One of the most hotly – and frequently – contested D&O insurance coverage issues involves the question of the preclusive effect of the policy’s Bump-Up provision. There have been a host of decisions in recent years addressing this issue, with some finding in favor of coverage and some ruling against coverage. In the latest in this series of cases, the Delaware Superior Court held that the Bump-Up provision precluded coverage for the settlement of litigation arising out of the acquisition of Madison Square Garden Networks. As discussed below, the decision raises some interesting questions about the Bump-Up provision and how it is to be applied. A copy of the June 24, 2026, opinion in the case can be found here.

Background

This insurance dispute arises out of the 2021 merger of Madison Square Garden Networks (MSGN), a sports content development and distribution company, and Madison Square Garden Entertainment (MSGE), now known as Sphere Entertainment, which operates sports and entertainment venues. Prior to the Merger, the Dolan Family Group owned around a quarter of both companies but held a majority of the voting power of both. In July 2021, the two companies executed a stock-for-stock reverse triangular merger, in which MSGN combined with an MSGE subsidiary, becoming MSGE’s wholly owned subsidiary.

After the merger, MSGN’s Class A shareholders sued MSGN’s directors in Delaware Chancery Court. The MSGE shareholders also filed a derivative suit relating to the merger. The two actions were consolidated. Both sets of shareholder plaintiffs alleged that the merger process was unfair and that their stock had been undervalued.

In March 2023, the MSGN action settled for a payment of $48.5 million to the shareholders. Two of MSGN’s D&O insurers each separately consented to advance $10 million toward the settlement, with the understanding that the insurers could recoup the advance if the policy didn’t provide coverage. MSGN paid the rest of the settlement cost. The MSGE derivative suit separately settled for $85 million.

At relevant times, MSGN maintained a program of D&O insurance consisting of a primary policy and several excess policies. The primary policy contained a so-called Bump-Up Clause, which, as the court later described it, provides that “amounts paid in acquisition-related litigation that represent or are substantially equivalent to an increase in consideration aren’t covered.” The insurers contended that the Bump-Up provision precluded coverage for the settlement.

MSGN filed an action in the Delaware Superior Court seeking a judicial declaration that the settlement amount was covered under the D&O insurance program. The insurers countersued, seeking a judicial declaration that the Bump-Up provision precluded coverage for the settlement. The parties cross-moved for summary judgment.

Relevant Policy Provision

The Bump-Up Provision provides that:

Loss does not include any portion of such amount that constitutes any:  … (3) amount that represents, or is substantially equivalent to, an increase in the consideration paid (or proposed to be paid) in an acquisition  (or proposed acquisition) of more than 50% of the outstanding securities or other ownership interest of an entity, including an Organization, or in the right to vote for election of, or to appoint, more than fifty percent (50%) of the directors or limited liability company managers or members, or the equivalent of such positions, of an entity, including an Organization; except for any amount otherwise covered under Insurance Clause (A).

The June 24, 2026, Opinion

In an opinion published on June 24, 2026, Delaware Superior Court Judge Paul Wallace granted the insurers’ summary judgment motions and denied MSGN’s summary judgment motion, holding that the settlement satisfies all of the criteria of the Bump-Up provision and therefore that the provision precludes coverage.

Judge Wallace first determined that the settlement represents both an increase in consideration and the substantial equivalent of an increase of consideration. In concluding that the settlement amount represents an increase in consideration, Judge Wallace considered four factors: (1) the Settlement’s language; (2) indications that the Settlement amount represents consideration for an inadequate deal price; (3) the stage of the litigation at the time of the settlement; and (4) the settlement class’s composition. Judge Wallace found that each of these factors supported the conclusion that the settlement represented an increase of the deal consideration, though also noting that “none are dispositive.”

Among other things, Judge Wallace noted that in seeking approval of the settlement, the MSGN shareholders had informed the court that the Settlement represented an 8.8% increase in consideration, contending that the settlement was a substantial “get.” In approving the settlement, the Chancery Court said that the settlement represented a “meaningful benefit,” which Judge Wallace said is “strong evidence that Settlement indeed constituted an increase in consideration.”

MSGN had tried to argue that the settlement agreement itself stated that the parties had settled solely to avoid the costs and burden of litigation. Judge Wallace said that this “doesn’t wholly foreclose the conclusion that the Settlement represented an increase in consideration.” Judge Wallace also noted that the shareholders had, in fact, sued for an increase in consideration, and that the class that received the benefit of the settlement consisted exclusively of persons who sought an increase in consideration. Judge Wallace noted that “upon a hard look at what the Settlement represents, the Insurers have shown it constitutes an increase in consideration.”

Judge Wallace also concluded, consistently with the Delaware Supreme Court’s opinion in its recent Harman decision, that the reverse triangular merger transaction was an “acquisition” within the meaning of the Bump-Up provision, as it is “an acquisition effectuated via a merger mechanism.” MSGN had tried to argue that the transaction was not an acquisition, because the Dolans controlled both companies before and after the transaction, and therefore there was no change in control. Judge Wallace rejected this argument because it depended on a “change in control” requirement that was not in fact in the Bump-Up provision.

Judge Wallace ruled that the Bump-Up provision precluded coverage for the settlement, that the excess insurers who had advanced their limits were entitled to recoup the advanced amounts, and that the Bump-Up provision’s preclusive effect applied to the entire settlement amount including amounts awarded out of the settlement fund to pay attorney’s fees and expenses.

Discussion

As I noted at the outset, the potential preclusive effect of the Bump-Up provision may be one of the most hotly and frequently contested issues in the world of D&O insurance coverage. The provision is so frequently disputed for several reasons: the amount of money at stake is often huge; and the transactions involved are often highly complex, allowing room for the parties to argue about what the transaction represented. Moreover, there is almost always an argument about what the underlying settlement represents – is it really an increase in consideration?

Given these factors, it is arguably unsurprising that there are cases going both ways, some courts finding in favor of coverage, and some finding coverage precluded. Indeed, in his analysis in this case, Judge Wallace considered in depth two recent Bump-Up provision cases, one (the Fourth Circuit’s May 2025 opinion in the Towers Watson case) finding that the provision precluded coverage, and the other (the Delaware Supreme Court’s January 2026 opinion in the Harman case), which held that the provision did not preclude coverage. (Students of D&O insurance case law will note that Judge Wallace was the trial court judge who ruled in favor of coverage in the Harman case.)

MSGN here tried to lean heavily on the Harman opinion, and in particular on the language in the settlement agreement here that the parties had entered the settlement solely to avoid the costs and burden of litigation. Judge Wallace concluded that this case was distinguishable from Harman, based on what the shareholders had told the Chancery Court about the settlement and what it represented.

What the opinion in this case shows is that, in light of Harman, parties disputing the applicability of the Bump-Up provision must now fight their way through an evidentiary record scrutinizing the motivations of the parties to the underlying settlement. From my perspective, this is unnecessarily convoluted (particularly the cumbersome four-factor analysis Judge Wallace deployed here).

I agree with the dissenting opinion in Harman that it would be “far simpler and more efficient if the court limited its review to the ‘real effect’ of the settlement rather than plumb the depths after an evidentiary proceeding in search of the true motivations of the settling parties.” Moreover, settling parties, in settling cases, may now try to “skew” the record with recitations and so on to try to affect a later coverage dispute.

If the pattern in earlier cases is any indication, it seems likely that this case too will now make its way to the Delaware Supreme Court, so there may still be more to be heard about the Bump-Up exclusion (and, I strongly suspect, about the Harman opinion as well).

Where does all of this now leave us with respect to Bump-Up cases? I think we are now in the same place we have always been, which is that the outcome of a Bump-Up dispute is going to be a reflection of the policy wording, the deal structure, and the governing law. The appeal of this case could have more to say about whether and to what extent, in light of Harman, the motivations of the parties to the underlying settlement should also matter.

I will leave for another day the question of whether the Bump-Up provision should even apply (or rather, be written so as to apply) to transactions (like the one here) where the insured entity is the target of the acquisition. The Bump Up provision makes more sense in the context of a transaction where the insured entity is the acquiror; the entity should not be able to underpay for an acquisition and then expect its insurer to make up the shortfall. But when the insured entity is the target, the allegation is that, in breach of their duties (that is, through the commission of wrongful acts), the company’s executives sold their company too cheaply, to the financial detriment of the entity’s shareholders. That starts to sound to me an awful lot like the kind of thing that D&O insurance was invented to insure against.

My thanks to the several loyal readers who sent me a copy of Judge Wallace’s opinion.

As we have detailed in numerous posts on this site, Artificial Intelligence (AI) is an important area of emerging corporate risk. AI also represents an important corporate governance challenge for companies and their boards. In the following guest post, Patrick Meson takes a detailed look at the nature of AI-related corporate risks and considers the corporate governance implications. Patrick is a Corporate Counsel at a New York Investment Bank. Our thanks to Patrick for allowing us to publish his article on this site. Here is Patrick’s article.

*************************

For boards and the officers who advise them, the decision to deploy or build AI is a Caremark event. This piece traces the Delaware oversight chain from Caremark to McDonald’s and explains why personal, loyalty-based exposure attaches before the tool is ever switched on.

Abstract

U.S. corporations considering the adoption of a third-party AI tool, or the development of an internal AI application built on a third-party foundation model, face a legal landscape that is simultaneously unregulated at the federal level and densely governed by existing law. No federal statute prescribes how a company must govern its AI systems. Yet Delaware corporate law, sector-specific regulatory guidance, emerging state legislation, and commercial counterparty expectations jointly impose obligations that attach before a contract is signed and persist throughout the system’s operational life. This piece explains why the decision to deploy or develop AI is a governance event, not merely a procurement event; how the deploying company retains legal accountability for outputs it did not build and cannot fully inspect; and why the NIST AI Risk Management Framework, though formally voluntary, has become the operational standard against which corporate AI governance is assessed in litigation, regulatory examination, and enterprise procurement.

The Problem Arrives Before the Contract

When a company decides to deploy an AI tool within the organization, the decision may look like routine business at first. A request comes from HR, legal, finance, IT, or the business team. The paperwork looks like a standard software subscription. The vendor is reputable. The use case is clear. It is, by all appearances, a procurement event.

Except that it is not. The legal relationships created when a company deploys a third-party AI tool, or uses a third-party foundation model to build its own, are materially different from those created by conventional software procurement. The liability that attaches to getting those relationships wrong does not flow to the vendor; it flows to the company, and more specifically, under Delaware corporate law, to the directors and officers responsible for overseeing the company’s systems and controls. A board that treats an AI deployment as a standard procurement event, without the governance process that Delaware law now requires for mission-critical systems, could create a director and officer liability problem before the tool is ever turned on.

Three distinct legal exposure vectors make the AI adoption decision a governance event rather than a procurement one. The first is Delaware corporate law. It imposes a personal duty of oversight on directors and officers that attaches when the company deploys AI, which is itself a source of legal, operational, and compliance risk that requires board-level oversight. The second is the structure of the AI vendor market, in which contracts are systematically drafted to leave liability with the deploying company rather than the vendor. The third is a rapidly expanding patchwork of federal regulatory expectations and state legislation that attaches based on what the AI system does, where the company operates, and who is affected. The NIST AI Risk Management Framework is the practical answer to all three simultaneously.

First Exposure Vector: Delaware’s Duty of Oversight

Congress has not passed comprehensive AI legislation. No federal statute tells a U.S. company how to evaluate, procure, or govern an AI system. The executive orders issued by both the Biden and Trump administrations operate primarily on federal agencies, not private companies. Sector regulators have signaled expectations through examination guidance and enforcement posture, but their authority runs through existing statutes: the FTC Act, Title VII of the Civil Rights Act of 1964, the Equal Credit Opportunity Act, SEC disclosure rules. There is no AI statute that maps cleanly onto what a company must do when it decides to use an AI tool.

Delaware corporate law fills that gap. For the roughly two-thirds of Fortune 500 companies incorporated in Delaware, the fiduciary duty of oversight requires directors and officers to make a good-faith effort to implement and monitor the systems through which the company manages its material risks. When AI becomes one of those systems, the duty attaches.

The doctrinal foundation rests on five cases that together define what the oversight duty requires.

• In re Caremark International Inc. Derivative Litigation, 698 A.2d 959 (Del. Ch. 1996), established the original framework. Directors may face liability either for failing entirely to implement a reporting and information system, or for consciously disregarding red flags produced by a system they did implement. Both require bad faith, not mere negligence.
• Stone v. Ritter, 911 A.2d 362 (Del. 2006), confirmed that the Caremark duty is grounded in the duty of loyalty, not the duty of care. That distinction has direct practical significance: Delaware corporations routinely include provisions in their charters, authorized by DGCL § 102(b)(7), that exculpate directors from personal liability for duty-of-care violations. Those provisions do not protect against loyalty-based claims. A director who consciously disregards the need for an oversight system cannot hide behind an exculpatory charter provision.
• Marchand v. Barnhill, 212 A.3d 805 (Del. 2019), sharpened the standard considerably. Where a risk is mission-critical to the company’s business or compliance obligations, the board must install board-level oversight of that risk and cannot rely on management’s discretionary reporting as a substitute. When a listeria outbreak at the company killed three people, derivative plaintiffs sued the board for failing to oversee food safety. The Delaware Supreme Court held that the complete absence of any board-level committee or reporting process dedicated to food safety was sufficient to allow the claim to proceed past a motion to dismiss, even though the board had not been shown to have received and ignored a specific warning.
• In re Boeing Co. Derivative Litigation, 2021 WL 4059934 (Del. Ch. 2021), applied the same logic as Marchand to airplane safety. Boeing’s board had no committee responsible for it, received no regular safety reports, and failed to act after a fatal crash in 2018 provided an unmistakable warning.
• In re McDonald’s Corp. Stockholder Derivative Litigation, 289 A.3d 343 (Del. Ch. 2023), extended Caremark liability beyond directors to corporate officers within their respective areas of responsibility, substantially widening the personal exposure surface for senior executives.

Three features of the post-Marchand doctrine bear directly on AI adoption decisions.

First, the duty scales with criticality. Where a risk is mission-critical to the company’s business or compliance obligations, the board must install a board-level structure for monitoring it, not merely rely on management’s discretionary reporting. Whether that standard applies is a company-specific inquiry: AML monitoring is mission-critical to a bank; content-moderation algorithms are mission-critical to a social media or digital marketplace platform. The question is whether the AI system materially bears on a risk that is core to its business or compliance obligations, not merely whether the system could produce a harmful output. For companies where AI performs functions of that character, including credit decisioning, AML monitoring, hiring, insurance underwriting, or the handling of sensitive, confidential, or privacy-protected data at scale, the board-level oversight obligation almost certainly applies.

Second, the duty now extends to officers. McDonald’s confirmed that officers carry a Caremark duty of oversight within their areas of responsibility, scoped to their functional domain. Under the first Caremark prong, an officer must implement adequate oversight systems within that domain — the general counsel cannot discharge the obligation by approving a vendor contract without supervising what the vendor actually does; the chief compliance officer cannot discharge it by certifying that a monitoring program exists without verifying that it functions. Under the second prong, an officer who receives red flags indicating that existing oversight is failing and does nothing has consciously disregarded those warnings. The board’s oversight structure does not absorb either obligation; it supplements them.

Third, the standard is procedural, not technical. Directors are not required to understand how a large language model generates an output or what a transformer architecture does. What they are required to do is make a good-faith effort to design, validate, and supervise the company’s reliance on the system in light of its intrinsic opacity. As Pierluigi Matera’s recent paper frames it, AI does not change the Caremark standard; it changes the evidentiary terrain on which good faith is shown. (From Red Flags to Black Boxes, CLS Blue Sky Blog, Mar. 10, 2026; SSRN 6161886.) The inquiry is into process and documentation, not technical mastery.

Second Exposure Vector: Liability Does Not Travel With the Vendor Contract

The first thing corporate counsel should communicate clearly when a business unit arrives with an AI procurement request is this: legal accountability for what the system does does not transfer to the vendor when the contract is signed.

This is not intuitive. The assumption embedded in most procurement processes is that the vendor, who built and controls the model, bears the legal exposure for its behavior. In the AI context, that assumption is wrong in two distinct ways.

The first is contractual. AI vendor agreements, as a class, are structured to minimize vendor exposure and maximize deployer accountability. A recent market analysis found that 88% of AI vendors cap their own liability at the monthly subscription fee, while imposing broad indemnification obligations requiring the customer to hold the vendor harmless against discrimination claims, IP infringement claims, and regulatory actions arising from use of the tool. (Jones Walker, AI Vendor Liability Squeeze, 2026.) A procurement team that accepts vendor-drafted AI terms as standard boilerplate, without negotiating AI-specific liability and data-use provisions, will find that the resulting agreement transfers all meaningful risk to the company.

The second is regulatory and legal. Regulators have stated unambiguously that deploying a third-party AI tool does not transfer the deploying company’s compliance obligations. The Equal Employment Opportunity Commission (EEOC), the federal agency responsible for enforcing employment discrimination law, has confirmed that employers remain fully liable under Title VII when an AI screening tool produces discriminatory outcomes, regardless of whether the tool was built in-house or procured from a vendor. (Lexology, AI Use in Employment Decisions, Jan. 2026.) The same principle applies in financial services. The Consumer Financial Protection Bureau (CFPB) has stated explicitly that “there are no exceptions to the federal consumer financial protection laws for new technologies” and has required lenders using AI credit models to provide substantive, model-specific reasons for adverse actions rather than generic checklist responses, an obligation that falls on the deploying institution regardless of whether the underlying model was built by a third-party vendor. (CFPB Circular 2023-03; Skadden, Aug. 2024.) In July 2025, the Massachusetts Attorney General settled a fair lending action against a student loan company whose AI underwriting models produced disparate impact on the basis of race and immigration status, with liability attaching to the deploying institution for outcomes generated by its AI system. (Massachusetts AG Settlement, July 2025.) The FTC’s enforcement action against Rite Aid, arising from inadequate oversight, testing, and monitoring of a third-party AI facial recognition system, reinforces the same logic across sectors: the gap between what an AI system does and what the deploying company can demonstrate it understood, monitored, and controlled is the regulator’s target. (Cleary Gottlieb, Managing AI Risk, Jan. 2026.) Courts are developing the same logic through agency theory: in Mobley v. Workday, Inc., No. 23-cv-00770-RFL (N.D. Cal.), the court denied Workday’s motion to dismiss and, in May 2025, conditionally certified a nationwide ADEA collective action, allowing the case to proceed on the theory that Workday may be held directly liable as an agent of the employers who used its AI screening software to make hiring decisions. Under that theory, the vendor itself, not only the deploying employer, could bear liability for discriminatory screening outcomes.

The practical consequence is that a company acquiring a third-party AI tool acquires its outputs, its flaws, its biases, and its regulatory exposure along with its capabilities. Contractual provisions can partially mitigate that exposure: restrictions on the vendor’s use of company data for model training, audit rights, meaningful indemnification, and defined performance standards with remediation obligations each shift some risk back toward the vendor. But no contract eliminates the deploying company’s underlying regulatory and fiduciary obligations. The governance program built before deployment is what provides that foundation; the contract governs the vendor relationship within it.

The accountability analysis is sharpest for companies that go further than subscribing to a third-party tool and instead use a foundation model API from providers such as Anthropic, OpenAI, Google, or Meta to build their own internal application. That company is simultaneously a deployer and a functional developer: it makes design choices about the application’s structure, guardrails, data inputs, and human oversight requirements. Those design choices are the company’s own decisions, and the compliance obligation for their consequences belongs to the company accordingly. A pure subscriber exercises no control over the model’s training data, architecture, or update cycle; a company building on a foundation model API controls the application layer entirely. The greater the control, the greater the accountability, and the more important it is that the governance program reflect the company’s own design decisions, not merely its vendor management practices.

Third Exposure Vector: No Federal AI Law Does Not Mean No Law

The absence of a federal AI statute does not mean the absence of applicable law. Existing federal statutes govern AI-enabled conduct directly, and sector regulators have issued guidance, examination priorities, and enforcement positions that impose additional obligations on companies deploying AI in regulated contexts. Companies must account for both layers.

A few examples convey the texture of what companies face, though the landscape is considerably broader. The SEC has identified AI-based systems as a 2026 examination priority for registered advisers and broker-dealers, with examiners directed to assess whether automated tools operate consistently with regulatory expectations, specifically whether governance and validation structures exist. (SEC 2026 Examination Priorities.) The OCC, Federal Reserve, and FDIC apply model risk management guidance (SR 11-7) to AI and machine learning in banking, requiring documented validation, independent review, and board-level visibility for critical models.

At the state level, the legislative landscape has moved quickly, if unevenly. Texas’s Responsible AI Governance Act (TRAIGA), effective January 1, 2026, imposes risk assessment and transparency obligations on deployers of high-risk AI systems and provides an affirmative defense for organizations demonstrating alignment with a recognized governance framework such as the NIST AI RMF. California has enacted multiple AI-specific statutes imposing training data transparency requirements, mandatory disclosure and detection tools for AI-generated content, and impact assessment and opt-out rights for consequential automated decisions. New York City Local Law 144 requires independent bias audits for automated employment decision tools. More than thirty states introduced or passed AI-related legislation in 2025 alone. While the scope and approach vary, the legislation generally falls into two categories: liability-oriented statutes that assign responsibility for discriminatory or harmful AI outputs to the deploying company regardless of who built the model, and prescriptive governance statutes that impose affirmative obligations, including impact assessments, consumer disclosures, human review requirements, and incident reporting, on companies that deploy AI in high-risk contexts. The result is a patchwork of obligations triggered by use case, geography, and sector. There is no federal floor, but there is no regulatory silence either.

The Answer to All Three: Standards in the Absence of Statutes

The three exposure vectors described above share a common problem: none of them comes with a prescribed governance architecture. Delaware law requires a good-faith oversight system but does not specify what one looks like for AI. The vendor contract structure leaves liability with the deployer but does not tell the deployer how to govern what it has bought. The regulatory patchwork creates obligations triggered by use case and geography but provides no unified compliance framework.

The gap has been filled, not by legislation, but by the emergence of non-governmental and quasi-governmental standards that are quietly fashioning the unwritten rules of AI governance in the United States. The most significant of these is the NIST AI Risk Management Framework, but it operates alongside ISO/IEC 42001 (the international certifiable management system standard for AI), sector-specific adaptations developed by industry bodies such as the Bank Policy Institute and the Cyber Risk Institute in financial services, and a growing body of technical standards from the Institute of Electrical and Electronics Engineers (IEEE) and other standards development organizations. These instruments were designed as guidance, not law. But in a market where courts, regulators, investors, and customers all need some reference point for what responsible AI governance looks like, voluntary standards tend to acquire the authority that statutes have not yet supplied.

The NIST AI RMF: Voluntary in Name, Mandatory in Effect

The National Institute of Standards and Technology published the AI Risk Management Framework (NIST AI RMF) on January 26, 2023, under a congressional mandate in the National Artificial Intelligence Initiative Act of 2020. (NIST AI RMF.) Its operational companion, the AI RMF Playbook, maps each of the framework’s 72 subcategories to specific suggested actions and provides implementation guidance organized by role and context. Both are publicly available at no cost. Neither carries enforcement authority.

But in the absence of a federal AI statute, the NIST AI RMF has quietly become the closest thing the United States has to an authoritative standard for how companies should govern AI. Courts reference it to define reasonable conduct. Federal regulators use it as an assessment benchmark. State legislatures cite it as a compliance safe harbor. Enterprise customers demand alignment with it in procurement questionnaires. It was not designed to fill this role, and NIST did not claim it for one. But in a regulatory vacuum, a well-constructed voluntary framework developed by a credible federal agency, built with industry input, and aligned to international standards tends to become the default measure of what responsible governance looks like. The NIST AI RMF is now that measure, and organizations that cannot demonstrate alignment with it face an increasingly difficult question when things go wrong: if not this, then what?

The relevant question is not whether NIST can enforce the AI RMF. It cannot. The question is what happens to a company that cannot demonstrate alignment with it when its AI governance practices are examined.

There is a precedent that sheds light on how the NIST AI RMF is likely to be used and interpreted over time. The NIST Cybersecurity Framework, also voluntary, was introduced in 2014. Over the following decade it became the operational definition of reasonable cybersecurity practice: regulators cited it when assessing whether organizations had taken adequate precautions before a breach; courts used it to define the standard of care in negligence cases; insurers used it as an underwriting criterion. The AI RMF is following the same trajectory. (Jones Walker, 2026.) Three forces are driving that convergence.

• Litigation. Courts have not yet issued a body of decisions expressly citing the NIST AI RMF by name, but the trajectory is established. Under longstanding negligence and product liability doctrine, courts look to industry standards and voluntary frameworks to define the standard of reasonable care — and legal scholars and practitioners now widely expect the NIST AI RMF to fill that role for AI governance, following the same path as the NIST Cybersecurity Framework before it. (FPF, Incentives or Obligations, Mar. 2026; Harvard JOLT, Redefining the Standard of Human Oversight for AI Negligence, Feb. 2026.) A company that cannot demonstrate NIST-aligned processes faces an inference gap in litigation: it had no structured approach to governing a technology deployed into consequential decisions. In the Delaware Caremark context specifically, the NIST AI RMF Govern function maps directly onto the “information and reporting system” that directors must design in good faith. Undocumented adoption amplifies the appearance of abdication in discovery. (Matera, SSRN 6161886.)
• Regulatory benchmarking. The Treasury Department’s February 2026 release of the Financial Services AI RMF, developed with over a hundred financial institutions and providing 230 mapped control objectives with explicit “effective evidence” guidance for examiners, signals that examination readiness in financial services now means NIST-aligned documentation. (Treasury FS AI RMF, Feb. 19, 2026.) Texas’s TRAIGA provides an affirmative defense for NIST alignment. California and several other states reference NIST and ISO/IEC 42001 as compliance benchmarks.
• Commercial and contractual pressure. Enterprise procurement teams now routinely include AI governance sections in vendor due diligence questionnaires, asking specifically for AI inventories, documented approval workflows, framework alignment, and performance monitoring evidence. IBM’s research found that 63% of organizations either have no AI governance policy or are still developing one — precisely the gap that counterparties are now probing. Cyber insurers are adding AI-specific risk questions to renewal applications, with premium and coverage implications for organizations that cannot demonstrate governance maturity. A company that cannot produce governance documentation on demand faces deal friction that its competitors with structured programs do not.

The AI RMF is organized around four functions that apply across the AI system lifecycle. They are not post-deployment housekeeping. They describe a process that should be engaged before deployment and maintained throughout the system’s operational life, and they map directly onto the governance obligations that Delaware corporate law, federal regulators, and state legislatures are each, in their own ways, demanding.

Govern is the foundational function, and the one most directly implicated by Caremark. It requires the organization to establish the policies, roles, accountability structures, and decision-making processes that make risk management possible across all AI activities. In practice, this means defining who has authority to approve AI deployments, who owns each system once deployed, how AI risk is reported to senior management and the board, what the organization’s risk tolerance is for different categories of AI use, and what the incident response playbook requires when an AI system fails or produces harmful outputs. Without a functioning Govern structure, the other three functions have no organizational substrate to operate in, and a board cannot demonstrate the good-faith oversight system that Caremark requires. The AI inventory sits within Govern: a maintained catalog of every AI system in use, including shadow AI and AI features embedded in licensed platforms, is the prerequisite artifact for everything that follows.

Map requires the organization to identify and categorize the risk profile of each AI system before it is deployed. This means understanding the system’s intended use and the populations it affects; identifying the potential harms if it fails, produces biased outputs, or is used outside its intended scope; assessing external risks arising from the supply chain, including the developer’s own governance practices, the provenance and quality of training data, and dependencies on third-party foundation models or APIs; and determining which legal and regulatory obligations attach given the system’s function and the jurisdictions in which it operates. A company that deploys an AI hiring tool without first mapping its exposure under the EEOC’s Title VII guidance, NYC Local Law 144, and TRAIGA has not completed the Map function and has not made the threshold determination that Caremark requires before relying on a system for a mission-critical function. Map is also where the developer/deployer distinction becomes operational: a company building on a foundation model API must map not only the risks of the underlying model but the additional risks introduced by its own application layer design choices.

Measure addresses how the organization evaluates and monitors AI risk on an ongoing basis. Pre-deployment, this means testing the system’s performance against defined metrics, evaluating for bias and fairness across relevant demographic groups, assessing robustness against adversarial inputs, and documenting the results. Post-deployment, it means continuous monitoring for model drift (degradation in performance as real-world data diverges from the training distribution) and for emerging harms that were not apparent at launch. The Measure function is what makes the Caremark “secondary red flag” analysis operational: declining alert rates, anomalous performance on outcome metrics, and divergence between model outputs and external signals such as regulatory inquiries or whistleblower complaints are each measurable events. A governance program that defines the thresholds that trigger escalation, and documents its response when they are crossed, demonstrates the engagement that distinguishes oversight from abdication.

Manage covers the decisions the organization makes in response to identified and measured risks, and the ongoing operational disciplines that keep those decisions current. It includes the determination of how to respond to each risk: mitigate through system redesign or human oversight, transfer through contractual allocation, accept with documented rationale, or avoid by declining to deploy, as well as the incident response plan for when AI systems produce harmful outputs, the vendor governance processes that ensure third-party systems remain within their approved parameters, and the record-keeping that makes the entire program auditable. The Manage function is where vendor contract obligations become internal governance requirements: audit rights negotiated in the contract are only valuable if the organization has a Manage-function process for exercising them and acting on what it finds.

The International Dimension: EU AI Act Exposure for U.S. Companies

The four NIST functions align closely, in some respects nearly one-for-one, with the obligations imposed by the European Union’s AI Act (Regulation (EU) 2024/1689), the world’s first comprehensive binding AI law. That alignment matters for U.S. companies because the EU AI Act has explicit extraterritorial reach. Under Article 2, the Act applies to three categories of non-EU companies: providers that place AI systems on the EU market or make them available to EU users, regardless of where the provider is incorporated; deployers that have an establishment or are located in the EU (including a U.S. company’s EU subsidiary or office); and, most broadly, any provider or deployer established outside the EU where the output of the AI system is used in the EU. That last trigger is the one most U.S. companies underestimate: if a U.S. company’s AI system generates a decision, score, recommendation, or piece of content that affects a person located in the EU, the Act reaches the company regardless of where its servers or headquarters sit. (Baker McKenzie, EU AI Act scope; William Fry, Extraterritorial Reach of the AI Act.) The prohibitions on unacceptable-risk AI practices have applied since February 2, 2025. High-risk system obligations, covering AI used in employment, credit, healthcare, education, and critical infrastructure, were scheduled for full effect on August 2, 2026; a European Commission proposal currently in legislative process would push certain deadlines to December 2027, though that revision is not yet final.

For U.S. companies within the Act’s scope, the practical benefit of NIST AI RMF alignment is direct: the EU AI Act’s core obligations for high-risk systems, including risk management systems, data governance, technical documentation, human oversight, accuracy and robustness requirements, and conformity assessments, map onto the Govern, Map, Measure, and Manage functions respectively. A company that has built its governance program against the NIST AI RMF will have addressed most of the substantive requirements the EU AI Act imposes, and will be significantly better positioned for the conformity assessment and documentation obligations the Act requires than a company starting from scratch. The inverse is also true: a U.S. company that has deferred AI governance on the assumption that domestic law does not yet require it may find that its EU market exposure has already made compliance non-optional.

Conclusion: Where the Law Leaves a Corporation Today

Return to the question this piece opened with. A company decides to deploy an enterprise AI assistant across its workforce, or to build an internal application on a foundation model API. The business case is clear. The procurement process is underway. What does the law require?

The honest answer is that the law requires more than most companies currently do, and less than a fully mature AI governance program eventually demands. The obligations are real, they attach before deployment, and they flow from multiple directions simultaneously.

From a Delaware corporate law perspective, the board and responsible officers face a duty of oversight that is personal, grounded in loyalty rather than care, and not exculpable by charter provision. That duty requires a good-faith effort to put in place an information and reporting system adequate to the risk that AI creates, and to monitor it once deployed. For companies where AI is mission-critical to operations, compliance, or safety, the bar is higher: the board must have an express oversight structure, not merely rely on management’s discretionary reporting. The failure to build that structure before an AI-related harm occurs is, under the doctrine established across Caremark, Stone, Marchand, Boeing, and McDonald’s, the bad-faith fact that exposes directors and officers to personal liability.

From existing federal and state law, the obligations are sector-specific but pervasive. Employment law, fair lending law, consumer protection law, model risk management guidance, and securities regulation all apply to AI-enabled conduct through their existing authority. They do not create a unified AI compliance regime, but they create a dense web of exposure that attaches based on what the AI system does, where the company operates, and who is affected. A company deploying AI in hiring, credit, insurance, healthcare, or any function that generates consequential decisions affecting individuals is operating in a regulated environment whether or not it has analyzed that environment before deployment.

From the contractual structure of the AI market, the company retains liability that its vendor agreements will not absorb. Vendor contracts are structured to transfer risk to the deployer. The company that signs without negotiating AI-specific terms, without restricting data use, without securing audit rights, and without establishing performance obligations has accepted a contractual structure that places the regulatory, litigation, and reputational exposure squarely on itself.

The path forward runs through the NIST AI Risk Management Framework, not because it is mandatory, but because it has become the operational answer to the question that Delaware courts, federal regulators, and state legislatures are all asking in different ways: did this organization make a good-faith effort to govern its AI? A company that can demonstrate alignment with the four functions of the NIST AI RMF, that has built the governance program the checklist below describes, and that has maintained the documentary record that reflects genuine engagement, has given itself the strongest available defense in litigation, the clearest evidence of good faith in regulatory examination, and the most credible posture in commercial relationships that increasingly demand it.

The law of the land is not yet settled. But its direction is clear.

Practical Checklist: What Boards, Management, and Counsel Must Do

The following checklist organizes the governance obligations described in this piece into sequential steps, moving from board-level accountability through operational implementation and ongoing monitoring. It is not exhaustive; specific industries carry additional obligations not reflected here. Its purpose is to provide initial referential guidance to U.S. companies considering deploying or developing AI tools.

Step 1: The Board Accepts and Takes Ownership of AI Risk

The starting point is a formal board-level decision to treat AI governance as a fiduciary obligation, not a matter left to management’s discretion. This means the board, with the advice of counsel, acknowledges that AI deployments within the company’s operations create oversight duties under Delaware law, and that those duties attach to the board and to responsible officers personally. The board should ensure its charter, or the charter of the relevant committee, expressly assigns AI oversight responsibility. The choice of committee (audit, risk, technology, or a dedicated AI committee) is discretionary; the absence of any assignment is not. Marchand and Boeing together establish that structural absence of responsible oversight is itself the bad-faith fact derivative plaintiffs use to survive a motion to dismiss.

Step 2: Appoint an Owner of AI Risk

The board, with management, should designate a named senior officer as the accountable owner of the company’s AI risk management program. In larger organizations this may be a Chief AI Officer (CAIO); in others it may be the Chief Risk Officer, Chief Compliance Officer, or General Counsel, depending on how AI is deployed and where the greatest risk exposure lies. What matters is that accountability is assigned to a specific individual, documented, and reflected in that officer’s mandate and reporting obligations. Accountability distributed across multiple functions without a named owner is, in practice, accountability belonging to no one, which is precisely the organizational failure pattern that the extension of Caremark liability to officers under McDonald’s is designed to address.

Step 3: Constitute an AI Governance Committee

The designated AI risk owner should chair a cross-functional AI governance committee with decision-making authority over AI deployments across the organization. The committee should draw from legal and compliance, risk management, technology and information security, data science or engineering, and relevant business-line owners. The NIST AI RMF places particular emphasis on technical competence within the governance structure: committee members responsible for risk assessment, validation, and monitoring must have sufficient technical literacy to evaluate AI system performance, understand model limitations, and assess the adequacy of controls — not merely receive and forward management reports. Its mandate should cover the full AI lifecycle: intake and approval of new deployments, ongoing oversight of deployed systems, vendor governance, policy development, and escalation to the board committee. The committee’s composition, charter, and reporting cadence should be documented; its deliberations should generate a record that demonstrates the substantive engagement Caremark requires.

Step 4: Conduct a Jurisdictional Legal Survey

Before any deployment decision is made, counsel should conduct a legal survey of the applicable federal and state obligations. At the federal level, this means identifying which sector-specific regimes attach to the proposed AI system’s function: EEOC guidance and Title VII for employment-related tools; CFPB and fair lending rules for credit decisioning; SEC model risk and disclosure obligations for investment-related systems; OCC and Federal Reserve model risk management guidance (SR 11-7) for banking applications. At the state level, this survey must account for where the company is incorporated, where its employees work, where its customers are located, and what decisions the AI system makes or influences. A hiring tool deployed across Texas, California, and New York City may trigger TRAIGA, California’s automated decision-making regulations, and NYC Local Law 144 concurrently, each with different obligations and enforcement mechanisms. For companies with EU market exposure or EU-based operations, the EU AI Act applicability analysis should also be part of this survey: the Act reaches non-EU companies that place AI systems on the EU market, operate EU-based subsidiaries or offices, or generate AI outputs used by persons in the EU, as discussed in the NIST section of this piece. This jurisdictional survey should be treated as a standing obligation updated at least annually, given the pace of state-level legislative activity.

Step 5: Develop Policies, Procedures, and an Incident Response Playbook

The AI governance committee, with counsel, should develop and adopt the core policy instruments that govern AI use across the organization, aligned to the NIST AI RMF Govern function. These include: an AI acceptable-use policy defining permitted and prohibited uses; an AI intake and approval process with defined risk-tiering criteria; data governance standards governing what information may be inputted into AI systems (with specific attention to confidential, proprietary, and personally identifiable data); vendor selection and oversight standards; and an AI incident response playbook defining what constitutes a reportable AI incident, who is notified, what the investigation and remediation process is, and how the board committee is informed. The incident response playbook is not optional. Under TRAIGA, Colorado SB 26-189, and the EU AI Act’s Article 73, incident reporting obligations attach to deployers of high-risk AI systems. Under Caremark, the failure to respond to a known AI system failure is the conscious disregard that creates personal director and officer liability.

Step 6: Build and Maintain the AI Inventory

The AI governance committee should direct management to build and maintain a complete, current catalog of every AI system in use across the enterprise, including shadow AI (employees using consumer tools such as ChatGPT or Claude without formal approval), AI features activated within licensed SaaS platforms, and legacy statistical or machine learning models. The inventory is the foundational artifact of the entire governance program. Every downstream obligation, including risk classification, validation, monitoring, and vendor oversight, presupposes knowing what systems the company has. A board cannot demonstrate the good-faith information and reporting system Caremark requires when it cannot identify what AI the company is running.

Step 7: Negotiate AI-Specific Vendor Contracts

For each AI system sourced from a third-party vendor, counsel should negotiate terms that reflect the deployer’s legal accountability, not merely accept vendor-drafted boilerplate. At minimum, AI vendor agreements should address: explicit prohibition on using company data to train the vendor’s models without consent; notification obligations when the model is materially updated or its behavior changes; audit rights or third-party attestation (SOC 2, ISO/IEC 42001); indemnification coverage that is substantively meaningful (not capped at the monthly subscription fee) for IP infringement, data breaches, and regulatory violations attributable to the vendor’s system; and defined performance metrics with remediation obligations. For companies building on foundation model APIs, the analysis must also cover the provider’s terms of service governing permitted uses, data retention, and IP ownership of outputs. The DGCL § 141(e) protection for good-faith reliance on experts depends on the quality of that reliance; blind acceptance of vendor terms does not qualify.

Step 8: Train Users and Communicate Policies

The AI governance committee should implement a training and communication program ensuring that employees who use AI systems understand the applicable policies, the limits of permitted use, the data handling requirements, and the escalation pathway when something goes wrong. AI literacy is not only a governance best practice; it is an explicit obligation under the EU AI Act’s Article 4 (which has applied since February 2, 2025 and reaches EU-market-exposed U.S. companies) and is increasingly reflected in domestic regulatory expectations. Policies that exist on paper but have not been communicated or trained provide little protection: the documentary record of training and acknowledgment is part of what a court or regulator examines when assessing whether governance was substantive or merely nominal.

Step 9: Monitor, Measure, and Escalate

Post-deployment oversight must be continuous, not episodic. The AI governance committee should implement performance monitoring aligned to the NIST AI RMF Measure function: tracking against defined baseline metrics, scheduled bias and accuracy reviews, and defined thresholds that trigger escalation when performance degrades. AI models are not static; drift is a governance event, not a technical nuisance. Declining alert rates, anomalous outcome patterns, divergence between model outputs and external signals such as regulatory inquiries or employee complaints, and any known model updates by the vendor are each events that require documented response. The failure to act after such signals is the conscious disregard that Stone v. Ritter and Boeing describe. The board committee should receive AI risk reports on a regular cadence, quarterly at minimum for companies with material deployments, with substantive discussion documented in the minutes.

A newly filed lawsuit against Oura Health (Oura) highlights how company-directed share repurchases executed shortly before major financing transactions or anticipated IPOs can create significant D&O risk for late-stage private companies domiciled in Delaware. As companies remain private longer, secondary liquidity transactions involving founders, employees, and former executives seeking to monetize their holdings have become increasingly common. At the same time, these transactions can create fertile ground for litigation when significant valuation-enhancing events emerge shortly after a sale closes.

The lawsuit against Oura, maker of the Oura Ring, and certain of its directors and officers, was filed on May 29, 2026, in the Delaware Court of Chancery. By allegedly repurchasing shares from an existing stockholder at suppressed valuations while in possession of material nonpublic information about the company’s financial trajectory, corporate fiduciaries can face claims that they breached their stringent duties of disclosure and fair dealing under Delaware law. With thousands of late-stage startups eyeing exits, the Oura complaint illustrates how companies risk breaching disclosure obligations and fiduciary duties when they repurchase shareholder stock while concealing impending valuation-moving events.

The following discusses the allegations of the Oura Complaint in more detail, along with potential D&O risks and underwriting takeaways.

The Oura Complaint

The Oura Complaint, filed by former Oura CEO Harpreet Singh Rai in the U.S. District Court for the District of Delaware, alleges that Oura and certain directors and officers orchestrated a scheme to repurchase Rai’s shares at an artificially depressed price by restricting his ability to sell to third parties while concealing material information about an impending financing that significantly increased the company’s valuation. Rai seeks rescission and asserts claims for breach of fiduciary duty, securities fraud, negligent misrepresentation, and related causes of action.

Rai, who served as CEO from 2018 to 2021 and accumulated over three million shares, alleges that after his departure Oura amended its shareholder agreement to give the board broad discretion over share transfers. According to the complaint, the company used this authority to block multiple attempted secondary sales over a two-year period, leaving him effectively unable to obtain liquidity through outside buyers.

The complaint contends that these restrictions were part of a broader effort to control share liquidity and steer Rai toward a company-directed repurchase. In 2024, Oura, acting through a broker, approached Rai about buying back his shares. During negotiations, Rai allegedly inquired about valuation, potential financing, and investor identity, but was told only that the buyer was an existing investor, without disclosure of a pending strategic investment and Series D financing.

Rai ultimately agreed to sell shares at approximately $10 per share and to relinquish associated voting rights. He alleges that after securing these rights, Oura disclosed a financing that valued the company at about $5.5 billion, causing a substantial increase in share value. Rai claims he lost roughly $142 million due to the defendants’ conduct and asserts claims including violations of Section 10(b) and Rule 10b-5.

Discussion

The allegations are particularly noteworthy given Oura’s status as a late-stage private company that has frequently been discussed as a potential IPO candidate, as well as the broader market trend of companies remaining private longer while continuing to raise substantial amounts of capital. As companies stay private for extended periods, secondary liquidity transactions involving founders, employees, former executives, and early investors may become an increasingly important mechanism for monetizing equity holdings. At the same time, these transactions can create litigation risk when significant valuation-enhancing events emerge shortly after a sale is completed.

Although the complaint includes breach of fiduciary duty claims, the lawsuit is first and foremost a securities fraud action. The plaintiff alleges that Oura and certain directors and officers possessed material nonpublic information regarding an impending financing transaction and used that informational advantage in connection with a company-directed repurchase of his shares. Nevertheless, Rai’s effort to characterize a prominent Oura director as a de facto controller appears designed to invoke enhanced scrutiny under Delaware law and potentially expand the scope of liability beyond the federal securities claims themselves.

More broadly, the Oura Complaint could illustrate a recurring risk facing late-stage private companies. As secondary transactions become more common and companies remain private longer, disputes may arise when former shareholders later contend that they sold their shares without access to information that insiders possessed regarding future financings, strategic transactions, acquisitions, IPO plans, or other valuation-enhancing developments. Whether Rai’s allegations against Oura and its directors and officers ultimately succeed remains to be seen, but the claims underscore the litigation risks that can accompany company-sponsored liquidity events occurring shortly before significant corporate developments.

From a D&O insurance perspective, the coverage analysis may be complicated by the mixture of securities law and fiduciary duty allegations. Claims against the individual directors and officers would ordinarily trigger defense coverage under the policy’s Side A and Side B insuring agreements. However, the complaint’s federal securities law allegations raise issues that are frequently addressed differently under private-company D&O policies than under public-company forms.

Unlike public-company D&O policies, which generally provide entity coverage under Side C specifically for securities claims, many private-company D&O policies contain some form of securities exclusion. The scope of those exclusions varies considerably. Some are triggered only after an initial public offering or other specified securities transaction. Others are drafted more broadly and seek to preclude coverage for certain securities-related claims regardless of whether the company is publicly traded. As a result, whether the entity itself would have coverage for the complaint’s securities law allegations would depend heavily on the specific policy language, including the wording of any applicable securities exclusion and any exceptions to that exclusion.

These distinctions illustrate an important underwriting consideration for late-stage private companies. As organizations remain private longer, conduct secondary transactions, and move closer to potential liquidity events, they may face litigation exposures that increasingly resemble those traditionally associated with public companies. Secondary transactions that might have been viewed primarily as corporate finance events can also create securities, fiduciary duty, and governance-related exposures, particularly when they occur close in time to significant valuation events.

Taken together, the Oura Complaint highlights the growing D&O risks associated with private-company liquidity transactions. As venture-backed companies remain private longer, secondary share sales and company-sponsored repurchases are likely to become increasingly common. The Oura lawsuit serves as a reminder that when those transactions occur in proximity to major financings, strategic developments, or anticipated public offerings, disappointed sellers may seek to challenge the transaction by alleging that insiders possessed information that was not shared with them. As a result, these types of claims may become an increasingly important area of exposure for late-stage private companies and their directors and officers.

One of the ways that underlying problems or events can translate into a D&O claim is through a “follow-on” lawsuit alleging the defendant company’s board should be held liable for the underlying problem. In the latest example of this phenomenon, a plaintiff shareholder has filed a derivative lawsuit against the board of Uber, calling the company a “serial compliance offender,” and seeking to hold the board liable for allegedly recurring sexual assault and harassment claims and other alleged legal violations. As discussed below, the new lawsuit illustrates the frequently repeated catch phrase that sooner or later, everything becomes a D&O claim. A copy of the new Uber complaint can be found here.

Background

Uber is a ride-sharing company. The new complaint is based on a fundamental premise, which is that the company has a long “history of non-compliance.” The complaint recites various alleged measures the company has taken over time to evade regulatory oversight and that the company’s actions have set “a tone of non-compliance for the organization,” which, the complaint alleges, “inevitably led to harm to customers and massive legal and regulatory exposure to Uber.”

Specifically, the complaint alleges that the company’s failure to take measures to ensure customer safety led among other things to customers’ filing of thousands of lawsuits against the company alleging that they were victims of sexual assault and harassment. The complaint alleges that the company and its board failed to take corrective or remedial measures to prevent further problems of this kind.

The complaint further alleges that the company failed to implement adequate measures to protect the company from claims of discrimination from disabled customers, and related claims for violations of the Americans with Disabilities Act, and claims of alleged deceptive practices in connection with signing up customers and preventing cancellation of its Uber One subscription services.

The complaint alleges that the company’s liabilities for the sexual assault and harassment claims, as well as the other legal matters, could amount to “hundreds of millions, if not billions, of dollars.”

In support of its claims against the company’s board, the complaint sets out a separate section captioned “Board Culpability.” However, this section of the publicly available version of the complaint is almost entirely redacted. The complaint alleges “demand futility,” based on the allegation that, due to the board’s responsibility and potential liability for failure to address the alleged underlying violations, a litigation demand to the company’s board would be futile.

The Lawsuit

On June 22, 2026, a plaintiff shareholder filed a shareholder derivative lawsuit in the Northern District of California against 13 directors and officers of Uber, as well as against the company as nominal defendant.

The complaint asserts three substantive claims against all defendants: for breach of fiduciary duty; for corporate waste; and for unjust enrichment. The complaint asserts two additional substantive counts against the director defendants, alleging violations of Section 14 of the Securities Exchange Act of 1934 in connection with alleged misrepresentations in the company’s proxy statements; and seeking rescission of the directors’ incentive compensation and fees under Section 29(b) of the Exchange Act for alleged misrepresentations to investors.

The complaint seeks to recover damages; restitution or disgorgement of fees and other amounts; and an order requiring the company to take all necessary actions to reform and improve the company’s corporate governance.

Discussion

This complaint has only just been filed, and it remains to be seen how it will fare. The merits of the allegations against the company’s board are particularly hard to assess owing to the extensive redactions in the key “board culpability” section.

Regardless of how this lawsuit unfolds, the case does illustrate a recurring phenomenon, which is the way that matters that would not otherwise be covered under a D&O insurance policy can be translated into potentially covered D&O claims, through the medium of a follow-on lawsuit.

Here, the underlying allegations of sexual misconduct, discrimination against disabled persons, and violations of consumer protection laws would not typically be covered under a D&O insurance policy. However, by alleging that the company’s liabilities for these alleged underlying violations are the result of board misconduct or inaction, the liabilities for these otherwise noncovered matters potentially become matters for the D&O policy to address.

This “follow-on lawsuit” phenomenon is of course not anything new. For example, in April, we noted a new lawsuit against the technology company Adobe in which it is alleged that the company’s board violated its duties by allowing the company to build its AI model allegedly knowing that its model building processes would violate copyright holders’ intellectual property (IP) rights. In that case, the underlying IP lawsuits would not be covered under the typical D&O insurance policy, but the liability claims against the board for allegedly allowing the IP violations potentially could be covered.

Other examples of this follow on litigation phenomenon involve D&O lawsuits following in the wake of alleged antitrust violations (discussed, for example, here), or alleged FCPA violations (here) or even alleged trade sanctions violations (discussed here).

The pattern of follow-on D&O litigation filed in the wake of underlying allegations of regulatory or legal violations illustrates an often-repeated principle, that sooner or later everything becomes a D&O claim. The common thread among these kinds of claims is the allegation that the underlying problem was the board’s fault.

The way that these various other, presumably noncovered matters can become D&O claims is an obvious concern for D&O insurance underwriters. The underwriters may well feel that these underlying matters should not become the source of potential liability under the D&O insurance policy. In some instances, the insurers will seek to protect themselves from these instances of follow-on liability by including exclusions precluding coverage for claims based upon, arising out of, or in any way relating to various identified matters. However, these kinds of exclusions are more common in private company D&O insurance policies and are relatively uncommon in the public company context.

The challenge for underwriters is that companies’ potential liability for potential regulatory or legal violations, in the current legal and regulatory environment, is vast. Underwriters’ ability to try to underwrite for these various potential liabilities is quite limited. In the absence of detailed underwriting for potential regulatory or legal violations, underwriters’ only alternative is to try to underwrite the company itself – or rather, to underwrite the company’s compliance culture.

In that regard, it is not necessarily a new allegation that Uber’s compliance culture is challenged. But as a general matter it will be difficult for underwriters, on the outside of a company and with only a limited opportunity to try to see how the company operates, to assess any given company’s compliance culture. One thing I do recall from my days on the underwriting side was how important it is to determine the company’s approach – as in, is this a company that tries to play by the rules?  While this may be difficult to assess, a company trying to do the right thing is less likely to violate legal norms or leave problems that do emerge uncorrected.

In any event, this new lawsuit is an important reminder of the breadth of liabilities that can arise out of alleged breakdowns in governance and compliance and the ways in which a variety of seemingly noncovered matters can turn into claims to which the D&O insurance policy potentially may respond.

As readers know, in recent years, red state politicians and other litigants, in service of an anti-ESG backlash agenda, have launched a series of suits challenging the sustainability practices and policies of companies, asset managers, and other market participants. On May 20, 2026, the Texas Attorney General (AG) launched the latest of these kinds of suits, filing an action against proxy advisory firm Institutional Shareholder Services (“ISS”), alleging the company deceptively prioritized undisclosed ESG factors over objective financial analysis.  The lawsuit was filed in conjunction with similar state court lawsuits brought in Nebraska, Iowa and West Virginia. 

The Texas AG’s complaint against ISS reflects the now well-established trend of anti-ESG litigation in which political officials and activist groups target market participants over sustainability-related practices and policies. In recent years, The D&O Diary has frequently examined this evolving ESG backlash, including litigation, regulatory scrutiny, and political efforts challenging climate initiatives, diversity programs, and sustainability-focused governance practices.

In a separate but arguably related development, ExxonMobil recently launched a public campaign criticizing major proxy advisory firms ISS and Glass Lewis over alleged conflicts of interest tied to shareholder voting recommendations and corporate governance disputes.  Together, these developments underscore how ESG-related disputes increasingly are migrating beyond sustainability disclosures themselves and into broader battles involving shareholder voting, fiduciary duties, governance oversight, and corporate accountability.

The following discusses the Texas AG’s lawsuit against ISS, Exxon’s follow-on commentary and potential D&O exposures stemming therefrom.

The Allegations Against ISS

Texas’ Attorney General filed the complaint in Collin County District Court, alleging that ISS falsely represented its services as objective and financially focused while advancing ESG-oriented goals through its voting recommendations and governance frameworks. The suit alleges violations of the Texas Deceptive Trade Practices Act and seeks injunctive relief, disclosure requirements, and civil penalties.

The complaint focuses heavily on ISS’s public representations that its proxy research is “independent and objective” and designed to help investors make informed financial decisions. Texas contends those representations are misleading because ISS allegedly incorporates ESG priorities into its analyses without adequately disclosing the extent to which those considerations influence voting recommendations.

Among other things, the complaint challenges ISS’s “Climate Accountability” voting policy, under which ISS may recommend voting against directors at companies it believes have failed adequately to address climate-related risks. The lawsuit also targets ISS’s support for climate-related shareholder proposals, board diversity expectations, and ESG-oriented governance scorecards.

The complaint specifically references ISS’s “QualityScore” and “Climate Awareness Scorecard,” which evaluate companies using environmental, social, and governance metrics, including greenhouse gas emissions and climate-related disclosures. Texas alleges that these frameworks demonstrate that ESG considerations have become embedded within ISS’s governance recommendations.

Texas also alleges that ISS failed to disclose ties to ESG-oriented organizations and investors, including the Interfaith Center on Corporate Responsibility and Deutsche Börse’s participation in the Net Zero Financial Service Providers Alliance. The lawsuit further claims that ISS’s ESG priorities conflict with shareholder financial interests and cites alleged ESG fund underperformance and changing political attitudes toward climate initiatives as evidence supporting that argument.

While ISS has indicated it intends to vigorously contest the allegations, the broader significance of the lawsuit lies in the continued expansion of anti-ESG litigation theories into the governance infrastructure surrounding public companies.

Exxon v. ISS and Glass Lewis

In a separate development that may provide important context for the Texas AG’s lawsuit, the Wall Street Journal recently reported on ExxonMobil’s criticism of proxy advisory firms ISS and Glass Lewis after the firms’ recommended shareholders vote against Exxon’s proposed reincorporation from New Jersey to Texas. Exxon argued the firms failed to disclose potential conflicts arising from their simultaneous litigation against Texas Attorney General Ken Paxton over Texas legislation requiring proxy advisors to disclose when voting recommendations are influenced by nonfinancial considerations, including ESG-related factors.

Exxon publicly questioned whether proxy advisors exercising enormous influence over shareholder voting outcomes could remain “independent” while suing a state whose laws directly affect their business models and disclosure obligations. Proxy advisors, meanwhile, argued that Exxon’s proposed move to Texas could weaken shareholder rights and make it more difficult for shareholders to hold directors and officers accountable.

Discussion

Over the last several years, ESG litigation largely has not involved traditional “greenwashing” claims but instead has increasingly reflected political and regulatory backlash against sustainability-focused business practices themselves. As previously discussed on The D&O Diary, this backlash has taken multiple forms, including state anti‑ESG legislation, ERISA fiduciary duty lawsuits challenging ESG-oriented investment decisions, and securities suits targeting companies over ESG and DEI-related business strategies.

One of the most important D&O implications of the ISS litigation is that companies, governance professionals, and financial institutions increasingly may face scrutiny regardless of which side of the ESG debate they occupy. A company that heavily emphasizes ESG initiatives may face accusations of subordinating financial performance to political ideology. At the same time, companies that retreat from ESG commitments may face shareholder criticism, activist pressure, or claims alleging inadequate oversight of financially material climate or human capital risks. For D&O purposes, that tension is significant because these disputes increasingly are framed through the language of fiduciary duty, governance integrity, disclosure obligations, and shareholder rights. 

Texas AG’s lawsuit against ISS repeatedly argues that ISS’s ESG-oriented recommendations allegedly conflict with shareholders’ best financial interests. Whether or not those allegations ultimately succeed, the framing itself is important because anti-ESG plaintiffs and regulators increasingly attempt to characterize ESG-related governance practices as evidence of inadequate oversight, improper prioritization of non-financial objectives, or misleading disclosure practices.  Indeed, this framing closely parallels fiduciary duty theories advanced in ESG-backlash ERISA litigation, where plaintiffs similarly allege that ESG considerations conflict with the obligation to maximize financial returns

The Exxon dispute further demonstrates how governance conflicts surrounding ESG increasingly extend into the broader shareholder voting ecosystem itself. Exxon portrays its disagreement with ISS and Glass Lewis not simply as a policy dispute over climate issues, but as a question involving governance integrity, proxy advisor independence, and shareholder accountability. That narrative matters because, as D&O Diary readers may recall, proxy advisors can play an extraordinarily influential role in shaping shareholder voting outcomes involving director elections, executive compensation, climate proposals, governance reforms, and shareholder activism campaigns.

From a D&O underwriting perspective, these developments may significantly complicate governance risk assessments. Underwriters evaluating public company risks increasingly must consider not only a company’s ESG disclosures and sustainability commitments, but also the company’s relationships with activist shareholders, proxy advisors, institutional investors, and stewardship organizations that may influence shareholder voting outcomes and litigation dynamics. Questions involving board independence, proxy voting transparency, shareholder rights, reincorporation efforts, climate oversight, and governance controls increasingly carry political and litigation implications in the current ESG backlash environment that may directly affect D&O exposure.

The Exxon dispute also highlights how politically polarized governance disputes have become. Companies perceived as either too aligned with ESG-oriented governance frameworks or too aggressively opposed to them may face heightened scrutiny from regulators, investors, activist groups, or politically motivated state officials. Companies operating in industries frequently targeted by climate activists or anti-ESG regulators may face elevated securities, derivative, and regulatory exposure regardless of which governance approach they adopt.

The ISS litigation is also noteworthy because it demonstrates that ESG-related exposure is no longer confined to public companies themselves. According to the Texas complaint, ISS and Glass Lewis together control more than 90% of the proxy advisory market. If proxy advisors face increasing legal or political pressure concerning ESG-related recommendations, the effects could ripple throughout the broader governance landscape. Boards may face evolving shareholder expectations, inconsistent voting standards, and greater uncertainty regarding governance best practices. That uncertainty itself may contribute to D&O exposure because governance disputes often arise not because boards ignored risks entirely, but because stakeholders disagree regarding which governance approach was appropriate under evolving standards and expectations. 

The Texas lawsuit against ISS demonstrates that ESG-related D&O exposure is not disappearing even as portions of the ESG movement encounter political resistance. Instead, the litigation theories continue to evolve. ESG disputes increasingly are being reframed through the language of fiduciary duty, governance integrity, shareholder rights, and disclosure accuracy. Public companies, institutional investors, proxy advisors, and governance professionals now face litigation risks not only for allegedly overstating ESG commitments, but also for allegedly incorporating ESG considerations into governance decision-making at all.

As readers know, the SEC has proposed changes to the public company reporting timing requirements, allowing companies the option to file periodic reports with the SEC on a semiannual rather than a quarterly basis. As discussed below, many commentators have weighed in on this proposal. Among the more interesting and noteworthy comments in favor of more frequent reporting is that the periodic reporting process both imposes institutional discipline and enforces a culture of compliance, as John Jenkins noted in a June 10, 2026, post on TheCorporateCounsel.net blog (here), and as is also discussed further below.

The SEC has proposed to allow optional semiannual reporting for three essential reasons: to reduce compliance costs for public companies, minimize management distractions associated with frequent reporting, and modernize disclosure frameworks to better align reporting cadence with the specific needs of the business and its investors.

The proposed rule change is now open for public comment. Already, a number of institutional investors and financial market participants have come forward in opposition to the proposed rule change.

For example, in a report from its June 4, 2026 meeting, the SEC’s Investor Advisory Committee has come out against the proposed rule change. The report noted that at its meeting the panelists had “overwhelmingly noted the structural importance of the existing quarterly reporting cadence to the U.S. capital markets and were skeptical that a semiannual alternative would be feasible or attractive to most public companies.” The IAC concluded that “the SEC should not eliminate its quarterly reporting mandate for public companies, as doing so would deprive the markets of timely, material information, and thereby undermine informed investor decision making and the efficient allocation of capital among public companies.”

Similarly, in a June 1, 2026 post on the Blue Sky Law Blog (here) the Shadow SEC, a group of six academics collaborating to provide commentary on the securities laws and the SEC’s activities and policies, expressed their view that the SEC should retain its current system of quarterly reporting. Among other things, the commentators note that companies adopting semiannual reporting could see their share prices decline, and that semiannual reporting could create “the possibility of an increase in fraud as a result of companies being able to report less frequently.” The commentators also note that the SEC’s proposal fails to take advantage of experience data from countries that have adopted semiannual reporting, data showing the negative effects of making the switch.

In addition, in a June 17, 2026 post on TheCorporateCounsel.net (here), Liz Dunshee reports that the individual investor submissions to the SEC on the proposed rule change are “from individual investors who oppose (or strongly oppose!) the proposal.” Liz quotes from and refers to a tracker that Professor Tzachi Zach at The Ohio State University Fischer College of Business has established that categorizes the comment letters so that you can see at a glance the number that oppose, support, or conditionally support the proposal. The tracker shows that, as of June 17, 2026, when I checked the tracker, 96% of submissions oppose the proposal.

From among all of the various comments proffered so far about the proposal, there is one that I found particularly interesting. It appears in a June 3, 2026, post on the CLS Blue Sky Blog entitled “The Hidden Work of Securities Disclosures,” by Timothy Lytton and Anne Tucker, both of the University of Georgia Law School. As John Jenkins noted in his blog post about the article, to which I linked above, the article is written from the perspective of mutual funds, but what the authors have to say is relevant to the corporate side as well.

The article’s authors suggest that the discipline of disclosure strengthens internal governance, in ways that are beneficial to the companies and their investors. The authors suggest a number of these benefits: for starters, the disclosure process empowers lawyers. As the authors note, “the disclosure process elevates the authority of lawyers within organizations that financial professionals would otherwise dominate.”

The disclosure process also “builds a culture of compliance” through a cross-department exercise that requires collaboration and input from across the company. In-house lawyers acquire the character of “good inspectors,” gaining access to information and trying to anticipate problems before they arise.

Moreover, as the authors note, “disclosure forces institutional learning.” Frequent periodic reviews “compel funds to revisit their disclosures, kick the tires, and reconcile public representations.”

In a June 4, 2026 post on the Business Law Prof Blog, University of Denver Law Professor Ann Lipton, commenting on the authors’ post about periodic disclosure as a disciplinary process, notes that “The obligation to report necessarily carries with it an obligation of oversight; you can’t report what you don’t know.” Professor Lipton adds that “a switch to semi-annual reporting may not simply mean less information to investors; it loosens the obligations of boards, and managers, to oversee the company.”

Discussion

The authors’ discussion of the importance of reporting discipline highlights the fact that going to a less frequent reporting model may be bad from a corporate risk management perspective. Frequent corporate reporting reinforces discipline and helps foster a compliance culture. Less frequent reporting can diminish or even undermine boards’ performance of their duty of oversight.

For these reasons, D&O insurers may be concerned about companies that choose to report semiannually rather than quarterly. The insurers may be concerned that less frequent reporting could weaken corporate governance and even potentially lead to more frequent corporate and securities litigation. A cynical observer might note that the insurers can just charge more for companies that report less frequently. At least during the current soft market pricing conditions, the insurers will have relatively little leeway to push pricing increases, but as the market eventually moves to the next phase of the cycle, companies reporting semiannually could well pay more for their D&O insurance – which is an interesting consideration for those who advocate less frequent reporting as a source of cost savings.  

It seems likely that, despite the chorus of voices opposing the proposed rule change, the proposed rule will be adopted. The SEC is now (or will be shortly) down to just two commissioners. The two remaining commissioners are Republican appointees. (By statute, the SEC is supposed to have a bipartisan panel of five commissioners).  The proposed rule change is the product of a “one party proposal” (as the Shadow SEC put it), and the two remaining commissioners have little reason to heed the commentary opposing the rule change.

The two Commissioners have an audience of one; the fact is that the semiannual reporting idea most recently originated in a proposal from the President put forward in a social media post. Under these conditions, the pleas for quarterly reporting to be preserved may not stand a chance.

The more interesting question may be, if the SEC allows optional semiannual reporting, how many companies will actually opt for less frequent reporting? Investors and financial markets may impose their own discipline, particularly if the share prices of companies that report less frequently face a pricing debit due to their less frequent financial reporting. Many companies may opt to continue quarterly reporting, even if the rules are changed.  

The D&O Diary is pleased to announce that the second installment in its podcast series is now available online. This latest podcast discusses artificial intelligence from the perspective of D&O risk, specifically including AI-related litigation, regulation, and board governance. The episode, like our recent D&O Diary post on AI, D&O Risk, and the Limits of Underwriting, also discusses the challenge that AI presents for D&O insurance underwriters.

We hope you will listen to the podcast and that you will tell us what you think. We are grateful that so many of you have already listened and subscribed to our podcast. We appreciate the many suggestions we have already received. We are learning-by-doing  about making podcasts and your suggestions will help make us better.

Thank you to The D&O Diary community for supporting the launch of The D&O Diary podcast series.

🎙️Listen Now:
Apple Podcasts: https://podcasts.apple.com/us/podcast/artificial-intelligence/id1896880954?i=1000773102806
Or

Spotify: https://open.spotify.com/episode/2XZxkwJPB2b82dSKrkhUOJ?si=0o8YY5EgRcG8vDXBoFzeLw

The emergence of artificial intelligence (AI) technology presents an enormous opportunity for many companies and indeed for commerce generally. It also presents an enormous challenge for companies trying to establish themselves as one of the winners in the AI scramble. Among the prominent companies involved in this scramble are several of the technology giants, including, for example, Microsoft, a company that, at least according to press reports, recently has faced some challenges with its AI product, Copilot.

Now, the company has been hit with a securities suit alleging the company overstated its AI prospects and success, while downplaying the difficulties it was facing. The complaint illustrates many of the important features of the  still-emerging AI-related litigation. A copy of the June 12, 2026, complaint against Microsoft can be found here.

Background

Microsoft is one of the world’s largest technology companies. In recent years, Azure, the company’s cloud computing platform, has been one of the company’s main growth drivers. From many years, Microsoft has also invested in AI development. In 2023, Microsoft announced its own proprietary AI chatbot, Copilot. Microsoft offers Copilot on a “freemium” model, allowing users to use basic features free of charge but then charging consumers and businesses for more premium features and capabilities.

Over the course of 2025, Microsoft announced that it had invested billions of dollars in two prominent Large Language Model (LLM) AI developers, OpenAI and Anthropic. These two companies in turn committed to purchasing significant amount of Azure services. These arrangements, the securities lawsuit alleges, were “criticized for their apparent circularity,” as these two AI companies and Microsoft committed to using each other’s products and services.

The complaint alleges that during the Class Period, the company and its executives “highlighted the purported success of Copilot and Microsoft’s foray into AI development, claiming Copilot offered best-in-class capabilities and enjoyed widespread and growing user adoption.” The company, the complaint said, also “downplayed concerns about the Company’s AI investments and business dealings with LLM providers,” and claimed that the company “was well positioned to achieve suitable returns on its AI-related investments and emerge a key benefactor from AI technological advancements.” The complaint alleges further that as a result of these statements, the company’s share price reached an all-time high.

On January 28, 2026, Microsoft announced disappointing results its fiscal second quarter, reporting among other things that the company’s Azure growth had slowed suddenly and fallen below analyst expectations, primarily due to computational capacity constraints, as the company diverted central processing unit (CPU) and graphics processing unit capacity (GPU) capacity to Copilot applications and AI-related research and development.

The company also announced that its capital expenditures for the first half of the fiscal year had ballooned to $72.4 billion, nearly as much as for all of the prior fiscal year. The growth in capital expenditures was “largely attributed to AI-related R&D and Copilot development and capacity buildout costs.” The company also disclosed that the number of paid Copilot users was, as the complaint put it, “materially below analyst estimates.” According to the complaint, the company’s share price fell on this news.

News articles published in the days following the company’s earnings release detailed problems the company was experiencing with its Copilot product, and noted that the company was losing market share to Google’s Gemini and other competing products. An analyst report also detailed how the company’s Copilot problems and Azure problems were linked. The company’s share price continued to decline on these reports.

The Lawsuit

On June 12, 2026, a plaintiff shareholder filed a securities class action lawsuit in the Western District of Washington against Microsoft and certain of its officers and directors. The complaint purports to be filed on behalf of a class of investors who purchased the company’s securities between May 1, 2025, and January 28, 2026.

The complaint alleges that during the class period the defendants failed to disclose:

(a) that Microsoft’s Copilot family of products had experienced significant brand positioning, user experience, usage, data siloing, computational capacity, organizational, and interoperability problems;

(b) that Microsoft’s flagship proprietary AI model ranked well below competitors on a number of benchmark tests;

(c) that Microsoft needed to increase by billions of dollars its capital expenditures and divert GPU and CPU capacity away from fulfilling demand for its profitable Azure services in order to improve the competitive positioning of its critical Copilot family of products and increase its AI-related R&D; and

(d) that, as a result of (a)-(c) above, Microsoft had failed to convert a significant percentage of its commercial Microsoft 365 users to paid Copilot subscriptions and the Company’s Copilot offerings has lost market share to rival product, a trend that was increasing.

The complaint alleges that the defendants violated Sections 10(b) and 20(a) of the Securities Exchange Act of 1934 and Rule 10b-5 thereunder. The complaint seeks damages on behalf of the class.

Discussion

This complaint in many ways encapsulates the tumult accompanying the race to develop AI tools and the challenges involved for companies trying to position themselves to be among the AI winners. It is all there: the rapidly changing technology, the massive amounts of expenditure involved, the incredible level of competition, and the difficulties of translating the investments and efforts into a successful business strategy.

The gist of the complaint is that the company misled investors about the business prospects for its AI product, Copilot, while downplaying the financial challenges and operational problems with the tool. It is in that respect a classic case of “AI washing,” in that the plaintiff claims the company overstated its AI business prospects and opportunities.

While this case arguably fits within an existing category of AI-related litigation, there are features that make it distinct as well. The sheer size of Microsoft’s AI efforts, the importance of the company with respect to the development of AI generally, the massive size of its AI investments, the company’s conflicted relationship with two of the other major AI developers, all give this case a character of its own. In a sense, it could be said is that what this case is about is materialization and manifestation of AI technology as a material factor in the world of commerce –messy, complicated, expensive, uncertain, and difficult.

The sheer magnitude of the dollars involved in the company’s AI investments echoes allegations that have been raised in other previously filed AI related suits. For example, the lawsuit filed in February 2026 against the software firm Oracle, discussed here, also had allegations concerning the company’s massive AI infrastructure investments. In both cases, the allegations emphasized the massive ramp up in AI-related capital expenditures.

The sheer size of the investments – ranging into the tens and even hundreds of billions of dollars – does raise the possibility that that at some point it could emerge that companies  have overinvested in AI, and that the AI over-investment has created a bubble that, should it burst, could damage the prospects and valuations of many companies. Were any of that to occur, there could be a great deal more litigation about the massive investments many companies are making in AI.

The one thing that is for sure is that AI-related litigation is an important factor in the number of securities class action lawsuits so far this year. By my count, this lawsuit is the twelfth AI-related securities class action lawsuit to be filed in 2026, representing more than ten percent of this year’s securities suit filings. By way of comparison, in 2025, there were fourteen AI-related securities suits during the entire year, representing about seven percent of all 2025 filings. It seems probable that by year end, the number of AI-related suits will be a key contributor to the total number of 2026 securities suit filings.

A recent decision in the long-running securities litigation involving Cutera, Inc. serves as a potent reminder of the complex interplay between securities class actions and Chapter 11 restructuring. In a May 11, 2026, order, the Northern District of California dismissed the suit against Cutera and its former executives, ruling that claims against the company were legally discharged via its bankruptcy reorganization and that allegations against the individual defendants failed to meet the PSLRA’s exacting scienter standards.

The ruling is particularly instructive for D&O practitioners. It illustrates the formidable “double barrier” now facing shareholder plaintiffs: the procedural hurdle of surviving a bankruptcy discharge and the substantive challenge of converting operational setbacks, such as failed product launches and accounting restatements, into actionable fraud. While the underlying fact pattern reflects familiar exposures for high-growth life sciences companies, the outcome highlights how bankruptcy can fundamentally shift the litigation’s trajectory and finality.

The following examines the Cutera SCA allegations, the court’s dismissal reasoning, and the broader implications for D&O underwriting and bankruptcy-related releases.

Cutera SCA and Dismissal

The underlying litigation centered on Cutera’s launch of AviClear, a laser-based acne treatment device introduced in 2022. According to the Cutera SCA, the company adopted an aggressive leasing model to accelerate device placement with physician practices. Plaintiffs alleged that the structure was heavily influenced by executive compensation incentives tied to placement targets under what the complaint described as the “Acne Equity Grant.” 

Plaintiffs alleged that senior executives diverted resources from the company’s traditional “Core Capital” business to support AviClear placements and maximize stock-based compensation. The complaint further alleged that AviClear revenues underperformed internally projected results and that executives nevertheless continued making optimistic statements regarding demand and rollout success. 

The securities claims also focused heavily on Cutera’s internal control environment and later financial restatements. According to the complaint, the company experienced inventory management problems that led to an extended plant shutdown and accounting errors tied to inventory discrepancies.

Cutera later restated portions of its 2023 financial statements, purportedly after discovering inventory-related issues. Plaintiffs alleged that executives improperly certified financial statements despite purported knowledge of deficiencies in internal controls and reporting systems. The complaint also pointed to delayed SEC filings, disclosure of material weaknesses, and Nasdaq compliance concerns. 

In its May 11, 2026 dismissal, the Northern District of California distinguished between Cutera’s accounting problems and actionable scienter. The court acknowledged that several challenged financial statements were in fact false because the company later restated them. Nevertheless, the court concluded that plaintiffs still failed to adequately allege that the executives acted with the required intent to deceive investors. 

The court emphasized that plaintiffs failed to connect generalized allegations of internal concerns or operational underperformance to specific contemporaneous knowledge by individual executives. In analyzing statements concerning AviClear’s “successful launch,” physician feedback, and customer demand, the court found that plaintiffs failed to identify facts showing executives knew those statements were false when made. 

The court also rejected plaintiffs’ reliance on confidential witness allegations, finding many lacked the specificity required under Rule 9(b) and the PSLRA. In several instances, the court noted that plaintiffs alleged dissatisfaction, utilization concerns, or revenue shortfalls without tying those concerns to executives at the time the statements were made.

Similarly, the court rejected allegations that interim CFO Stuart Drummond recklessly certified financial statements. According to the court, allegations that Drummond “ignored red flags” were insufficient absent additional allegations showing he actually knew the financial statements were unreliable when signed.

Cutera’s Bankruptcy

Another key element noted in the dismissal of the Cutera SCA was the influence of the company’s Chapter 11 proceedings on the pending litigation. Cutera filed for bankruptcy protection in March 2025 with roughly $429 million in debt and emerged in May 2025 as a private company after reducing about $400 million of its debt and raising additional capital. The Northern District of California held that claims against Cutera were abandoned and discharged under its confirmed Chapter 11 reorganization plan.

The lead plaintiff of the Cutera SCA apparently opted out of third-party releases applicable to directors and officers, preserving claims against individual defendants. However, the court concluded the claims against the corporate debtor itself had been discharged and further found plaintiffs abandoned any opposition to dismissal by failing to substantively respond to defendants’ bankruptcy-based arguments. 

Discussion

The decision to dismiss the Cutera SCA underscores a significant issue in securities litigation involving distressed companies. Should public companies facing operational disruption, rising debt costs, and liquidity challenges enter restructuring proceedings, bankruptcy courts may become critical to the disposition of pending securities litigation.

Notably for D&O insurers, the decision highlights the interplay between bankruptcy releases and Side A exposure. As corporate insolvency frequently renders Side B indemnification unavailable, defense and settlement burdens shift directly to Side A policies. Furthermore, when bankruptcy courts bar claims against the corporate entity, plaintiffs may pivot toward individual defendants, intensifying pressure on Side A limits.

The allegations of the Cutera SCA also underscore how shareholder plaintiffs may exploit governance risks associated with compensation structures and aggressive timelines. As D&O Diary readers are aware, allegations that management incentives distorted operational priorities and did not disclose disappointing sales performances, while common, are not unique to life sciences companies. 

The Cutera litigation may serve as a cautionary tale for D&O insurers regarding the risks of “scaling pains.” It demonstrates how rapid commercialization can stress a company’s internal infrastructure, specifically inventory and accounting beyond its breaking point. When these operational lags result in restatements or filing delays, they create a direct path to securities litigation and individual executive exposure.

While the dismissal of the Cutera SCA marks a definitive defense victory, the case highlights a persistent litigation pattern: plaintiffs’ firms aggressively target high-growth companies where operational disruptions collide with ambitious public narratives. However, the dismissal also underscores the transformative impact of bankruptcy on such disputes.

When a company enters Chapter 11, the legal focus shifts from corporate liability to the protection of individual leadership. As reorganization plans often discharge claims against the debtor entity, litigation pressure pivots toward individual directors and officers, potentially exhausting Side A insurance limits and leaving executives personally exposed without traditional corporate indemnification.

In recent posts (for example, here), we have documented growing problems in the private credit industry. As we have also discussed (most recently here), in many instances these problems have translated into corporate litigation. Among the growing numbers of private credit market-related lawsuit filings has been a series of lawsuits against filed Blue Owl Capital and related entities.

In the latest development in this series, last week a plaintiff investor filed a derivative lawsuit on behalf of one of the Blue Owl funds against the fund’s investment manager and advisor, alleging that the advisor’s conflicted valuations of the fund’s private credit assets resulted in the payment of improper and excessive fees to the advisor. The new lawsuit has several interesting features and suggests the possibility of further litigation in the private credit space. A copy of the June 5, 2026, lawsuit can be found here.

Background

Blue Owl Technology Finance Corp. (OTF) is an investment fund sponsored, controlled, and managed by Blue Owl Capital. Blue Owl Technology Credit Advisors LLC (the Advisor) is OTF’s investment manager and administrator. OTF is primarily focused on making loans to, and making debt and equity investments in, technology-related companies, primarily in the United States.

OTF does not have employees, and services for OTF’s business are provided by employees of the Advisor or its affiliates. According to the complaint, OTF has paid the Advisor hundreds of millions of dollars in fees for acting as OTF’s investment manager.

The plaintiff’s complaint alleges that the Advisor’s management fee is based on OTF’s gross assets and its incentive fee is based on income and capital gains. Both of these fees, the complaint alleges, “incentivize the Advisor to increase the value of OTF’s assets and to keep those assets at an inflated value.”

The problems arise because many of OTF’s investments are, according to the complaint, “illiquid or not freely traded.” OTF’s board of directors has designated the Advisor as OTF’s “valuation designee” – that is, the entity that provides a value for these assets that do not trade on active markets.

The complaint alleges that by designating the Advisor as the valuation designee, OTF’s board “essentially turned over to Defendant the ability to set its own fees.” The complaint alleges that “as could be expected with these incentives,” the Advisor has “inflated the value of OTF’s assets by hundreds of millions of dollars, substantially increasing the fees it received.”

The complaint alleges that there is a further problem with the Advisor’s fee arrangements. The complaint alleges that it is a standard investment industry practice that as a fund’s size grows, the percentage of assets an advisor charges in fees generally diminish. However, in this instance, the complaint alleges, the Advisor has not lowered its fees as OTF has grown. To the contrary the Advisor’s fees have also grown. Indeed, the complaint alleges that the Advisor’s fees have actually grown at a greater rate than the fund itself.

The Lawsuit

On June 5, 2026, an OTF investor filed a shareholder derivative lawsuit in the District of Maryland against the Advisor on behalf of OTF, which is named as nominal defendant.

The complaint alleges that the Advisor’s fees are “so disproportionately large” that they bear “no reasonable relationship to the services rendered and could not have been the product of arm’s-length bargaining.”

The complaint alleges that the defendant Advisor breached its fiduciary duties, and seeks to recover damages resulting from the breaches, including “the amount of the excessive compensation and payments received by Defendant,” pursuant to Section 36(b)(3) of the Investment Company Act of 1940.

Discussion

There are a number of interesting things about this new lawsuit. For starters, the complaint suggests the possibility of a whole new range of potential excessive fee litigation. As readers know, there has in recent years been a plethora of excessive fee litigation in the employee benefit plan space. Indeed, this type of excessive fee litigation has become something of an industry of its own. Could excessive fee litigation become a new area of litigation in the private credit fund manager space? As discussed further below, this latest lawsuit is not the first case involving allegedly excessive private credit industry-related advisory fees. Nor, for reasons discussed below, is it likely to be the last.

But the more important thing about this litigation is its connection to the private credit space. The nub of the alleged problem with the Advisor’s fees here is that the fees depend on the valuation of the private credit assets. As the complaint points out, there is no market mechanism setting the price for these private credit assets (which primarily involve loans and other debt instruments). It is the very murkiness of the valuation of these assets that, allegedly, allowed the Advisor to charge what the complaint characterizes as “improper and excessive fees.”

This aspect – that is, the murkiness of the valuation of private credit assets – has been a significant component of much of the recently filed private credit industry-related litigation.

For example, valuation issues were at the center of the securities class action lawsuit filed in May 2026 against FSS KKR Capital Corp. (as discussed here). Similarly, the complaint in the February 2026 securities class action lawsuit filed in February 2026 against BlackRock TCP Capital Corp. (discussed here) is based on allegations relating to the valuation of the defendants’s private credit assets.

Indeed, private credit asset valuation issues were at the heart of a prior derivative lawsuit filed in April 2026 against a separate Blue Owl-affiliated advisory firm (here), a lawsuit that, like this one, alleged violations of and sought damages under Section 36(b) of the Investment Company Act.

As Sarah Abrams noted in a post on this site discussing the prior lawsuit involving the separate Blue Owl-affiliated advisory firm, private credit portfolios frequently consist of illiquid assets lacking observable market prices, meaning valuations depend heavily on internal models and judgment, an inherent problem that becomes even murkier when valuations depend on structures and relationships between affiliates operating under a common corporate umbrella.

The problem for the private credit industry is that both the murky valuations and the structural issues are not uncommon in the industry. With all the concerns surrounding the private credit industry in general — relating to issues involving liquidity, rights of redemption, and valuations — it seems likely that questions about fees will continue to bubble up. And in some instances, these questions will translate into litigation of the type involved here. At this point, it seems likely that there will be more of this type of litigation to come, as well as other litigation involving the private credit industry generally.

The circumstances involved in this latest lawsuit also suggest additional ways these kinds of structural relationships could lead to further allegations and potential sources of liability. For example, this latest complaint contains allegations concerning the Board of Directors of OTF. The complaint alleges that OTF’s Board, by selecting the Advisor as the “valuation designee,” essentially “turned over to Defendant the ability to set its own fees,” which created an incentive for the Advisor to inflate valuations. Though the complaint raises these claims against OTF’s board, the complaint does not separately assert substantive claims against OTF’s board. But the allegations certainly suggest the possibility of those kinds of claims. Plaintiffs could well allege that boards failed to exercise adequate oversight or failed to manage disclosed conflicts.

And as Sarah Abrams noted in her prior post to which I linked above, the allegations in these asset valuation lawsuits riase could also raise E&O claims against the advisory service providers, as they implicate the advisor’s professional services in valuing and managing portfolio assets, potentially giving rise to claims that valuations were unreasonable, biased, or inconsistent with prevailing credit market conditions.

One final note. Some readers may have noted that late last week the U.S. Supreme Court issued an opinion in FS Credit Opportunities Corp. v. Saba Capital Master Fund, Ltd. (here), in which the court held that there is no implied private right of action under Section 47(b) of the Investment Company Act of 1940 (ICA).  Readers may well wonder whether this decision has any relevance to the plaintiff’s recently filed lawsuit, in which the plaintiff seeks to recover damages under Section 36(b) of the ICA. The short answer is that the new Supreme Court decision has no relevance because the private right of action under Section 36(b) is not an implied right of action, it is rather expressly granted in the statute itself.