The D&O Diary has been chronicling how securities plaintiffs continue to expand litigation theories beyond traditional “AI-washing” claims. The recent securities class action against data protection company Commvault Systems, Inc. demonstrates how AI hype and strategy can become entangled with traditional securities claims, even when actual AI integration is not the central issue of the lawsuit.

By contrast to AI-washing claims, in which the allegation is that the defendant company overstated its AI capabilities, this new complaint involved alleged overstatement of AI capabilities. The following discusses the allegations against Commvault in more detail, compares the Commvault complaint to other AI-related securities litigation and considers the potential D&O underwriting takeaways.

The Commvault SCA

On May 18, 2026, the complaint against Commvault (Commvault SCA) was filed, in the District of New Jersey and alleges that Commvault and certain executives overstated the sustainability and predictability of the company’s annual recurring revenue (“ARR”) growth, while failing to disclose that these projections did not adequately account for the changing mix of sales underpinning that growth.

At the same time, Commvault management allegedly emphasized the company’s “AI-enabled cyber resilience platform,” linking these capabilities to customer demand and long-term growth expectations. The alleged misstatements, however, do not turn on whether those AI-related descriptions were false. Instead, plaintiffs focus on whether the company’s revenue guidance and supporting disclosures adequately reflected the impact of shifting deal structures on ARR performance.

According to the complaint, Commvault failed to accurately project how its rapid shift toward AI-driven SaaS offerings would impact ARR calculations. As customer demand pivoted heavily toward these modern SaaS and cloud-isolated tools, new contract structures carried lower average selling prices. This structural change diluted near-term ARR metrics, meaning the company’s financial guidance fell short even though overall market demand for its AI cyber-resilience platform remained robust.

Even so, the complaint alleges that, during the company’s October 2025 earnings call, the CFO stated that second-half performance implied “$45 million of net new ARR,” above the $40 million baseline discussed earlier in the fiscal year. However, despite high demand for Commvault’s AI-enhanced cybersecurity tools, when the company reported third-quarter fiscal 2026 results on January 27, 2026, the lower pricing structures of those AI SaaS deals caused ARR growth to miss expectations at $39 million (versus the guided $40–45 million), causing a 31% stock price crash.

Discussion

What makes the Commvault lawsuit notable is precisely that it does not fit neatly within the now-familiar category of “AI-washing” cases. In earlier suits, plaintiffs typically alleged that companies overstated the existence, sophistication, or readiness of their AI capabilities. Here, by contrast, the complaint does not meaningfully challenge Commvault’s AI-related statements as false.

Instead, the core allegation concerns ARR guidance, specifically, that the company overstated the sustainability and predictability of its recurring revenue growth while failing to disclose key operational variables affecting those projections.

The AI references matter in a different way. Their significance is not that they were allegedly misleading in isolation, but that they indicated increased growth. By repeatedly highlighting its “AI-enabled” platform and linking it to increasing demand and long-term opportunity, the company arguably conveyed a sense of durability and momentum that plaintiffs claim was undermined by the underlying shift in sales mix and contract structure.

In this respect, the alleged disconnect is not between AI capability and reality, but between messaging and metrics. The complaint can be understood as asserting that the company’s emphasis on AI-driven growth contributed to an overall disclosure framework that did not fully or clearly communicate the factors limiting the predictability of ARR performance.

This framing places the case within a broader, emerging category of AI-adjacent disclosure claims. In these cases, AI is not the actual source of the misstatement, but it serves to contextualize and shape investor expectations. In these cases, the litigation risk arises not from overstating AI technology itself, but from how AI-related themes are incorporated into broader discussions of business performance, strategy, and outlook.

The Commvault securities class action should not be conflated with disclosure cases like the one filed against Reddit, which strictly alleges a failure to warn investors about external threat vectors from Google’s AI search summaries. Commvault represents an internal disruption: the mathematical miscalculation of revenue metrics during a structural shift to an AI SaaS model. However, looking past those functional differences reveals a broader shared truth. In neither case is the underlying AI technology alleged to be broken or fraudulent; instead, both actions target how AI developments reshape the context of a company’s broader financial and operational reporting.

These cases suggest that AI-related litigation exposure may increasingly arise not from what companies say about AI technology, but from how AI influences the assumptions, risks, and uncertainties embedded in their disclosures.

This comparison highlights an important evolution in AI-related securities litigation. Rather than focusing on whether AI capabilities are overstated, these cases focus on whether companies have adequately disclosed the business implications of AI, whether as a source of disruption, as in Reddit, or as part of a broader operational and revenue model shift, as in Commvault. In that sense, the emerging risk is less about “AI-washing” and more about AI-related disclosure incompleteness or contextual distortion.

For D&O underwriters, the Commvault SCA underscores how AI-related securities litigation risk is evolving beyond traditional “AI-washing” allegations into a broader category of disclosure-driven claims tied to business model transitions and financial metrics. The complaint focuses on whether management adequately conveyed how AI-related strategic shifts, particularly the move toward SaaS and cloud-based offerings, affected key performance indicators such as ARR. Companies emphasizing AI-enabled growth while simultaneously undergoing changes in pricing models, contract structures, or customer acquisition dynamics may present elevated disclosure risk if those complexities are not clearly articulated.

In addition, as illustrated by both Commvault and the Reddit action, AI-related exposure may arise where companies understate risks or fail to explain how AI-driven changes affect core business performance. For D&O underwriters, this means evaluating not only the presence of AI in a company’s strategy, but also how management discusses associated uncertainties, assumptions, and potential variability in forward-looking statements. Ultimately, AI-related risk appears increasingly embedded within ordinary disclosure practices, making it critical for underwriters to assess disclosure controls, consistency of messaging, and the robustness of assumptions supporting guidance, rather than focusing narrowly on AI technology claims alone.

From this perspective, even if the Commvault complaint is not, strictly speaking, an “AI case,” it reflects how AI has become embedded in the disclosures companies use to explain performance and growth. As a result, litigation risk may emerge where those disclosures, AI-related or otherwise, outpace the underlying operational realities or fail to fully capture sources of variability.

For D&O underwriters, the implication is that assessing AI-related risk requires looking beyond representations about technology and focusing instead on how AI-driven strategy is translated into disclosure, particularly where it intersects with key performance metrics, guidance, and investor expectations.

For several years, cybersecurity has been a perennial D&O liability issue. Although there has never quite been the volume of cybersecurity-related D&O litigation that some anticipated, cybersecurity-related D&O claims do continue to arise. In the latest example, last week a plaintiff shareholder filed a securities suit against cloud data storage company Snowflake, alleging, among many other things, that the company failed to disclose shortcomings in its customer data security arrangements that allegedly allowed key customers to experience a data breach. There are a number of noteworthy aspects of this new complaint and its cybersecurity-related allegations, as discussed below. A copy of the plaintiff’s complaint can be found here.

Background

Snowflake is a cloud data storage company. It completed an IPO in September 2020. Beginning in 2022, several developments affected the company’s business operations and financial results. First, the company found it necessary to offer its largest customers pricing discounts. Second, the company experienced competition from alternative data storage technologies. Third, the company experienced changes in its customers’ usage of its products due to the company’s own software improvements.

In addition, in 2023, the electronic storage industry was hit with a series of data breaches. The securities complaint alleges that “roadblocks” in Snowflake’s “system architecture” limited the company’s ability to utilize “multi-factor authentication” (MFA) as a means to deter data breaches. The complaint alleges that the company and its executives “created a misimpression that customers were handling security, when in fact they had not been able to do so.”

The complaint further alleges that in late May and early June 2024, Snowflake’s “data security issues were revealed,” as “a major data breach hit many of Snowflake’s most prominent customers,” which negatively affected Snowflake’s share price. The securities complaint alleges that in the customers’ ensuing federal court litigation against Snowflake, Snowflake had attempted to argue that it lacked a duty to protect its customers against a data breach; the securities complaint alleges that these arguments were rejected.

The Lawsuit

On May 22, 2026, a plaintiff shareholder filed a securities class action complaint in the Northern District of California against Snowflake and certain of its executives. The complaint purports to be filed on behalf of investors who purchased the company’s securities between May 24, 2023, and June 10, 2024.

The complaint alleges that during the class period, the company was “hard-pressed to battle customer demands for discounts, new competitive technologies, and the effects on usage of its products resulting from its own software improvements.” The defendants, the complaint alleges, “failed to acknowledge the seriousness of these issues, and deceived investors by downplaying them.”

The complaint further alleges that Frank Slootman, the company’s CEO, had a “motive” to conceal this information, as, during the class period, Slootman established and traded shares in his personal holdings of company stock pursuant to a Rule 10b5-1 trading plan. The complaint alleges that Slootman traded $223 million worth of Snowflake stock in four trades in late 2023 and early 2024.

The complaint also alleges that on May 22, 2024, cybersecurity watchdog Mandiant notified Snowflake and law enforcement of an ongoing hacker campaign focusing on Snowflake customers. Several major customers confirmed they had been hacked. The company’s share price declined on this news. The complaint alleges that the price drops represented the “materialization of an undisclosed risk that flowed from Snowflake’s concealment of the degree of vulnerability and lack of precautions prevailing at Snowflake’s customers.”

The complaint alleges that “instead of frankly disclosing customers’ unpreparedness when it raised the issue of customer security, Snowflake misleadingly downplayed the matter by simply stating that the customer was (in its view) solely responsible for customer security.” Snowflake did not reveal that “major customers were unable to handle that responsibility, or that Snowflake’s systems actually impeded the adoption by customers of certain key security measures.” The company had reason to know of these shortcomings, and the defendants “thus concealed the nature and magnitude of this known risk and their security-related statements were misleading ‘half-truths.’”

The complaint alleges that the defendants violated Sections 10(b) and 20(a) of the Securities Exchange Act of 1934 and Rule 10b-5 thereunder. The complaint seeks to recover damages on behalf of the plaintiff class.

Discussion

This new lawsuit has only just been filed, and it remains to be seen how it will fare. However, it certainly can be said now that there are a number of unusual features to this complaint.

The first noteworthy thing about this complaint is its timing. The complaint purports to be filed on behalf of a class of investors who purchased the company’s securities between May 24, 2023 and June 10, 2024. The complaint was filed on May 22, 2026 – that is, just short of three years after the beginning of the class period. The filing of this suit does not exactly suggest a race to the courthouse. Even if the allegations in this suit are not time-barred, it certainly could be argued that the claims are a little stale.

Another noteworthy feature of this complaint is that it does not exactly reflect a precise rifle-shot approach to pleading. Instead, the complaint seems to reflect more of a scattershot approach. The complaint gripes about allegedly undisclosed customer discounts, changing technology, and changing customer usage patterns. There are even AI-related allegations; in paragraph 15, the complaint alleges that the company had ignored increased spending needed to accelerate Snowflake’s artificial intelligence initiatives. The defendants, the complaint alleges, “disregarded that the forecasted spend for this was previously understated.”

It is only after detailing all of these other alleged shortcomings that the complaint gets around to the alleged cybersecurity-related disclosure issues. And the cybersecurity-related disclosures are themselves distinctive in their own way. That is, the complaint does not allege that the company itself suffered a data breach; rather, the breach supposedly hit the company’s customers. And the breach is alleged to have occurred, at least in part, due to the customers’ own “lack of preparedness” and inability to “handle” the “responsibility” for customer security, as opposed to supposed shortcomings of Snowflake itself.  

To be sure, the complaint also alleges that “Snowflake’s systems actually impeded the adoption by customers of certain key security measures,” but even according to the complaint, the actual security issues that allowed the breaches to happen seem to have been on the customers’ systems. So the alleged security law violation apparently is that Snowflake failed to disclose that its customers had security vulnerabilities, as well as that Snowflake’s system architecture impeded the resolution of the vulnerabilities.

All of that said, perhaps the most notable thing about this complaint for purposes of this blog post is that it does involve cybersecurity-related allegations. As I noted at the outset, there has been less cybersecurity-related D&O litigation than some observers (including me) had anticipated when cybersecurity emerged several years ago as a D&O issue.

There appear to several reasons why there has been less cybersecurity D&O litigation than some expected. For starters, the claims that were filed were not as successful as the plaintiffs’ lawyers might have hoped. Also, these days share prices rarely react to data breach news, making cybersecurity cases less attractive for the plaintiffs’ lawyer.

The filing of this lawsuit – no matter how belated – does show that cybersecurity-related lawsuits do continue to be filed, and cybersecurity remains as an important potential source of D&O liability. As far as I know, this lawsuit is the first cybersecurity-related securities class action lawsuit to be filed so far in 2026. (Readers aware of other cybersecurity-related securities suit filings this year should please let me know.) This lawsuit filing comes after the filing last December of two cybersecurity suits (discussed in detail here), which as far as I know were the only two cybersecurity-related securities suits filed in 2025.

The bottom line is that while cybersecurity remains a continuing source of potential D&O liability, it has proven to be less of a factor than was originally anticipated when the issue first arose several years ago. It does remain as one of several standard issues on the list of concerns for corporate boards and management to watch and monitor, and likely will remain as one of the standard items of concern in the world of D&O liability.

One final note: the new securities complaint refers to the pending litigation that Snowflake’s customers filed against the company relating to the data breaches. Readers interested in learning more about this litigation, now pending in the District of Montana, will want to refer here.

The D&O Diary has been tracking how fragmented state and federal climate disclosure initiatives, along with rising anti-ESG litigation, are reshaping D&O risk. Vanguard Guard Group’s (Vanguard) recent settlement of the anti-ESG antitrust litigation that red state attorneys general (AGs) brought against the firm and several other asset management companies could mark a watershed moment in the intersection of ESG governance and D&O liability.

There was a time several years ago when ESG-related litigation involved allegations of “greenwashing” and relating to disclosures about sustainability. However, as illustrated by the State AGs’ lawsuit, litigation involving ESG-related allegations increasingly has involved a decidedly anti-ESG approach. Our December 1, 2024, D&O Diary post discussed the State AGs’ complaint against Vanguard and the other asset management firms and the State AGs’ claim that institutional investors and asset managers colluded on climate initiatives to the detriment of markets and consumers.

Vanguard’s settlement could intensify the scrutiny of asset managers trying to operate in an increasingly fragmented regulatory environment. At a time when some blue-state jurisdictions advance strict ESG mandates, conservative states are aggressively escalating anti-ESG legislation, investigations, and antitrust litigation. The following reviews the ESG antitrust litigation, key terms of Vanguard’s settlement, and the resulting implications for expanded D&O risk.

The ESG Antitrust Litigation

Led by Texas, a coalition of Republican attorneys general filed the underlying lawsuit, claiming that Vanguard, BlackRock, and State Street weaponized their massive stock holdings in public energy companies to depress coal output and suppress fossil fuel production in pursuit of climate targets.

The state AGs alleged that these “Big Three” asset managers weaponized climate-focused investor alliances and collective corporate stewardship to artificially suppress coal output, driving up energy prices and damaging both consumers and state economies.

Rather than limiting their challenge to disclosure disputes or breaches of fiduciary duty, the state AGs asserted that the asset managers’ coordinated sustainability stewardship constituted unlawful market manipulation under federal and state antitrust laws.

Vanguard’s Settlement

On February 26, 2026, Vanguard agreed to settle the litigation for approximately $29.5 million and to adopt a series of operational and governance restrictions that may prove more consequential than the monetary payment itself.

According to reports Vanguard agreed to comply with “passivity commitments” for a five-year period extending through June 2032. The commitments include limitations on climate-related shareholder engagement activity, restrictions on the use of divestment as a mechanism to pressure companies regarding environmental matters, and commitments not to advocate for carbon reduction targets at portfolio companies.

The settlement also reportedly requires Vanguard to provide expanded proxy voting flexibility to investors and to withdraw from certain climate-oriented investor organizations and initiatives, including the Principles for Responsible Investment (PRI). In addition, Vanguard purportedly agreed not to vote against directors solely on climate-related grounds.

BlackRock and State Street did not join the settlement and remain active defendants in the litigation.

Discussion

While the Vanguard settlement arose in the asset management sector, its broader implications extend far beyond investment firms, marking a structural shift in the intersection of ESG governance and D&O liability.

Earlier ESG litigation often focused on greenwashing and fiduciary failures, penalizing companies that understated climate risks or overstated sustainability commitments; however, that pattern has shifted over the past several years. The AG antitrust litigation reflects an inverse theory: companies may face direct liability for pursuing ESG initiatives too aggressively. This could create a challenging environment for boards, as actions praised by one constituency or jurisdiction may trigger scrutiny or litigation from another.

Prior D&O claims also tended to involve securities fraud, derivative suits, or disclosure disputes. The multi-state coalition led by Texas reframes coordinated climate engagement as unlawful collusion among market participants. This theory has significant implications for corporate America. In particular, businesses participating in net-zero coalitions, climate alliances, DEI benchmarking groups, or other coordinated initiatives may face scrutiny over whether such collaboration constitutes anticompetitive conduct.

Moreover, shareholder engagement, proxy voting, and participation in industry initiatives have traditionally been viewed as routine corporate governance. Vanguard’s settlement out of the AG Antitrust lawsuit could suggest these activities now carry distinct regulatory exposures, meaning D&O underwriters may no longer treat proxy policies as neutral back-office functions.

The AG Antitrust ESG-related litigation remains pending amid deep regulatory fragmentation. The federal government’s retreat from mandatory climate disclosures stands in stark contrast to highly active, deeply divided state-level agendas. This geographic and political divergence complicates underwriting risk evaluation because insurers must evaluate not just if a company has ESG initiatives, but where those initiatives create localized legal friction.

This growing regulatory divergence could leave asset managers potentially facing a precarious dual-threat liability landscape: they risk enforcement from one set of regulators for doing too much on climate, and from another for doing too little.   Thus, D&O underwriters may want to scrutinize participation in climate alliances, checking if commitments to carbon-reduction campaigns create antitrust vulnerabilities.

In addition, the increasingly fragmented regulatory landscape could create a compounding “Catch-22” disclosure risk that may expand D&O risk. When a company modifies its narrative across different jurisdictions, it could leave a contradictory paper trail that can be weaponized by opposing factions of litigants. For D&O underwriters, this cross-jurisdictional whiplash could translate into D&O exposure, including material misstatement claims driven by inconsistent ESG positioning.

In addition, when anti-ESG critics or activist state AGs cite pro-ESG statements as evidence of “ideological bias” or “political activism,” they could be laying the groundwork for shareholder derivative suits alleging a breach of the duty of loyalty. The allegation may shift from poor business judgment to claims that directors abandoned their fiduciary duty to maximize shareholder value in pursuit of non-pecuniary social goals.

Ultimately, the Vanguard settlement may prove significant not only for its monetary size but also for signaling the politicization of ordinary corporate conduct. Texas Attorney General Ken Paxton has publicly praised Vanguard while castigating BlackRock and State Street for remaining “defiant.”  As a result, D&O underwriters may want to evaluate the geographic footprint of a company’s revenue and operations, along with its public-facing ESG statements.

Those who observe securities class action litigation filing patterns know that life sciences companies are frequent securities litigation targets. Though the number of securities suit filings against life sciences companies fluctuates from year to year, more recently the number of life sciences company filings has stabilized at higher levels, according to the latest annual report from the Sidley law firm. A copy of the law firm’s recent memo, entitled “Securities Class Actions in the Life Sciences Sector: 2025 Annual Survey,” can be found here. A two-page summary of the report can be found here.

According to the report, there were 44 new securities class action lawsuits filed against companies in the life sciences sector in 2025, the same number as in 2024. Though the number of life sciences securities suit filings was the same in 2025 as in 2024, this annual number of filings is significantly higher than in some prior years, and is the highest annual number of filings since 2021, when there were 49 suits filed.

Interestingly, the number of life sciences company filings was at higher levels compared to recent years even though COVID-19-related filings were not a factor in the volume of 2025 litigation filings, by contrast to prior years when the filings related to COVID were a significant factor in the number of life sciences company securities suit filings.

Of the 44 securities lawsuits filed against life sciences companies in 2025, 25 involved companies with products in the pre-approval stage, while 19 involved companies with mature products. The proportion of cases against developmental stage companies is in line with filing patterns in recent years. The majority of the cases against developmental stage companies arise from setbacks the company faced in the final stages of the regulatory approval process.

In addition to the life sciences company securities suit filings in 2025, the report also analyzes rulings and decision in cases against life sciences companies. The statistics show that – as has been the case in recent years – while plaintiffs’ lawyers often are quick to file securities suits against life sciences companies that have experienced setbacks, the reality is that many of these lawsuits prove to be unsuccessful, a pattern that remained in effect in 2025.

In 2025, there were 39 decisions in securities suits involving life sciences companies, at the motion to dismiss stage or at the summary judgment stage. The defendants were successful in over half of these decisions – that is, the defendant life sciences companies prevailed in 23 out of the 39 decisions, representing a success rate of 59%. The success rate in 2024 was also 59%.

As has also been the case in recent years, defendant life sciences companies fared better in pre-approval cases than in cases involving companies with mature products. That is, defendant life sciences companies won dismissal in 67% of the cases involving pre-approval companies (14 out of 21), but only 50% of the mature product cases (9 out of 18). The report suggests that the reason that plaintiffs may struggle to survive the dismissal motion stage in cases against pre-approval companies is because of the challenges plaintiffs face in establishing falsity and scienter in situations where the statements they attack concern inherently unknowable events – the outcome of clinical trials and the FDA approval process.

In addition to prevailing in these trial court rulings more than half of the time, life sciences companies were also successful at the appellate court level. According to the report, defendant life sciences companies won affirmance of dismissal in all three cases in which appellate courts issued rulings.

The report notes that among the trial court rulings in 2025 were various court decisions involving COVID-19-related cases. The report notes that these rulings are continuing so long after the pandemic’s initial outbreak because of the number of cases that were filed as the pandemic evolved, relating to companies whose fortunes prospered at the outset of the pandemic but whose fortunes waned as the pandemic eased. The report notes that the pandemic had unanticipated ripple effects for some life sciences companies. In particular, life sciences companies that experienced positive effects from the pandemic struggled to predict when and to what extent the pandemic’s positive effects would wane.

The report has further, more detailed analyses of the 2025 dismissal motion and summary judgment rulings. The report is quite lengthy, full of interesting information, and merits reading at length and in full.

The D&O Diary’s European assignment continued this week with a long weekend visit to Croatia, the southeastern European country located along the Adriatic Sea with a long, irregular coastline marked by numerous islands. This was a long overdue return visit to Croatia for us, after a memorable 2018 visit to Dubrovnik.

Croatia is about the geographic size of the U.S. state of West Virginia (roughly 22,000 sq. mi.) and has a national population of roughly 3.8 million (about the same as Los Angeles). The locals’ name for their country is Republika Hrvatska (which means Croatian in the local language). The country is in the Eurozone. Just about everybody we encountered during our trip spoke English. It is also a really beautiful place with a great climate and great people.

Our first stop in Croatia was a brief visit to Zagreb, the country’s capital and largest city. The city is divided between its older Upper Town (Gornji Grad), consisting primarily of the formerly separate districts of Gradec and Kaptol, and its newer Lower Town (Donji Grad).

There is one very important thing you need to know about Zagreb, and that is that on March 22, 2020 (at a time when the rest of the world was preoccupied by other things), the city was hit with a massive earthquake, at 5.5 on the Richter Scale. The result was extensive damage to many of the city’s buildings, including, in particular, many of its historic structures.

Our visit to Zagreb was short and we were soon off to Split, Croatia’s second largest city, located on the Adriatic Coast. Though we had some rain in Zagreb, the weather in Split was just about perfect. Split is centered around the remarkably well-preserved Diocletian’s Palace, a Roman imperial palace complex that forms the heart of its old town.

On the peninsula to the west of Split’s old town is a huge, pine-covered park, known as Marjan Forest Park. We had originally intended just to walk up to the view point on the hillside above the city, but it was such a beautiful day and such a great walk that we wound up hiking the length of the park peninsula, about seven miles round trip.

On our final day in Croatia, we took a passenger ferry from Split to Hvar (pronounced “Far,” sort of), a large (115 sq. mi.) island located about 22 miles from Split. The ferry, which takes about 50 minutes, goes directly to the town of Hvar. The town has a scenic harbor, a central square, a hilltop fortress overlooking the town, and a promenade that goes along the shoreline for quite a distance.

We had one last evening in Split before it was time to head home. We had a light meal at an outdoor cafe on the Riva, and then we joined the evening promenade along the Riva. We were sorry to leave, we had a great visit to Croatia, and we returned home with a long list of islands and other destinations we have to see on our next visit. What a great place.

On May 11, 2026, the Supreme Court of New Jersey issued a highly anticipated ruling, holding that when an individual’s actions span both insured and uninsured capacities, that overlap in role-based conduct is sufficient to trigger the D&O policy’s capacity exclusion. Affirming the July 9, 2024, Appellate Court decision, with modifications, the Court held that the exclusion properly precluded coverage for an individual acting in multiple capacities, specifically regarding underlying self-dealing claims. The D&O Diary previously covered the appellate decision, which had completely denied coverage in full.

A May 12, 2026, LinkedIn post by Geoffrey Fehling of the Hunton Andrews Kurth law firm discussing the decision can be found here.

The Supreme Court’s ruling provides important guidance on three recurring D&O coverage issues: (1) the breadth of capacity exclusions; (2) dual-capacity conduct; and (3) whether an insurer forfeits coverage defenses by defending under a reservation of rights while declining to fund settlement. This article reviews the Court’s analysis of the underlying allegations and policy language, as well as the potential implications for future disputes involving overlapping executive roles in private equity, healthcare, and other complex corporate structures.

Background

The underlying litigation involved a multi-entity self-dealing scheme led by principal Joseph Krivulka. Minority investors in Akrimax Pharmaceuticals filed direct and derivative actions alleging that Krivulka systematically stripped Akrimax of valuable pharmaceutical product rights. According to the complaints, he diverted these assets to entities he controlled, including Mist Pharmaceuticals, which collected royalties and ultimately terminated Akrimax’s distribution licenses.

When Mist sought coverage for the lawsuits, its insurer denied the claim. Although Mist was an insured under the private-company D&O policy, its uninsured affiliates, including Akrimax, implicated the policy’s capacity exclusion. That distinction ultimately drove the coverage outcome. That distinction ultimately drove the coverage outcome.

The Capacity Exclusion

The policy’s capacity exclusion precluded coverage for claims “in any way involving” wrongful acts committed by an insured person while serving in various roles for an uninsured entity.

The Supreme Court emphasized the breadth of this language, particularly the phrase “in any way involving.” Relying on its prior decision in Norman International, the Court held that the exclusion does not require a strict causal nexus between the excluded conduct and the alleged loss. Rather, any overlap between the alleged misconduct and the insured’s role with an uninsured entity is sufficient to trigger the exclusion.

According to the Court, all material allegations in the underlying complaints involved Krivulka acting in his capacity as a director, member, or manager of uninsured entities, particularly Akrimax. The Court found “no allegation” against Mist, or against Krivulka in his insured role, that was independent of his activities involving uninsured entities. The claims therefore fell squarely within the exclusion.

The “Dual Capacity” Problem

The Court also addressed the increasingly common “dual capacity” issue. The insured argued that some of Krivulka’s alleged conduct occurred in his insured role with Mist and therefore should not be excluded. The dissent found this argument persuasive, reasoning that the exclusion should apply only to conduct undertaken solely in an uninsured capacity.

The majority rejected this narrower interpretation, adopting instead an expansive approach under which any claim involving overlapping uninsured capacities, even in part, may be barred in full.

For D&O underwriters, the ruling underscores the importance of outside-entity coverage provisions, insured entity definitions, and careful delineation of executive roles.

Reservation of Rights and Estoppel

The Court also considered whether the insurer forfeited its reliance on the exclusion by participating in the defense for several years. Mist argued that the insurer violated New Jersey’s good-faith standards by funding the defense and then disclaiming coverage shortly before settlement.

The Court rejected that argument, emphasizing that the insurer consistently and repeatedly reserved its rights under the capacity exclusion throughout the five-year claims process. The insurer reproduced the exclusion in multiple communications, invoked it at least ten times, and expressly disclaimed waiver or estoppel.

Under these circumstances, the Court concluded that Mist could not reasonably rely on any expectation that the insurer would fund a settlement or waive its coverage defenses.

The dissent viewed the issue differently, characterizing the insurer’s conduct as an untimely and unreasonable assertion of the exclusion. This divergence may prove significant in future disputes involving prolonged reservation-of-rights defenses.

Settlement Participation and the Duty to Indemnify

Finally, the Court addressed whether an insurer disputing coverage must participate in settlement negotiations. Mist argued that the insurer acted improperly by refusing to contribute to a $12 million global settlement, under which 25% of liability was allocated to Mist and to Krivulka in his role as chairman of its board.

The trial court agreed with the insured, but the Appellate Division reversed. The Supreme Court affirmed, holding that because the claims fell within the capacity exclusion, the insurer had no obligation to fund the settlement or provide indemnity.

The Court further concluded that the insurer’s refusal to participate in settlement negotiations did not constitute bad faith, given its consistent reservation-of-rights position.

Broader D&O Implications

First, it reinforces the expansive reach of capacity exclusions where policies employ language such as “in any way involving,” “related to,” or “arising out of.” Courts may continue to interpret such provisions broadly, increasing the likelihood that coverage will be denied where uninsured entities are intertwined with the alleged misconduct.

Second, the ruling highlights the risks posed by overlapping executive roles in founder-controlled businesses, healthcare enterprises, private equity structures, and affiliated company groups. It underscores the importance of carefully structuring outside-entity coverage and ensuring that relevant entities are properly scheduled.

The decision also highlights a recurring gap between how capacity exclusions are written and how policyholders expect them to operate in real-world “dual capacity” scenarios. One practical takeaway for D&O underwriters is that this outcome may be avoidable through more precise policy wording. For example, policies could clarify that coverage applies to claims “to the extent” the insured person was acting in an insured capacity, even if the same course of conduct also involved service in an uninsured capacity.

Conversely, exclusions could be drafted to apply only “to the extent” the individual was acting in an uninsured capacity, rather than barring coverage in its entirety based on any involvement of such a role. At a minimum, a more balanced approach, consistent with the reasonable expectations of insureds, may recognize that individuals frequently act in multiple capacities and should remain covered at least for that portion of their conduct undertaken in an insured capacity.

Finally, as D&O insurers continue to defend under reservations of rights while evaluating allocation and indemnity issues, disputes over when such reservations become prejudicial may intensify. This decision may emerge as a leading case on dual-capacity claims, reservation-of-rights practices, and the scope of D&O capacity exclusions.

It is a well-established fact that securities class action lawsuits rarely go to trial. In most cases, the lawsuits are either dismissed or settled. However, there has been an interesting recent uptick in the number of securities suits going all the way to a jury verdict. In the latest example of this development, on May 14, 2026, a federal court jury entered a defense verdict following trial in the long-running ExxonMobil securities class action lawsuit. As discussed below, this verdict is the latest of several post-trial verdicts entered in securities suits this year. A May 14, 2026, Law360 article about the verdict can be found here.

As discussed here, a plaintiff shareholder first filed this action in the Northern District of Texas against ExxonMobil and certain of its directors and officers in November 2016. The lawsuit as originally filed raised a number of allegations, including in particular that the defendants misrepresented the profitability and valuation of the company’s operations at Kearl Lake in Canada and its Rocky Mountain dry gas assets. In August 2018, the defendants’ motion to dismiss was largely denied, as discussed in detail here.

Trial in the matter commenced in late April 2026. The trial proceeded for three weeks. The jury delivered its verdict on May 14, 2026. The jury found for the defendants and against the plaintiffs on all counts. A May 15, 2026, statement from Exxon’s defense firm about the verdict can be found here.

Discussion

Though securities class action lawsuits rarely proceed all the way through trial, there recently has been a rash of jury verdicts in securities suits. By my count, this case is the third securities suit to proceed through trial to verdict so far in calendar year 2026. As discussed here, the Armistice Capital case went to verdict in April 2026, and the Elon Musk/Twitter Acquisition case went to verdict in March 2026, as discussed here.

The three jury verdicts so far this year are noteworthy if for no other reason than that such verdicts are so rare. There have been over 7,000 securities class action lawsuits filed in the U.S. since the beginning of 1996, and by my count only about 30 cases have gone to trial (inclusive of the three cases that went to trial this year). That is, only about one-half of one percent of all securities suits go to trial. All the rest are dismissed or settled (or are currently in process).

It is also noteworthy that this case resulted in a defense verdict, as did the Armistice Capital case in April. I have long thought that if more securities suits went to trial, fewer cases would be filed. The two recent defense verdicts might help advance this prospect. However, it should be noted that the Elon Musk/Twitter Acquisition case resulted in a partial verdict in plaintiffs’ favor. So the potential messages from recent verdicts is at best mixed.

There is another noteworthy thing about the recent ExxonMobil verdict and that is that this case as originally pitched was built in significant part on climate change-related allegations, as detailed in my post about the plaintiff’s initial complaint (here). In essence, the asset valuation issues the plaintiff raised had to do with questions surrounding the valuation of hydrocarbon assets whose economic value might not be realized due to changing regulation and cultural views arising in response to climate change.

From the publicity surrounding the recent trial of this case, it appears that as this case progressed the plaintiff lawyers de-emphasized the climate change-related allegations. It does not appear that the climate change-related allegations were a particular focus at the trial, which is interesting since at the outset the climate change related allegations were a major point of focus.

In any event, for observers of directors’ and officers’ liability issues, the fact that three cases have gone to trial this year is interesting and potentially significant. To be sure, the trial in this ten-year-old case was a long time coming, and it arguably is only coincidental that it happened to go to trial now. But nevertheless there is something very interesting about the fact that so many securities suit have recently gone to trial. The question is whether the recent rash of trials represents an indication that we might need to anticipate that more cases may go to trial than has been the case in the past.

The D&O Diary is on assignment in Europe this week, with a first stop in the Bavarian city of Munich. Munich is such a comfortable, walkable place, with rich history, interesting local traditions, and a vibrant arts culture. Munich is one of my favorite places to visit and I was glad to be back again to enjoy the city.

The primary purpose of my visit to Munich was to participate as a speaker at Munich Re’s annual Casualty Claims Days event. The meeting was held offsite in Munich Re’s recently refurbished classroom and event building. The conference was well-organized and well-attended and I enjoyed being a part of it. My thanks to Li Hanxing and Rainer Hanselmann of Munich Re for inviting me to attend, to Jenny Sofia Hoegen of Munich Re for all of her assistance in coordinating my attendance and participation, and to everyone at Munich Re for being such good hosts while I was in Munich.

I really do enjoy Munich and I would gladly have stayed there longer, but I was soon off to other destinations. As I noted at the outset, Munich really is one of my favorite places to visit.

The recent securities and derivative litigation involving e.l.f. Beauty reflects a familiar D&O liability pattern: a high-growth narrative challenged by operational headwinds, followed by securities litigation and a derivative action. While e.l.f. and its D&Os achieved meaningful success at the motion to dismiss stage, the survival of certain securities claims and a recently filed a derivative complaint in Delaware highlights the potential of prolonged D&O exposure.

The Securities Class Action Complaint

The securities class action against e.l.f. and certain of its senior executives was filed on March 6, 2025, in the Northern District of California and alleges violations of Sections 10(b) and 20(a) of the Securities Exchange Act arising from alleged misrepresentations concerning demand, inventory, and financial performance (e.l.f. SCA).

According to the e.l.f. SCA, the company repeatedly emphasized its “exceptional, consistent, category-leading growth” while allegedly concealing a deterioration in consumer demand that began to emerge in 2024. The plaintiffs contend that, as demand slowed, inventory levels increased significantly; not as a result of strategic planning to meet demand, but rather because products were not selling at anticipated levels. The complaint alleges that the company mischaracterized these inventory increases, attributing them to supply chain timing and growth initiatives rather than weakening demand.

The complaint also focuses on the distinction between “sell-in” and “sell-through” sales and cites a November 20, 2024, Muddy Waters report alleging concealed inventory challenges. Plaintiffs argue that limited visibility into key retail channels, including Ulta Beauty, created an informational gap between internal performance data and public disclosures. Plaintiffs also rely on confidential witnesses who claim that internal data reflected declining sales trends, excess inventory, and missed projections during the latter half of 2024.

Following the publication of the Muddy Waters report and subsequent company disclosures addressing slowing growth and demand trends, the company’s share price declined significantly. Plaintiffs allege that these events revealed the extent to which prior statements may have been misleading, resulting in investor losses.

The e.l.f. SCA Partial-Dismissal Order

On February 6, 2026, the Northern District of California granted the defendants’ motion to dismiss in part while allowing certain claims to proceed.

The court found that many of the challenged statements were either made before the alleged adverse trends emerged, were consistent with the alleged facts, or constituted non-actionable puffery and corporate optimism. Generalized statements regarding growth, confidence, and performance were insufficient to support a securities fraud claim.

However, the court concluded that plaintiffs adequately alleged falsity and scienter with respect to a narrower set of statements made in November 2024, including statements by the company’s CEO during a televised interview responding to the Muddy Waters report. In that context, the court found that statements asserting that inventory levels were built to meet strong demand could be misleading if, as alleged, demand was in fact weakening at the time.

Accordingly, the court sustained Section 10(b) claims against the company and one executive based on these statements, while dismissing all other claims.

The Follow-On Derivative Action

The Verified Stockholder Derivative Complaint, filed on April 9, 2026, asserts claims that largely track the allegations in the e.l.f. SCA.

The derivative complaint alleges that the company’s directors and officers breached their fiduciary duties by failing to oversee operations adequately, disseminating misleading information, and allowing inventory levels to rise while demand declined. The complaint also includes insider trading allegations, asserting that certain executives sold stock while in possession of material nonpublic information.

Notably, the derivative complaint relies on the partial denial of the motion to dismiss in the securities action to support its claims and to bolster its demand futility arguments, illustrating how even a limited survival of claims can fuel follow-on litigation.

Discussion

From a D&O underwriting perspective, the e.l.f. litigation highlights the exposure associated with companies whose valuation narratives depend heavily on sustained growth. When a company emphasizes consistent, category-leading performance, even modest deviations from that trajectory, particularly when executives publicly address emerging concerns about demand or performance, can give rise to allegations that prior disclosures were misleading.

In addition, the case provides an example of litigation risk associated with informational asymmetries. Here, the alleged lack of visibility into “untracked” sales channels allegedly created a gap between internal data and public disclosures. For D&O underwriters, companies that rely on metrics that may not be independently verifiable by investors can present increased disclosure risk, particularly where those metrics are central to the company’s valuation narrative.

The court’s ruling may also illustrate, for both courts and market participants, the importance of distinguishing between non-actionable corporate optimism and actionable misstatements. While many of the challenged statements were dismissed as puffery, the survival of claims tied to specific, contextual statements, particularly those made in response to negative external reports, demonstrates that a discrete set of statements can sustain a securities claim where plaintiffs adequately allege contemporaneous contradictory facts.

More broadly, the decision reflects a practical reality in securities litigation: dismissal of most claims may not materially reduce overall D&O exposure. Even a narrow surviving claim can sustain a securities class action through discovery and, as this case demonstrates, provide a foundation for follow-on derivative litigation.

Finally, the derivative action highlights the extended lifecycle of D&O claims. Even where defendants achieve meaningful success at the motion to dismiss stage, the survival of any securities claims can lead to additional litigation, prolonging defense costs and increasing overall exposure. Derivative suits also introduce distinct risks, including the potential for non-indemnifiable loss, corporate governance reforms, and fee awards.

For D&O underwriters, a key takeaway should be that litigation outcomes are often more nuanced than they initially appeared. A “partial win” at the motion to dismiss stage may still carry significant downstream consequences, particularly where it enables plaintiffs to proceed into discovery and fuels parallel or follow-on actions.

Historically, companies have resolved SEC enforcement proceedings by agreeing to pay a fine or penalty, with the payment funds drawn from the corporate treasury. More recently, the agency has signaled an interest in ensuring that enforcement action resolutions involving individual liability, as a means of encouraging both accountability and deterrence. In the following guest post, Ashwin J. Ram, a partner at the Buchalter LLP law firm, examines the SEC’s individual accountability approach and considers the implications. I would like to thank Ashwin for allowing us to publish his article as a guest post on this site. Here is Ashwin’s article.

***********************

For the better part of a decade, SEC enforcement followed a familiar script: the company pays a substantial penalty, neither admits nor denies the findings, and everyone moves on. Officers and directors watched from the sidelines while the corporate treasury absorbed the blow. Shareholders — the people the SEC is supposed to protect — ended up paying for the misconduct through diluted earnings and depleted reserves.

That script may be a relic of the past.

At SEC Speaks 2026, Acting Enforcement Director Sam Waldon and Deputy Director Nekia Hackworth Jones made the new posture explicit: the Commission is no longer interested in collecting large corporate penalty checks while individuals escape accountability. Waldon framed it as a quality-over-quantity mandate; Hackworth Jones provided the operational details — evaluating individual culpability, scienter, and severity before recommending remedies. Individual liability is now the primary deterrent mechanism. The 2006 Statement Concerning Financial Penalties — largely dormant for years — is back as the governing framework for corporate penalty recommendations. And the threshold question the staff must now answer before recommending a corporate penalty is whether the penalty will harm the very shareholders the enforcement action is meant to protect.

Assuming this is not rhetoric, it is an operational directive that will likely reshape how SEC investigations are conducted, how cases are resolved, and how companies, officers, and D&O carriers should respond.

The 2006 Penalty Statement: What It Actually Says

The 2006 Statement was the Commission’s attempt to articulate when corporate financial penalties are appropriate. It identified two threshold considerations: (1) whether the penalty will harm innocent shareholders more than it deters future misconduct, and (2) whether individual liability — rather than entity penalties — would be a more effective and equitable deterrent.

The Statement also adopted the so-called Seaboard factors for evaluating corporate cooperation: self-reporting, remediation, cooperation with the investigation, the quality of compliance programs, and whether the entity obstructed the investigation. These factors never went away in theory. In practice, they were overwhelmed by a regime that prioritized headline penalty numbers.

What changed at SEC Speaks is that the Commission publicly recommitted to applying the Statement as written: start with the individual, and calibrate the corporate penalty to cooperation and remediation rather than headline impact.

Why This Shift Matters More Than It Appears

On the surface, prioritizing individual liability sounds like a narrowing of enforcement. It is the opposite.

Under the old regime, a company could resolve an SEC investigation by negotiating a penalty amount, implementing remedial measures, and moving on — often without any individual officer facing charges. The investigation ended when the check cleared. Defense counsel for individuals could reasonably argue that the matter was resolved and that bringing a follow-on case against their client would be duplicative or disproportionate.

The new posture eliminates that off-ramp. The Commission is now building individual cases from the outset of an investigation, not as an afterthought once the corporate resolution is complete. Waldon’s remarks made clear that Enforcement is hiring — and that the quality-over-quantity directive does not mean fewer cases. It means each case will be more focused on individual conduct, individual scienter, and individual consequences.

For corporate officers, this means several things simultaneously.

Separate counsel is no longer optional — it is a necessity. Joint representation between a company and its officers has always been fraught with the potential for conflicts. Under the new regime, those potential conflicts will be tested early. The company’s interests — cooperate, remediate, minimize the penalty — might be structurally adverse to the officer’s interests in a way they were not when the corporate penalty was the endgame. Officers who delay retaining personal counsel risk having their fate negotiated by lawyers whose primary obligation runs to the entity.

D&O carriers need to re-evaluate their exposure models. The shift toward individual liability directly increases the frequency and severity of D&O claims. Under the prior regime, many investigations resolved at the entity level without triggering Side A coverage (which covers individual officers when the company does not indemnify). Under the new regime, individual enforcement actions will become more common, individual defense costs will increase, and individual settlements or judgments will be larger. Carriers underwriting D&O risk based on historical claims data that reflected the old enforcement posture are pricing an outdated risk exposure model.

Early notice to D&O carriers is now a strategic imperative, not an administrative task. When the SEC opens an investigation that may target individual officers, the notice clock starts. Late notice remains one of the most litigated coverage defenses. Under the old regime, companies sometimes delayed notice because the investigation appeared headed toward a corporate resolution that would not trigger individual coverage. That calculation is no longer safe. Defense counsel should advise immediate notice to all potentially implicated towers upon learning of any SEC investigation that involves individual conduct — even if no Wells notice has been issued to any officer.

The Cooperation Calculus Flips

The Seaboard factors have always incentivized corporate cooperation. But under the new framework, cooperation means something different — and something more uncomfortable for the individuals involved.

The Commission evaluates whether the company made individuals available for testimony, produced communications promptly, and refrained from impeding the investigation of individual conduct. Under the old regime, companies could cooperate at the entity level while quietly coordinating with officers to present a unified narrative. That coordination is now riskier: a company that appears to be protecting its officers will not receive cooperation credit — and may face an enhanced corporate penalty on top of individual charges. The revised Enforcement Manual codifies cooperation credit factors but creates no tiers, no fixed credits, and no declination grid. It remains a qualitative, case-specific judgment with full staff discretion.

This creates an acute tension in the boardroom. Directors must balance their duty to the corporation (which favors maximum cooperation credit) against officers who may be investigation targets (which requires careful attention to individual rights). Boards that do not establish clear protocols for managing this tension — including retaining independent counsel for the board itself — will find themselves exposed on both sides.

What the ADM Case Tells Us

The Commission highlighted the In re Archer-Daniels-Midland Co. accounting fraud case as a paradigm for the new approach. In January 2026, the SEC charged ADM and three former executives — Vince Macciocchi, the former President of ADM’s Nutrition segment; Ray Young, the CFO; and Vikram Luthar, the former CFO of ADM’s Nutrition segment who later served as ADM’s overall CFO — for manipulating inter-segment transactions to inflate Nutrition’s operating profit. When Nutrition was in danger of missing its forecasts, management pressured employees to identify “adjustments” — retroactive rebates and pricing changes not available to third-party customers — that shifted operating profit from other ADM segments into Nutrition. The result was that ADM’s public disclosures claiming inter-segment transactions were recorded at amounts “approximating market” were false.

ADM paid a $40 million civil penalty. But the individual consequences tell the real story: Macciocchi agreed to disgorgement, a civil penalty, and a three-year officer-and-director bar. Young agreed to disgorgement and a penalty. Luthar is contesting the charges and preparing for trial.

Three features make this case a template. First, the enforcement action targeted individuals by name — not as an afterthought to the corporate resolution, but as the core of the case. Second, the evidentiary theory centered on the gap between what management knew internally (that the adjustments were artificial) and what it communicated externally (that inter-segment pricing approximated market). That gap — between private knowledge and public statements — is the template for the individual liability cases the Commission intends to focus on going forward. Third, the penalty structure tracks the new philosophy exactly: a corporate penalty calibrated to avoid excessive shareholder harm, paired with personal consequences (bars, disgorgement, penalties) designed to deter the individuals who made the decisions.

Defense counsel should advise clients to audit that gap now, before an investigation begins. The question is not whether the company’s disclosures are technically accurate. The question is whether internal communications — emails, Slack messages, board decks, earnings call prep materials — tell a different story than the public filings. If they do, the new enforcement regime makes it far more likely that the individuals responsible for that divergence will face personal consequences.

Practical Steps for Boards, Officers, and Carriers

For boards: Establish investigation-response protocols before the investigation arrives. Identify independent counsel for the board. Create clear guidelines for when individual officers should retain separate counsel. Review indemnification provisions and ensure they are current with the company’s actual exposure profile.

For officers: Retain personal counsel at the first sign of an SEC investigation touching your area of responsibility. Do not rely on company counsel to protect your individual interests. Preserve all communications — the document retention obligation attaches when an investigation is reasonably anticipated, and destruction of evidence in the current environment is an accelerant, not a defense.

For D&O carriers: Recalibrate loss models to account for increased frequency of individual SEC enforcement actions. Review notice provisions and ensure policyholders understand their obligations. Consider whether current Side A limits are adequate in an environment where individual defense costs and settlement values will increase. Engage proactively with insureds about early-notice protocols.

The SEC’s message is clear: the era of corporate penalty checks substituting for individual accountability is finished. Companies, officers, and their insurers who recognize this shift and prepare for it will navigate the new landscape far better than those who treat it as a temporary policy preference.

Ashwin J. Ram is a partner at Buchalter LLP in Los Angeles. A former Assistant U.S. Attorney in the Major Frauds Section, he focuses on white collar defense, securities litigation, and crisis management. He has successfully navigated D&O coverage issues in a variety of investigations, securities class actions, and SEC investigations. He can be reached at aram@buchalter.com.