to be filed on behalf of a class of investors who purchased the company’s securities between March 20, 2025, and July 2, 2026.

The complaint alleges that during the class period, the defendants made false or misleading statements or failed to disclose that: “(1) an Alarum Technologies subsidiary, NetNut, was engaging in illegal activity by linking customer home internet devices into another network without the customer’s consent; (2) this activity allows cyber criminals to conceal their locations; (3) the foregoing materially highlighted Alarum Technologies’ legal exposure and materially threatened its business prospects; and (4) as a result, Defendants’ statements about Alarum Technologies’ business, operations, and prospects were materially false and misleading and/or lacked a reasonable basis at all times.”

The complaint alleges that the defendants violated Sections 10(b) and 20(a) of the Securities Exchange Act of 1934 and Rule 10b-5 thereunder. The complaint seeks to recover damages on behalf of the class.

Discussion

As I noted at the outset, this new lawsuit is a reminder that cybersecurity-related issues remain an important potential source of D&O claims and liability. At the same time, however, this new lawsuit is quite a bit different from the kind of cybersecurity lawsuits filed in the past.

The typical allegations in prior cybersecurity-related securities suits would involve allegations that a bad actor had, unknown to the defendant company, infiltrated the company’s networks and systems, and accessed private or confidential data. This new complaint alleges that the company’s own allegedly improper actions created an environment that facilitated misuse of the company’s proxy networks in a way that allowed third parties to mask their locations and potentially engage in cybercrime. The new lawsuit is, however, similar to prior suits in at least one way, in that it involves allegations that cybersecurity vulnerabilities facilitated the activities of third-party bad actors.

The lawsuit has only just been filed, and it remains to be seen how it will fare. It is worth noting that the complaint quotes extensively from the company’s risk factor disclosures, in which the company repeatedly emphasized that the company’s operations and financial performance would suffer if the company were to experience network security issues or regulatory concerns. It also seems plausible that the company was as blindsided by the apparent misuse of its proxy network as anyone was, which would certainly undermine the plaintiffs’ allegations that the company acted with scienter to mislead investors.

In any event, this new complaint is a reminder that, even amidst ongoing discussion of the current securities litigation hot topics such as AI and geopolitics, cybersecurity issues remain an important potential source of D&O liability and claims.

Congratulations to Sarah Abrams: Congratulations to Sarah Abrams for the publication on August 18, 2026 of her article “Dropbox and the Evolving Governance Debate Over Corporate Domicile” on the Harvard Law School Forum on Corporate Governance. Sarah was invited to submit her article to the Harvard site after she first published a version of the article on The D&O Diary. Well done, Sarah.

In the following guest post, Vijay Jyotish, who writes on forecasting and decision-making under uncertainty, argues that launch-day decisions for self-insured space missions can expose companies to hundreds of millions of dollars in risk, yet often bypass board-level oversight because they are treated as engineering decisions rather than enterprise risks. The author contends that evolving Delaware case law increasingly requires boards to have documented systems for monitoring mission-critical risks, and recommends a process for recording and reviewing launch-day risk assessments before each launch. Our thanks to Vijay for allowing us to publish his article on this site. Here is Vijay’s article.

*********************************

Somewhere in the next few weeks, an American company will make a multi-hundred-million-dollar decision in about thirty seconds, and no board committee will ever see a record of it.

The decision is the launch decision — not whether to build the satellite, buy the rocket, or sign the insurance binder, all of which boards see, but whether to fly on that particular day. In the American space economy that decision is made inside an engineering poll, documented (if at all) in ephemeral operational records, and treated by every layer of governance above it as a technical fact rather than a governable risk. Meanwhile the exposure riding on it has become one of the largest routinely unexamined line items in the market: a review of two dozen recent launches (2023–2026, across five launch organizations) finds the missions carried roughly $6.2 billion of publicly documented cost — NASA OIG, GAO, and SEC figures — with exactly one commercially insured asset among them, a $30 million policy.

This post makes three claims. First, launch-day risk systematically escapes the oversight structures boards already run, for reasons that are structural rather than negligent. Second, under the Caremark line of cases as sharpened by Marchand and applied in Boeing, that escape is becoming legally untenable for space-exposed companies: a substantially self-insured launch book is close to a textbook example of “mission-critical” risk for which directors are expected to demand a board-level information system. Third — and this is the constructive point — a documented, board-legible launch-day risk process is neither hypothetical nor expensive; its elements can be specified in a page, and a working example already exists in public. The post closes with five questions an audit committee of any space-exposed company can ask at its next meeting.

I. How a $6.2 billion exposure escapes four oversight systems at once

Boards of space-exposed companies are not inattentive. The same companies that fly self-insured missions run sophisticated enterprise-risk programs, audit committees with published charters, cyber oversight that would satisfy any proxy advisor, and disclosure-committee machinery tuned to the last comma. Launch-day risk slips past all four, through four distinct mechanisms.

1. It is classified as an engineering fact, not an enterprise risk. The go/no-go decision belongs to a launch director and a poll of subsystem leads. That is as it should be — nobody wants a board flying rockets. But classification drives paperwork: engineering decisions generate engineering records (telemetry, anomaly reports, readiness reviews), not risk records. There is typically no document, created before the window, that states in plain language what risk the enterprise believed it was accepting by flying that day rather than another — the one document a board, a regulator, or a plaintiff’s lawyer would later ask for.

2. Self-insurance removes the only external institution that prices the day. When a mission is commercially insured, an underwriter interrogates the risk, charges a premium that moves with the vehicle’s record, and creates a paper trail: submission, slip, premium, claim. When a company self-insures — as the largest launch operator does for its own vehicle risk, and as the U.S. government does for its payloads as standing practice — every one of those disciplines disappears. Self-insurance is not merely a choice about risk transfer; it is the silent dismissal of the one third party whose job was to write the risk down. A self-insured launch book is an underwriter that charges itself zero and files no reports.

3. Reliability statistics average over years, while the exposure is per-day. The standard governance artifact for launch risk — a vehicle reliability percentage — answers the wrong question. A 99%-reliable vehicle at the cadence the U.S. Space Force itself projects (up to 3,000 launches per year by 2036, per its Objective Force Design 2040 planning, as reported by Defense One) is a vehicle that fails roughly thirty times a year. At rate, failure is not an event; it is a line item. Boards govern line items with processes, not with percentages.

4. The costs of caution are invisible while the costs of loss are episodic. Scrubs and slips carry real money — schedule penalties, standing-army costs, and, for insured missions, a named actuarial problem: premium and reserves misaligned by delay. But slip costs dissolve into operations while losses arrive as discrete catastrophes. An oversight system that never sees the price of not flying cannot evaluate the decision to fly; it only ever audits the disasters.

The result is a governance inversion that would be unthinkable in any other risk domain: the single most value-dense hour in the company’s year — the hour when the entire asset either reaches orbit or does not — is the hour with the thinnest board-legible record. Exhibit 1 assembles recent, publicly documented outcomes. The pattern to notice is not the losses; it is the two right-hand columns. Where a third party priced the risk, a record exists. Where no one did, the record is whatever the post-incident investigation reconstructs.

Exhibit 1 · What recent bad days cost — and who had priced the risk. Context: 2023 produced roughly $1.4B of space-insurance claims against ~$0.55B of premium, the market’s first negative five-year margin since 2001 (Carrier Management). Where the third-party column reads “No,” the enterprise bore the day unpriced — and undocumented.

II. What Caremark, Marchand, and Boeing actually require

The legal baseline is familiar to this readership. In re Caremark (Del. Ch. 1996) established that directors must make a good-faith effort to assure that adequate information and reporting systems exist; Stone v. Ritter (Del. 2006) framed liability as a bad-faith failure to implement any such system or to monitor it. For two decades the doctrine’s practical bite was limited — Chancellor Allen himself called it “possibly the most difficult theory in corporation law upon which a plaintiff might hope to win a judgment.”

Marchand v. Barnhill (Del. 2019) changed the geometry. For a monoline ice-cream maker, the Delaware Supreme Court held, food safety was “intrinsically critical” — mission-critical — and a board with “no committee overseeing food safety, no full board-level process to address food safety issues, and no protocol by which the board was expected to be advised of food safety reports” had not satisfied Caremark’s minimum. The teaching was not that boards must prevent bad outcomes; it was that for the risk at the heart of the business model, directors must be able to show a system — a standing, documented channel through which that specific risk reaches the board.

In re Boeing (Del. Ch. 2021) applied the template to aviation: for an airplane manufacturer, airplane safety is mission-critical, and the complaint’s allegations — no board committee charged with safety, no regular safety reporting, management treating safety as an engineering matter below the board’s line of sight — survived the motion to dismiss. The derivative claims settled for $237.5 million, reported as the largest Caremark-class settlement in Delaware history, with board-structure reforms attached.

Now run the syllogism for a company whose enterprise value concentrates in launched assets. Is launch success mission-critical in the Marchand sense? For a satellite operator whose constellation is the balance sheet, or a launch provider whose flight record is the product, the question answers itself. Does a documented, board-level information system exist for the risk as it is actually taken — day by day, window by window? At most space-exposed companies the honest answer today is the Blue Bell answer: the risk is managed diligently below the board, in a form the board never sees, generating no record the board could later point to.

Two clarifications keep this argument honest. First, Caremark claims remain hard to win, and nothing here predicts liability for any company. The claim is directional: the doctrine now asks, for mission-critical risk, “show me the system” — and launch-day risk at self-insured scale is drifting into the zone where “our engineers handle it” is the answer that failed in Marchand and Boeing. Second, the duty is not to fly less. It is to be able to demonstrate, contemporaneously and in writing, that flying was a considered risk decision. Oversight of the decision quality, not the outcome, is the entire ask.

The D&O market will do some of this work regardless. Underwriters who watched the Boeing settlement price board-structure questions into aviation-adjacent risk; a derivative complaint following a self-insured nine-figure launch loss writes itself — count the documents the board can produce about that specific day, and if the answer is zero, plead it. Directors would prefer the record to exist before the loss does.

III. What a board-legible launch-day information system looks like

The objection that arrives at this point in every boardroom conversation is practical: what would we even look at? Launch decisions are technical; boards cannot re-poll the engineers. Correct — and beside the point. A launch-day information system in the Marchand sense has five properties, none of which requires a director to understand propulsion:

1. Written before the window. For each mission, a short document — one page suffices — stating the risk position for that specific launch day: nominal, elevated (with the concern named and located in the flight sequence), or adverse, together with what alternatives (later windows, different days) were considered. Signed by a named owner.
2. Specific enough to be wrong. “Space is hard” is not a risk position. A document that cannot fail to match the outcome is a talisman, not a record. The statement must commit: what class of problem, in what phase, at what level of concern.
3. Graded after the fact. Each pre-window document is scored against what actually happened — against the flight record, not against the author’s recollection. Hits and misses both.
4. Misses kept. The grades accumulate in a ledger the board reviews on a cycle, with the failures retained at full weight. A record that only remembers its successes is marketing.
5. Tamper-evident. The documents are timestamped and hash-sealed at creation — a solved problem, at negligible cost, using the same cryptographic plumbing that already secures the company’s software supply chain. This is what converts “we considered it” from testimony into evidence.

None of this is speculative. A working public example already demonstrates all five properties in combination — launch-day forecasts published and cryptographically sealed before each window, graded afterward against the public flight record with the misses retained, the entire ledger independently recomputable from public files. It is sustained by a single individual at negligible cost, and that is precisely the point: what one disciplined person can maintain as a private practice, a board can require as an institutional system. The five properties are what transfer — no particular practitioner, method, or vendor is needed to adopt them.

The asymmetry deserves one more sentence. Space-exposed companies spend eight and nine figures annually on assurance functions — external audit, cyber programs, compliance staffs — governing risks that are individually smaller than one launch. The marginal cost of the five properties above is a rounding error inside any of those budgets. The gap is not capability or cost. It is that no one at the board level has asked.

IV. Five questions for the next audit-committee meeting

The record question.  “Before our most recent launch, what written statement existed of that specific day’s risk — who signed it, and where is it filed now?”

If the answer is “the readiness review,” ask whether it states a risk position for the day, or certifies the vehicle. Those are different documents.

The shadow-premium question.  “For each self-insured mission in our forward book, what would a third-party underwriter charge us — mission by mission — and if we cannot answer, who in this company could?”

A premium is a price on a day. A company that cannot state its shadow premium is carrying an exposure it has never priced.

The slip question.  “When we scrub or slip, where does that cost appear in what this committee sees — as a risk outcome with a number attached, or nowhere?”

An oversight system that cannot see the cost of caution cannot evaluate the decision to proceed.

The discovery question.  “If tomorrow’s mission fails, exactly which contemporaneous documents would we produce to demonstrate that the board oversaw launch-day risk as a category — and would we be content to see them quoted in a complaint?”

This is the Marchand question asked prospectively, while it is still cheap.

The asymmetry question.  “What did we spend last year on audit, cyber, and compliance — and what would the five-property record described above cost beside those numbers?”

The purpose of the question is its answer: the cheapest assurance function the company could run is the one it does not have.

V. The close

Delaware law does not require boards to predict launch failures, and neither does this post. It requires something humbler and, for that reason, harder to excuse the absence of: a system by which the company’s most concentrated recurring risk is documented as it is taken, in a form the board can see, before the outcome arrives to grade everyone involved. The $6.2 billion already flew. The doctrine’s direction is not subtle. The only open question is whether the record that Marchand and Boeing teach boards to demand gets built before the next bad day — or reconstructed, expensively and adversarially, after it.

Vijay Jyotish writes on forecasting and decision-making under uncertainty. This post draws entirely on public sources — court opinions, NASA Office of Inspector General and GAO reports, SEC filings, and trade reporting.

This post’s legal discussion is general commentary, not legal advice.

The wave of securities class actions alleging market manipulation involving recently public, low-float companies continues to grow. Notably, many of these lawsuits have involved non-U.S. companies that recently completed IPOs on U.S. exchanges. Two new pump-and-dump lawsuits, filed within a day of one another in the Southern District of New York against China-based iTonic Holdings Ltd. and Park Ha Biological Technology Co., Ltd., increase the number of market manipulation cases filed in 2026 to 13.

The two complaints present a similar, and familiar, fact pattern. Both companies are China-based operating businesses organized through Cayman Islands holding companies that completed small IPOs on U.S. exchanges at $4 per share and maintained highly concentrated insider ownership following their offerings. In each instance, the company’s share price rose sharply without any corresponding business developments before plunging by more than 90% in a single trading session. The complaints allege that the run-ups were fueled by social media campaigns in which imposters masquerading as investment professionals and promoted fictitious relationships with well-known companies.

As discussed in more detail below, the allegations not only reflect the recurring fact pattern underlying these low-float stock-manipulation cases. but could also provide important insights for D&O underwriters evaluating the risks associated with low-float offerings.

A copy of the complaint against iTonic can be found here.  A copy of the complaint against Park Ha can be found here.

The iTonic SCA

iTonic Holdings Ltd., formerly known as Pheton Holdings Ltd., is a Cayman Islands holding company that operates through a Beijing-based subsidiary developing cancer-radiation treatment planning software.

On July 29, 2026, investors filed a securities class action lawsuit against the company, certain directors and officers, its auditor, and its IPO underwriters (the iTonic SCA). The complaint alleges that Pheton’s September 2024 IPO raised approximately $9 million through the sale of 2.25 million shares at $4 per share, while insiders retained most outstanding shares. The company’s stock subsequently climbed to an intraday high of $32 on July 28, 2025, despite the absence of material business developments.

Plaintiffs allege that the increase was fueled by an online promotion campaign in which individuals posing as financial advisors circulated false claims, including fabricated reports that U.S.-based biopharmaceutical company Gilead Sciences was considering an acquisition of, or partnership with, the company.

On July 29, 2025, the alleged scheme unraveled after The Bear Cave published a report questioning the stock’s dramatic appreciation and comparing it to other purported pump-and-dump schemes involving Chinese microcap issuers. Following multiple volatility-related trading halts, the company’s shares fell approximately 95%, from a prior closing price of $30.96 to $1.65. Several days later, on August 1, 2025, the company denied any involvement in stock-price manipulation and stated that the purported Gilead transaction reports were false.

The plaintiffs contend that the defendants failed to disclose the alleged promotion scheme, the company’s susceptibility to stock-price manipulation, and the purported involvement of the auditor and underwriters in other foreign microcap IPOs exhibiting similar trading patterns. The iTonic SCA asserts claims under the Securities Act of 1933, the Securities Exchange Act of 1934, and Rule 10b-5.

The Park Ha SCA

Park Ha Biological Technology (Park Ha) is a Cayman Islands holding company with operations in China that develops and sells skincare and cosmetic products under the Park Ha brand and operates a network of franchise beauty stores.

On July 28, 2026, investors filed their securities class action lawsuit against Park Ha, its controlling shareholder, certain directors and officers, its auditor, and its IPO underwriters (Park Ha SCA). According to the complaint, the company completed its IPO in December 2024, selling 1.2 million shares at $4 per share and raising approximately $4.8 million. The offering allegedly represented less than 5% of the company’s outstanding shares, leaving insiders with more than 95% ownership.

The complaint alleges that Park Ha’s share price rose from its $4 IPO price to an intraday high of $41.49 on July 7, 2025, despite the absence of material corporate developments that would justify the increase. Shareholder plaintiffs allege that individuals using the stolen identities of legitimate financial advisors directed investors from social media advertisements into WhatsApp groups, where they promoted Park Ha shares and falsely claimed that the company was preparing to announce a partnership with L’Oréal, one of the world’s largest beauty and cosmetics companies. The purported advisors allegedly projected returns of between 200% and 300%.

On July 8, 2025, the company’s shares fell approximately 93%, from a prior closing price of $41.01 to $2.99, erasing nearly $1 billion in market capitalization in a single trading session. The plaintiffs allege that the defendants failed to disclose the purported promotion campaign, the artificial trading activity allegedly driving the share price, and the risks associated with the company’s extremely limited public float. The complaint further contends that the IPO was structured in a manner that facilitated the alleged manipulation scheme and asserts claims under the Securities Act of 1933, the Securities Exchange Act of 1934, and Rule 10b-5.

Discussion

The iTonic and Park Ha complaints fit within a growing body of securities litigation involving low-float issuers and underscore several themes of interest to D&O underwriters, including stock-promotion risks and potential liability for offering gatekeepers. Both actions also follow a fact pattern that has become increasingly familiar in recent market-manipulation-related securities lawsuits, many of which involve non-U.S. companies, frequently China-based companies, that recently completed IPOs on U.S. exchanges.

The iTonic and Park Ha lawsuits closely resemble the actions previously filed against Charming Medical, PomDoctor, China Liberal Education Holdings, and Picard Medical. Significantly, these cases also appear to share another common characteristic: they involve foreign issuers, many are China-based companies or issuers with substantial operations in China, that accessed U.S. capital markets through relatively small IPOs. In each case, plaintiffs allege a familiar pattern: a low-float IPO with concentrated insider ownership, a dramatic stock-price increase unsupported by company-specific developments, extensive social-media promotion directed at retail investors, and an eventual collapse that wiped out most of the company’s market value.

Another notable feature of the iTonic and Park Ha SCAs is the increasingly standardized nature of the alleged promotion campaigns. According to both complaints, social-media advertisements directed investors to WhatsApp groups where individuals posing as investment professionals promoted the stocks.  A new feature of both lawsuits is the allegation that the companies were purportedly planning partnerships with well-known Western companies. In the iTonic case, the alleged rumors involved Gilead Sciences, while the Park Ha complaint centers on claims of a potential relationship with L’Oréal.

As in many of the earlier low-float cases, the central challenge for plaintiffs will be connecting the alleged conduct of unidentified third-party promoters to the issuer, its executives, and other offering participants. The complaints seek to bridge that gap by alleging that the offerings were structured in a manner that enabled manipulation or that the defendants failed to disclose known risks associated with the companies’ limited public floats and susceptibility to promotional activity. The suits also name the companies’ underwriters and auditors as defendants, reflecting plaintiffs’ continued efforts to extend liability beyond the issuers themselves.

For D&O underwriters, the growing number of pump-and-dump securities suits may reinforce the importance of evaluating low-float structures, concentrated ownership, and controls designed to detect unusual trading activity and online stock promotion. The recent cases also suggest that underwriters should pay particular attention to foreign issuers seeking to access U.S. capital markets through small public offerings, especially where insiders retain overwhelming control following the IPO.

To the extent that a substantial number of these cases involve China-based companies listing on U.S. exchanges, that characteristic may also warrant heightened scrutiny as part of the underwriting process. Whether these allegations ultimately prove sufficient to establish issuer or gatekeeper liability remains to be seen, but the continued filing of similar lawsuits suggests that low-float IPOs may become a significant area of emerging D&O risk.

In the following guest post, Paul Noon,  OBE, Emeritus Professor of AI and Innovation and former Deputy Vice Chancellor at Coventry University, argues that UK company directors face growing legal and governance risks from AI under both the UK Companies Act and the EU AI Act, whose broad extraterritorial scope can apply even to UK companies with no EU presence if their AI systems affect people in the EU. The author also considers the implications for U.K. boards. We would like to thank Paul for allowing us to publish his article on our site. Here is his article.

*****************************************

This publication has already made the case, convincingly, that AI governance is a fiduciary duty under Delaware law, and that AI risk disclosure in 10-K filings creates its own securities exposure for public companies. Both arguments assume a US frame of reference: Caremark oversight duties, SEC disclosure, securities litigation. For the many boards sitting outside that frame, in the UK, or anywhere with meaningful EU customer or operational exposure, a different and less discussed collision is forming, between an old UK statute and a very new EU one. It is worth boards’ and their D&O programmes’ attention now, not in 2027 or 2028, when the headline compliance deadlines land.

Two duties, one country

UK company directors owe two statutory duties that matter here. Section 172 of the Companies Act 2006 requires a director to act in the way they consider, in good faith, most likely to promote the success of the company, having regard to, among other things, the likely long-term consequences of any decision and the desirability of maintaining a reputation for high standards of business conduct. Section 174 requires a director to exercise reasonable care, skill and diligence, judged by a two-part test: the general knowledge, skill and experience reasonably expected of anyone carrying out that role, and, where it is higher, the knowledge, skill and experience the individual director actually has.

Neither section mentions artificial intelligence. Both are drafted to bite on foreseeable risk, and AI governance has been squarely foreseeable for UK boards for some time now. A director with genuine sector expertise, or one who has been briefed on AI risk and done little with it, faces a materially higher bar under section 174’s subjective limb than a generalist director who was never briefed at all. That is a considerably lower threshold for a claimant to clear than the Delaware Caremark standard, which generally requires a showing of bad faith, a sustained or systematic failure of oversight, rather than ordinary negligence.

The extraterritorial hook few boards see coming

Layered on top of that domestic exposure is the EU AI Act’s reach, which is broader than most UK boards assume. Article 2 catches not only providers placing AI systems on the EU market, but providers and deployers established anywhere in the world where the output produced by an AI system is used in the Union. That is a much lower bar than the “targeting” test most UK boards learned to apply under GDPR, which requires intentionally aiming at EU customers. A UK company with no EU subsidiary and no interest in EU customers can still end up in scope. If a hiring tool or a credit-scoring system it built or bought produces an output that affects someone sitting in the EU, that is enough to bring the Act’s obligations home.

A moving deadline, not a vanishing one

The compliance timetable has just moved, which changes the shape of this exposure without removing it. On 29 June 2026 the Council of the EU gave final sign-off to the Digital Omnibus package, following the European Parliament’s endorsement on 16 June, confirming that high-risk obligations for stand-alone Annex III systems, covering employment, credit, education, essential services and similar use cases, are deferred to 2 December 2027, and that AI embedded in regulated products under Annex I is deferred further, to 2 August 2028. What has not moved is the core Article 50 obligation requiring providers and deployers to disclose to individuals that they are interacting with an AI system, which remains live from 2 August 2026 regardless of the Omnibus delay. A board that reads the Omnibus delay as “AI is now a 2027 problem” is making exactly the kind of oversight error section 174 exists to catch. The obligation to have identified the exposure, and to be building toward it, does not wait for the compliance deadline.

The UK layer most people miss

There is a UK domestic factor compounding all of this. Section 80 of the Data (Use and Access) Act 2025 came into force on 5 February 2026, replacing UK GDPR Article 22 with a new Article 22C, which gives individuals a right to transparency, to human review, and to contest automated decisions made about them. Any UK board using AI in hiring, credit, insurance or similar automated decisions is now managing three overlapping accountability regimes at once: domestic company law, domestic data protection law, and an extraterritorial EU regulatory regime, frequently with a single, thin governance framework covering all three, or none at all.

What this means for D&O practitioners

For D&O placement and coverage, the practical questions this raises are different from the US securities-disclosure conversation this blog has already covered well. Does the policy’s regulatory investigation coverage extend to an EU regulator investigating a UK-incorporated insured with no EU establishment, given how broadly Article 2 is drafted? Is AI-related exposure being treated as an implicit carve-out under an existing cyber or technology E&O exclusion, rather than something anyone has actually underwritten on purpose? And, most practically, underwriters assessing section 174 exposure will increasingly want to see the same kind of evidence a Delaware court looks for under Caremark: a named board-level owner for AI risk, a documented risk register, a defined review cadence, and minutes that show real discussion rather than a five-minute AI update tacked onto a routine board meeting. I set out what that evidence base looks like in practice in the PAIGE Framework, a five-pillar model, Policy, Accountability, Intelligence, Governance Mechanics, Ethics, for board-level AI governance. Boards that can produce that evidence have a genuinely stronger section 174 defence than boards that cannot, regardless of which jurisdiction ultimately hears the claim.

The Caremark and 10-K conversations this blog has run this year are necessary reading for any board with US exposure. But for the sizeable number of UK and European boards, and for the US boards with EU customers or operations, who assume that conversation is the whole picture, it is not. The Companies Act has always expected UK directors to identify and manage foreseeable risk. The EU AI Act has just confirmed that a great many of them are managing it whether they intended to or not, and their D&O programmes need to catch up to that reality before a regulator or a claimant does it for them.

About the author

Paul Noon OBE is Emeritus Professor of AI and Innovation and former Deputy Vice Chancellor at Coventry University. He advises UK boards on AI governance and strategy through The Professor-AI, and writes a weekly newsletter on practical, jargon-free AI for senior leaders.

The D&O insurance implications of M&A litigation often extend beyond claims against the company and its directors and officers. When financial advisers are drawn into transaction-related litigation, companies that have agreed to indemnify them may be required to reimburse defense costs and settlement payments, raising questions about the extent to which those amounts could be covered under a public company D&O insurance program.

A pending coverage dispute arising out of Cornerstone Building Brands’ 2022 take-private transaction highlights those issues. At the center of the dispute is whether amounts a company pays to indemnify its financial adviser for defense costs and settlement payments constitute covered Loss under a public-company D&O policy.  Below is a discussion of Cornerstone’s coverage complaint, the parties’ competing summary judgment arguments, and potential D&O underwriting implications.

Cornerstone Coverage Litigation

On August 25, 2025, Cornerstone filed its complaint in the Eastern District of North Carolina seeking indemnification from certain excess insurers. The complaint alleges that in October 2021, Cornerstone’s special committee retained Centerview Partners (Centerview) as its financial adviser in connection with a proposed take-private transaction involving the company’s controlling shareholder. Under the engagement agreement, Cornerstone allegedly agreed not only to pay Centerview’s advisory fees but also to broadly indemnify Centerview for losses, claims, liabilities, settlements, and litigation expenses arising from the take-private transaction.

After Cornerstone’s take-private deal was completed, various shareholder actions relating to the transaction were filed against Cornerstone and other participants in the transaction, including Cornerstone’s directors and officers. Centerview was subpoenaed during several of the proceedings and was eventually named as a defendant in aiding-and-abetting claims brought in the Delaware stockholder litigation. According to Cornerstone’s complaint, Centerview ultimately incurred $9.8 million in defense costs and settlement payments, which Cornerstone reimbursed pursuant to the indemnification agreement.

In its separate complaint in the coverage litigation, Cornerstone alleges that it sought reimbursement for Centerview’s defense costs under its D&O insurance program, but its insurers denied coverage for the amounts paid on Centerview’s behalf. Cornerstone argues that payments made on behalf of Centerview constitute covered “Loss” because they were amounts the company became legally obligated to pay on account of a “Securities Claim.” Cornerstone also emphasizes that the applicable policies did not contain a contractual liability exclusion.

Cornerstone filed its motion for partial summary judgment on June 5, 2026. It contends that the underlying Delaware stockholder litigation filed against Cornerstone, and which named Centerview, constituted a covered “Securities Claim” arising out of the take-private transaction and that the amounts paid to Centerview qualify as covered Loss because they were amounts the company became legally obligated to pay. Cornerstone further argues that the Delaware litigation and related federal securities actions constitute a single Securities Claim under the policies’ related-claims provisions, that Centerview’s costs were incurred “on account of” that claim because they would not have arisen absent the underlying shareholder litigation, and that the absence of a contractual liability exclusion confirms coverage.

Cornerstone’s excess insurers filed their opposition to Cornerstone’s motion for summary on July 10, 2026. The insurers contend that the Delaware stockholder litigation was not a “Securities Claim” made against Cornerstone because the company itself was not named as a defendant, and that claims asserted against directors and officers do not automatically become claims against the corporate entity. The insurers further argue that Centerview is neither the Company nor an Insured Person under the policies and that prior payments by the D&O program related to Cornerstone’s indemnification of insured directors and officers do not establish coverage for payments made on behalf of a non-insured third party.

In addition, Cornerstone’s excess insurers contend that Cornerstone’s payment obligation arose from a separate contractual undertaking contained in the Centerview engagement agreement rather than from a covered “Securities Claim.” According to the insurers, the reimbursement therefore represents an uninsured contractual obligation or business debt, and the absence of a contractual liability exclusion is irrelevant because coverage must first exist under the policies’ affirmative grant of Side C coverage before any exclusion analysis is reached.

On July 23, 2026, Cornerstone and one of the defendant insurers filed a notice of settlement. The coverage action remains pending as to the other excess insurer defendants.

Discussion

The Cornerstone dispute combines several recurring D&O coverage issues, including the scope of Side C entity coverage, the definition of a Securities Claim, and the impact of contractual indemnification obligations. As The D&O Diary has previously discussed, these disputes often turn on whether the underlying claim falls within the policy’s grant of coverage and whether the payment at issue is properly characterized as covered Loss.

In the Cornerstone coverage litigation, the central issue is whether a company’s payment of its financial adviser’s defense costs and settlement pursuant to an indemnification agreement constitutes covered Loss because it arises from a Securities Claim or is instead uncovered because it stems from a separate contractual obligation.

Cornerstone argues that a Texas court previously found coverage in a similar dispute involving its predecessor, NCI Building Systems. According to Cornerstone, the court held that amounts NCI was obligated to pay on behalf of third-party consultants in connection with shareholder litigation constituted covered Loss under materially similar D&O policy language. The insurers, by contrast, contend that the unpublished NCI order is distinguishable and provides little guidance.

Whatever weight the court gives the NCI decision, the dispute highlights the potential consequences of treating adviser indemnification payments as covered Loss. If Cornerstone prevails, D&O insurers may seek to clarify whether Loss includes amounts paid on behalf of non-insured third parties and to more expressly address contractual indemnification obligations through revised policy wording, exclusions, or related Side C provisions.

Conversely, a ruling for the insurers could reinforce the view that Side C coverage applies only to Loss arising from a Securities Claim against the company and not to liabilities assumed through separate contractual obligations. Such a result would preserve the distinction between covered Securities Claim exposure and obligations arising from indemnification agreements with financial advisers and other transaction participants.

Ultimately, the Cornerstone coverage litigation provides a useful example of the tension between broad Side C coverage grants and liabilities assumed through commercial contracts. If the court ultimately issues a substantive ruling, the decision could become an important reference point for future disputes involving financial-adviser indemnification obligations and the scope of Side C coverage in transaction-related litigation.

In the following guest post, Javier Ybarra, Oswald Carvalho, and Sofia Garcia-Ollauri, all of Marsh Spain, consider a special feature of D&O insurance in Spain. Spain’s legal system allows civil damage claims to be pursued within criminal proceedings, which can lead courts to require directors and officers to post civil or bail bonds (“fianzas”) before liability is finally determined. As the authors discuss below, D&O insurers in Spain may be expected to provide or support these bonds, and companies with Spanish operations should ensure their D&O policies explicitly address bond coverage, reimbursement obligations, and related collateral requirements. Our thanks to the authors for allowing us to publish their article as a guest post on this site. Here is the authors’ article.

*****************************

A bondsman is one who acts as a surety to pay a defendant’s bail assuming the responsibility of a bond. In the insurance world this would not expected to be a D&O insurance carrier but rather a Surety bond one. In Spain, when a civil liability case is handled by a criminal court in criminal proceedings this may not be the case and you will find in the below article the reasons behind the peculiarity of such coverage and its relevance for Directors and Officers in Spain.

Spanish Criminal Proceedings and “Fianzas” (Bonds) Impact on D&O Policies in Spain

Each country’s legal system is unique and can pose different challenges for companies and their directors and officers. In this regard, Spain has a unique exposure to the locally denominated “Fianzas” (bonds) which directors and officers need to be aware of, and for which D&O insurance policies need to reflect adequately. Owing to recent experiences in claims and queries on the matter by clients, we seek to clarify the legal mechanisms regarding such bonds and highlight relevant considerations in relation to D&O insurance policies. This is especially of importance where such policies are not placed in the Spanish insurance market, where coverage for bonds is commonplace.

Claiming for damages in civil and criminal proceedings

In case of tort, breach of contract, etc., prejudiced parties may bring civil proceedings to claim for damages.

If the act or omission concerned amounts to a criminal offence, the prejudiced party is entitled to bring criminal proceedings. In addition, the plaintiff (i.e. the prejudiced party) is entitled to claim for damages within the criminal proceedings (unless the prejudiced party waives its right or expressly reserves it for a subsequent civil proceeding). That is because, under Spanish law, a civil action can be brought together with the criminal action and both actions shall be heard by the criminal court. In summary, one of the particular characteristics of the Spanish legal system is the fact that the civil action to claim for the damages caused by a criminal offence can be brought at the same time as the criminal proceedings.

In this respect, it should be noted that only if, following the trial, the court finds that a criminal offence was committed, damages can be awarded by the criminal court to the plaintiff (i.e., the criminal court is not allowed to order the payment of damages if it finds that no criminal offence was committed). At the same time, if the defendant is acquitted in the criminal proceedings, the claimant will still be entitled to bring a separate civil proceeding to claim for damages.

In view of the above, where a criminal offence has been committed by a Director or an Officer of company, any prejudiced party is entitled to bring criminal -and also civil- proceedings against them.

Types of bonds (“fianzas”)

In civil proceedings, there are no bonds or deposits imposed by the Courts. Having said that, under certain circumstances, the plaintiff is entitled, when the suit is filed, to apply for the seizure/lien of the assets of the defendant (“embargo preventivo”). If the application is successful, the court will issue the appropriate order, but the defendant may, if he/she wishes to, offer a bond in replacement of the seizure/lien order.

In criminal proceedings, a Judge may impose two different kinds of bonds:

• Bail bond (“fianza carcelaria”): a surety required by a Judge or Court to ensure compliance with certain obligations on the part of the defendant. The purpose of the bail bond is to guarantee the presence of the defendant at the trial while the Court is investigating the circumstances surrounding the alleged commission of a crime. A bail bond is only imposed under certain circumstances, and if the accused person attends the trial, then the bond shall be returned. If the defendant however fails to appear in front of the Court on the date of the trial, the bond will be enforced by the Court immediately if such bond was deposited by the defendant. If the bond was deposited by a third party, a Bank or an Insurance Company, such third party or company will have 10 days to get hold of the defendant and place him before the Court. Once this period has elapsed, the third party will have to pay the full value of the bond to the Court and would only be able to attempt recovery from the missing individual. The amount of the bail bond depends upon factors such as the wealth of the accused director and tend to remain at relatively manageable levels when compared to a Civil bond.

• Civil bond (“fianza civil”): It is another type of bond or surety which a Judge may demand in the course of the investigative phase (when the Judge considers that there are sufficient “rational indications of criminality” -in practice, it is usually requested at the end of the investigation stage and with the order of the Judge for the commencement of an oral trial). The purpose of the civil bond is to secure the payment of damages or guarantee any eventual civil liability which may arise from the commission of the crime, in case that the accused persons are found guilty following the trial.

The bonds, which can be deposited either by the defendant or by a third party, are furnished into the Court in one of the following ways:

• In cash to be deposited in Courts bank account.
• By means of a real guarantee, i.e. a charge, mortgage or pledge over the assets of the defendant or a third party.
• A Bank Guarantee.
• An Insurer Guarantee (i.e. a letter signed by a representative of the insurance company securing the payment of the relevant amount, similar to a bank guarantee)

D&O Insurance Cover

Taking into account the above (particular features of Spanish Law), insurance policies in the Spanish marketplace usually provide cover for bonds in one of the following manners:

1. The Insurer itself will provide the bond. If the insurer provides cover for the provision or constitution/collateral of the bond itself, the Court may accept as a valid bond the insurance policy together with a letter signed by a legal representative of the insurer (“insurer guarantee”). In this case, no cost will be incurred initially by the Insurer. If the “insurer guarantee” is not accepted by the Court, then it will be for the insurer to obtain a bank guarantee to be filed with the Court or deposit the relevant amount in cash at the Court’ bank account. In the case of a Civil Bond, Cover for the provision or collateral of the bond by the Insurer is the standard market practice in most of the policies currently in force. As a condition to grant cover for the collateral, some insurers will require that the request to the insurer is jointly made by the insured and the policyholder (in particular for Bail Bonds) and that a guarantee will be provided (by the Policyholder) to the Insurers in order to secure recovery in the event that the bond is executed by the courts. Or:

2. The Insurer will only assume the cost or premium, but not the collateral of the bond itself. This, in practice, will mean that once the bond is imposed by the Court, the defendant directors will have to attempt to obtain from a bank a surety which will then be deposited at the Court. The cost of keeping this surety over the time of duration of the proceedings will be borne by the Insurer. This is standard market practice for a Bail Bond, although some insurers will provide full collateral cover as mentioned above.

In this regard, below there is an example of cover of a D&O policy:

“The Insurer shall pay to or on behalf of the Insured all Spanish “Bonds” arising from a Claim first made against an Insured during the Policy Period, consisting on:

• the constitution of civil bonds which have been imposed on insured persons by a court decision to guarantee potential civil liabilities covered by this policy; or the costs incurred by an insured person in connection with the constitution and maintenance of bail bonds imposed in criminal proceedings by a court decision to secure its provisional freedom;
• the constitution of the surety that an insured person provides, in substitution of the precautionary measures ordered by a judge in accordance with the provisions of Articles 746 and 747 of the Law 1/2000, of 7th January, of Civil Procedure, to guarantee possible civil liabilities covered by this policy as a consequence of a claim first made against the insured person during the policy period.

In case of enforcement of the bond or of the instrument by virtue of which the bonds or guarantees referred to in this Extension and in case that a liability arising from fraudulent, criminal or deliberately unlawful conduct is established by an authority, judge or court, the insured person and the policyholder undertake jointly and severally to reimburse the insurer, on first demand, the amount of the bond executed, or the costs paid by the insurer”.

In this regard, please note that insofar D&O policies exclude fraudulent, criminal or deliberately unlawful conducts (when such conducts are admitted by the insured or finally established by a judge or court) and Section 19 of the Spanish Insurance Contracts Act provides that the insurer shall be obliged to pay the indemnity, except when the loss has been caused in bad faith by the insured, in case of enforcement of the bond and in case the liability arises from a fraudulent, deliberate or dishonest act of the insured, the insurance company is entitled to recover from the insured and/or the policyholder. Further to the policyholder´s obligation, it is common practice that Spanish insurance companies request the corresponding policyholder (before providing the bond at the court) to provide a counter guarantee in order to guarantee such repayment obligation.

Further, it is worth noting that the Spanish Criminal Procedures Act provides that the civil bond may be imposed on the accused persons (i.e. on the person who allegedly committed the criminal offence) but also provides that any “liable person” (i.e. any person or entity which could be liable for the damage allegedly caused by the accused person) may, if requested by the plaintiff, be ordered to post the civil bond. Liability insurers fall within the concept of “liable persons”. In consequence, for the mere fact of having issued a liability policy, insurers may be ordered by the courts to secure the payment of the alleged damages (i.e. to post a civil bond) where criminal proceedings are brought against its insured. It should be noted that insurers may be ordered to post the civil bond whether or not the policy provides cover for the provision of bonds, for the costs of maintaining a bank guarantee or even if any kind of cover is provided in respect of bonds (including the case of foreign policies which may be silent on this matter), since in such case, the bond is imposed on the insurer directly.

Conclusions and recommendations

In summary, it might be advisable and prudent to: Apart from the coverage aspects, it is important to note that Spain does not permit non-admitted insurance, therefore any insurance policies procured outside of the European Union, where the EU Freedom of Services rule applies, would not be considered valid.

Taking into account the above considerations, foreign policyholders should be aware of this particular exposure of the Directors and Officers of their Spanish subsidiaries, regardless of whether the D&O´s are Spanish or not, or whether they are executive or independent directors, and review their D&O policies so coverage for bonds is properly reflected in their Master policies (whether via Difference in Conditions clauses) and/or local policies taken out in Spain.

In this regard, a final remark to consider is that if the governing law of the Master policy would not be Spanish Law, but a foreign Law, and such Law would have to be proved within the corresponding criminal proceedings with the pertinent complexity-.

In summary, it might be advisable and prudent to:

• Verify the policy coverage in respect of such bonds and the ability of the insurance company to grant such coverage in Spain
• Review policy language regarding the reimbursement of any civil bonds that may be seized by the court, in the event of a judgement against the insured persons
• Review in advance any collateral / guarantee letters from the insurance company to be prepared for any eventual claim as the courts may require bonds to be deposited in a very short period of time.
• Review Indemnification provisions for the advancement of defence costs, including possible bonds.
• Review any mechanism in place to offer the D&Os any alternative source of financing such bonds.

We recommend clarifying the scope of your policy and addressing any concerns with your insurance advisor.

________________________________

Javier Ybarra, Managing Director, Head of FINPRO. Marsh Spain

Oswald Carvalho, Director, Executive Risk Practice Leader. FINPRO. Marsh Spain

Sofia Garcia-Ollauri, Director, Coverage Counsel & Product Specialist Leader, FINPRO, Marsh Spain

In a recent post (here), I wrote about a lawsuit that had just been filed against Microsoft’s board, alleging that the company’s directors had violated their fiduciary duties by knowingly allowing its AI development efforts to engage in copyright infringement. The case, I said, represented an example of “silent AI” – that is, the seepage of AI-related matters into various insurance coverages that were not consciously intended to provide coverage for certain exposures. The case showed how a matter that would not typically be covered under a D&O policy (copyright infringement) can translate into a potentially covered matter (a breach of fiduciary duty lawsuit).

In the latest example of this kind of lawsuit, a plaintiff shareholder has filed a derivative lawsuit against the board of Nvidia, alleging that its directors knowingly permitted its AI models to violate copyright holders’ rights and allowed violations of the Illinois Biometric Information Privacy Act (BIPA). Nvidia, the complaint alleges, has been the target of numerous copyright infringement actions, as well as class actions brought for alleged BIPA violations concerning individual voiceprints. The derivative lawsuit seeks to hold the company’s directors liable for the company’s “potentially massive liability and related costs and reputational damages” that the company faces in the underlying litigation. As discussed below, the new Nvidia derivative lawsuit, which may be found here, represents yet another example of “silent AI” in operation in the D&O context.

Background

Nvidia is best known as the manufacturer of computer-graphics hardware, particularly for its Graphics Processing Units (GPUs), but it has recently expanded into software and hardware for training and operating Artificial Intelligence (AI) software programs. Nvidia’s hardware and software are used by all “Frontier AI” companies that develop the most advanced AI systems. Nvidia AI models include multiple AI software programs called Large Language Models (LLMs).

The Lawsuit

The derivative complaint alleges that the LLMs were trained using copyrighted materials pirated from many sources. Among other things, the source materials allegedly included thousands of hours of human speech recordings. The human voice recordings allegedly were used in violation of BIPA (among other things, by failing to identify the speakers and to provide written notice or obtain a release).

The complaint alleges that the company’s unauthorized use of copyrighted or protected materials “resulted in multiple copyright holders filing lawsuits against Nvidia based on Nvidia’s failure to compensate them for downloading, copying, storing, or using their copyrighted words … for which Nvidia is now facing potential massive liability.”

The complaint alleges that the defendant directors knew of these issues with Nvidia’s use of copyrighted works without the copyrighted material owners’ permission. The complaint further alleges that the defendant directors were “well aware” of the company’s potential liability for copyright infringement, as well as potential liability for BIPA violations. Both the alleged copyright and BIPA violations have resulted in massive litigation against the company.

The complaint alleges that Nvidia is “now saddled with having to defend itself” in the litigation and is “facing potentially massive liability and related costs and reputational damages.” The complaint seeks to hold the defendant directors liable for the harm to the company caused by their alleged breaches of their fiduciary duties.

Discussion

This new derivative lawsuit against Nvidia’s board is not the first lawsuit of its type in which a company’s directors were hit with a D&O lawsuit in which it is alleged that the directors violated their fiduciary duties by knowingly allowing the company’s efforts to develop AI models and products to violate copyright holders’ intellectual property rights. As noted at the top of this post, in June 2026, a plaintiff shareholder filed a lawsuit with similar allegations against the board of Microsoft (discussed here). And as discussed here, in April 2026, a plaintiff shareholder filed a similar derivative suit involving similar allegations against the board of Adobe. (Just an aside, this new lawsuit may be the first one to raise similar-type allegations with respect to alleged BIPA violations.)

As I noted with respect to the prior lawsuits, this new lawsuit may represent something of an emerging trend, in which matters that would not otherwise be covered under a D&O insurance policy (in this case, alleged copyright infringement) are tranformed into a claim presumptively covered by the D&O policy, through the means of a follow-on breach of fiduciary duty lawsuit.

There is nothing necessarily new about the phenomenon of a follow-on derivative lawsuit. For example, we recently discussed the follow-on lawsuit trend with respect to the derivative lawsuit filed against Uber’s board, I which the plaintiff shareholder alleged that the defendant directors breached their fiduciary duties by allowing the company to pursue or continue practices and policies that allowed the company to be sued in extensive underlying sexual harassment and assault litigation. The Uber post cited numerous other prior examples in which follow-on suits claimed defendant directors had breached their fiduciary duties by knowingly allowing the company to take actions that resulted in underlying litigation against the company.

These kinds of follow-on lawsuits arguably represent examples of the oft-stated principle in the D&O arena that sooner or later everything becomes a D&O claim.

The common thread among these lawsuits is that the company has taken actions that resulted in underlying litigation against the company (usually litigation of a type that would not be covered by a D&O insurance policy) and that the underlying problem and ensuing litigation were the board’s fault (allegations of a type that presumptively are covered under a D&O insurance policy).

As we noted in connection with the Microsoft lawsuit, these follow-on derivative suits relating to underlying copyright infringement illustrate another phenomenon – that is, “silent AI,” the way in which non-covered underlying AI-related misconduct can seep into the D&O insurance policy through the follow-on fiduciary duty lawsuit. D&O insurers may well feel aggrieved because they never intended the D&O policy to pick up AI-related intellectual property liability.

These developments may be among the many reasons why the possibility of D&O insurers seeking to insert AI-related exclusions into their policies is currently under discussion in the D&O arena. With the D&O insurance market in an extended soft market phase, the possibility of the inclusion of these exclusions in most cases is a remote possibility. However, the insurance market is cyclical, and when the market eventually moves to the next phase, insurers may well seek to restrict their policies’ exposure to “silent AI.”

For now, it seems likely that as prospective litigants identify ways in which they have been harmed by artificial intelligence, the litigants’ claims may at least potentially trigger parallel follow-on lawsuits, in which the underlying allegations are relied upon to support D&O liability claims. My guess is that there will be more lawsuits in the months ahead involving allegations similar to those alleged against the Nvidia board in this new lawsuit.

As The D&O Diary has emphasized in numerous posts in recent months (most recently here), geopolitical issues represent an increasing source of D&O risk. The geopolitical issues include, among other things, sanctions, tariffs, and export controls. Another geopolitical issue that can have an impact on D&O risk is the enforcement of anti-money laundering (AML) laws. In the latest example of AML enforcement translating into D&O risk, in late July a plaintiff shareholder filed a securities class action lawsuit against British money transfer technology company Wise Group, a company whose U.S. bank charter application was denied due to AML concerns. A copy of the July 31, 2026, complaint can be found here.

Background

Wise Group is a U.K.-based technology company concentrating on cross-border money and currency transfers. On May 11, 2026, Wise’s ordinary shares transferred to Nasdaq from the London Stock Exchange. The company said it made the move to the U.S. market as part of an effort to try to target the U.S. for its money transfer business. The company also expressed its intent to seek a U.S. bank charter.

The subsequently filed securities lawsuit complaint alleges that at the time the company made its U.S. move, it “materially understated the regulatory risk facing the Company, given that it was under active investigation by Belgian authorities.” The Company also “materially understated the chance that Wise would not receive a national bank charter from the Office of the Comptroller of the Currency … in the U.S. as a result of ‘longstanding,’ material and pervasive concerns with Wise’s anti-money laundering …protocols, and inadequate efforts to prevent terrorist financing, which were either known to Defendants or should have been known to Defendants.”

On June 1, 2026, Reuters published an article reporting that the value of the company’s shares had declined on news of a Belgian money-laundering investigation, reportedly involving more than half a billion euros ($582.5 million) in suspicious transactions. The Reuters article reported that the investigation “began last year and is nearing completion, concerns potential money laundering offences, with alleged links to fraud, corruption, and drug trafficking.” The story also noted allegations that the company’s services were “used by international criminal organizations.” The complaint alleges that the company’s shares fell on this news.

On July 24, 2025, the Wall Street Journal published an article reporting that the U.S. banking regulator had denied the company’s application for a banking charter “citing long-standing deficiencies in anti-money laundering and countering of the financing of terrorism.” The company ‘s share price fell further on this news.

The Lawsuit

On July 31, 2026, a plaintiff shareholder filed a securities class action lawsuit in the Southern District of New York against Wise and certain of its officers. The complaint purports to be filed on behalf of a class of investors who purchased the company’s shares between May 11, 2026, and July 23, 2026.

The complaint alleges that the defendants made false or misleading statements or failed to disclose that: “(1) in order to have a successful debut on the NASDAQ, Defendants materially understated Wise’s regulatory risk as a result of its materially deficient anti-money laundering efforts, as well as insufficient efforts to prevent the financing of terrorism; and (2) as a result, Defendants’ statements about Wise’s business, operations, and prospects were materially false and misleading and/or lacked a reasonable basis at all relevant times.”

The complaint alleges that the defendants violated Sections 10(b) and 20(a) of the Securities Exchange Act of 1934 and Rule 10b-5 thereunder. The complaint seeks to recover damages on behalf of the class.

Discussion

Although the focus of the complaint is Wise company’s alleged violation of anti-money laundering laws, the underlying allegations in fact relate to host of alleged violations of various cross-border laws and enforcement regimes, including those involving corruption and terrorism. The underlying allegations embody a series of cross-border concerns, all of which are magnified in the current fraught geopolitical environment.

While the current circumstances are an important element of the seriousness of the concerns involving the Wise company, it should also be noted that it is not necessarily a new development that alleged AML law violations can lead to D&O claims activity. For example, in January 2025, the money transfer company Block was hit with a securities suit based on allegations that the company’s failure to maintain AML protocols had created a “haven for criminal and illicit activities.” In our blog post (here) about the Block lawsuit, we linked to numerous prior securities suits filed based on underlying AML, export controls, or trade sanctions violations.

In light of the prior lawsuit filings, it could be argued that the issues underlying this complaint are not new. However, I believe that in the current geopolitical environment, these issues are even more complicated than in the past.

Geopolitical issues arising from the war in Ukraine and the conflict in Iran; the strains arising from the closure of the Strait of Hormuz; the trade war raging based on U.S. tariffs and other countries’ countermeasures; and tensions arising from cross-border migration, among many other things, make for an unpredictable and potentially changeable global business environment.

As we have noted in our recent posts discussing geopolitical issues and their impact on the D&O arena, the geopolitical issues are becoming an increasingly important source of D&O risk and increasingly are translating into D&O claims. The geopolitical issues increasingly are impacting companies’ operating circumstances and financial results, as well as companies’ share prices, creating an environment in which D&O claims are increasingly likely to emerge.

There may or may not be further AML-related lawsuits filed in the coming months, but it seems likely that there will continue to be D&O claims arising from underlying geopolitical issues in the weeks and months ahead.

It is worth noting that this company had been a U.S.-listed company for only about three months when it was hit with this securities class action lawsuit. (Indeed, the first day of the proposed class period is in fact the day the company’s shares began trading in the U.S.) If nothing else, this sequence of events shows the heightened litigation exposure for companies whose shares are listed on U.S. exchanges.