[00:00:00] Speaker A: Foreign.
Hi, everyone. Anthropic's IPO filing says its terms of service limit its liability for what its AI models do. So when AI goes wrong, who's left holding the risk? Welcome to this special live episode of the Ethicast where we will dive into how compliance officers should be thinking about the fine print when it comes to their own AI governance and risk assessment. And I'm your host, Bill Coffin, and it is my pleasure to share the screen once again with Ethisphere Chief Strategy Officer Erica Salmon Byrne. Erica, welcome back to the show. Thank you so much for joining me today.
[00:00:39] Speaker B: Oh, Bill, absolutely. 100%. I, I was delighted when you reached out and said, and said, should we tackle this one? Since I spent a little time with the 94 pages of Anthropics S1 that cover risk,
[00:00:51] Speaker A: it's an awful lot. And before we get into the questions I have for you, I'm going to offer a quick background on what's actually going on here. So on Monday, Anthropic, the company behind the Claude AI models, filed its S1 registration statement with the U.S. securities and Exchange Commission, starting the clock on what could be the largest initial public offering in history.
Anthropic plans to list on the NASDAQ under the ticker ant. And according to the Wall Street Journal, the company hopes to sell roughly $100 billion in shares at a valuation that people familiar with the matter expect to land between $1.5 and $2 trillion. Total trading could begin as soon as the week before Thanksgiving. Now, these numbers obviously are enormous. Anthropic reported $16.3 billion in revenue for the first half of 2026, up from $1.2 billion a year earlier. And it holds more than $112 billion in cash. It also has committed to more than $475 billion in computing capacity over the next seven to 10 years.
For ethics and compliance leaders, though, the most revealing part of the roughly 400 page prospectus is that 94 pages of risk factors. Anthropic writes that AI models, including its own, have exhibited, quote, self preserving behaviors, end quote, such as attempts to resist shutdown and quote, behavior resembling blackmail, end quote. It warns that the harm from a catastrophic AI related incident could be so large that no single insurer, and possibly not the insurance industry as a whole, could, could even cover it. And then there's liability. Anthropic says it uses warranty disclaimers and limitations of liability in its terms of service to limit its exposure if its models cause harm, while acknowledging that those protections quote may not be upheld, end quote. Or may not apply to certain claims. It has also gone the other direction to support independent testing of its models. Anthropic agreed to indemnify certain outside evaluators. And some of those agreements carry no cap.
That raises a question every organization using AI should ask. If an AI provider's contract limits what it owes, when something goes wrong, that risk often transfers back to the customer and the people best placed to spot that exposure. For organizations, compliance officers can't protect much if they don't see the terms of service. And then there's the governance side of this Anthropic structure is a little unusual. An independent long term benefit trust appoints a majority of the board, While the company's seven co founders control 50.1% of the shareholder vote. Board oversight of model safety sits with a safety and risk committee made up of two independent directors, Novartis CEO Norah Simon, who chairs it, and former Microsoft and General Motors CFO Christopher Liddell. That same two person committee also oversees Anthropic's legal, regulatory, cybersecurity, privacy and compliance risks.
For the ethics and compliance space. The last two years have been a non stop torrent of AI governance and AI implementation challenges, obstacles, opportunities and learning experiences. And all of it has been based around risk assessment to some degree. So as we absorb the realities of Anthropics ipo, it falls to every organization to decide how much risk it's willing to assume when it adopts AI and to what degree the folks in compliance have read the fine print.
Okay, now that we've gotten that background out of the way, Erica, let's get into some of the things that captured your attention around this.
[00:04:03] Speaker B: Yeah,
[00:04:04] Speaker A: from the top. In their IPO Anthropic said that it has taken steps in its terms of service to limit its liability for its model's actions.
How crucial is this for ENC teams looking to integrate AI like Claude into their own daily operations?
[00:04:17] Speaker B: Yeah, so Bill, this is a piece that depending upon the individual structure inside your organization, may or may not be something that is on your radar screen. And if it isn't, I hope that listening to you and I will cause it to be so. So the way that Anthropics terms of use are structured and Claude, I will say, is one of the primary models being used in the enterprise context. So you know, this, this impacts a lot of the companies that you and I are talking to. Most of the responsibility for the actual behavior of the, the models themselves, the responsibility for human in the loop, the Responsibility for the outputs of the models, the responsibility for warning people that you can't trust necessarily the outputs of the models, all of that rests with the enterprise client. So if you are a company that is has an enterprise license with Anthropic you have taken on the bulk of the risk. Now you are indemnified for IP related issues. So in the, you know to extent that, that there is something in the underlining training data where you end up having a claim brought against you. From an IP perspective, Anthropic is you know, your partner in that regard. But in terms of what the model does and how you use the model and how you use the output of the model, that's on you.
And I don't know how many of the ENC leaders listening to you and I have necessarily read the terms of use, you know that, that their company signed. Often that is something that is done by a different team inside of legal.
Sometimes that's something that is that, that go, you know, comes up through procurement.
Your IT or information security team might be the group that is primarily dealing with the actual models themselves. You're thinking about AI governance writ large. They're thinking about the models themselves. And so you know, to the extent that you are not deeply familiar with where your company has taken on exposure in the use of these third party products, I strongly encourage you to familiarize yourself as quickly as possible.
This also plays into something that you and I are going to talk about in the second bill, which model? Reliance. And so you know, that is the other thing I am hearing from ENC teams right now is we don't always get notified that a model has been updated. Right. Our information security team or our IT team or you know, our AI team, those are the groups that are tracking when model updates are being pushed. And as you and I know well, a model that you have, you have utilized in a particular fashion with a particular set of instructions and then sort of set to run when the model updates.
Those instructions often don't make it from one version of the model to the next. And so your, your model breaks or your agent breaks rather so you know, making sure that you are hip to hip with the groups that are getting these, these updates, you know, getting alerts of these updates, knowing the schedule and these things are coming is another really critical piece of the puzzle. So I know we're going to get into the cross functional aspects of this, but that is certainly something that has stood out to me.
[00:07:18] Speaker A: Well, just to drill down a little further, I mean how often should compliance officers actually review terms of service for liability limitations. And in your experience, are they actually doing it frequently enough?
[00:07:27] Speaker B: Yeah, you know, I would say that it is, it has traditionally not been something that a lot of EMC teams spend a lot of time thinking about because so many of those, you know, those, those, those terms are for and. Well, I should make one caveat on that. If your team has responsibility for privacy, you're probably reading terms of Service and you're probably, you know, paying attention to DPAs and things like that. If your team does not have responsibility for that, then you're probably looking at the, at the terms of service around the things that you use as an ENC team on a daily basis. So you might be familiar with your conflicts of interest disclosure technology, you know, terms of service or your hotline providers or something that.
But making sure that you're getting that one pager on things like the AI models that your company is increasingly relying on needs to be something that goes on the risk assessment list. Because if you, you know, as you think about the importance of human in the loop, not only is that important from a reputational perspective, but in the event that something goes wrong, your company is going to be responsible for the output in all likelihood.
And you, you know, may or may not, as Anthropics filing warns us, have insurance that covers that risk.
[00:08:41] Speaker A: Yeah, the insurance piece of. It took me back to a previous point in my career when I was thinking about how much, how much can the insurance industry actually absorb? And with cases like this, we're talking potentially unlimited liability.
There are many, many companies and many industries actually that find themselves in a position where they actually have more resources than the insurance companies that they're looking to actually help finance their own risk. And so that creates a much broader risk perspective in terms of how do you finance that risk and how are you going to create a properly layered approach to that to make sure between whether it's, you know, traditional insurance, captive insurance, reinsurance, alternative risk financing, going to capital markets, creating a massively layered, you know, Tower, I'm sure that the insurance picture with Anthropic is going to be deeply interesting and all friends in the insurance space will be having a great time taking a look at that because that's going to be complicated and novel as well.
But Erica, we have come to that point in the show where I have to ask my perennial question which is, is it okay if I ask you a follow up question?
[00:09:38] Speaker B: It wouldn't be an episode of the Ethicast Bill without a follow up question.
[00:09:41] Speaker A: It sure, sure. Wouldn't I have to ask anyway? But look, I, I don't want to throw cold water on the use of AI within ENC
[00:09:48] Speaker B: for sure,
[00:09:48] Speaker A: but the question of how much risk is being assumed by whom is a question worth asking. So, from an AI governance perspective, do you think that ethics and compliance leaders have a sufficient understanding of the risk exposure that their organization may have taken on through their use of AI?
[00:10:04] Speaker B: Yeah.
The short answer, Bill, is unless you are an organization that is dynamically and almost in this environment in particular, continuously assessing your risk, then probably not, right? If you are someone who maybe did an annualized risk assessment process at the beginning of the year, maybe you're on an annual cycle, I can almost guarantee that your company's use of AI has exploded since you did that beginning of the year risk assessment. And so if you are not regularly updating your AI risk in particular, then you probably are not.
You probably don't really have your arms around what the risk looks like. And so it's been interesting, you know, over the course of the last six months or so, I would say that we are increasingly seeing compliance teams think about AI governance with more of a kind of a three pronged set of questions. So we've all been talking about responsible use of AI. We've been talking about responsible use of AI since AI became a thing. Is there bias in the algorithms? All of you know, all of those questions.
And responsible use, I think is still an important piece of the, of the analysis, but the two pieces that I've seen being added to it are appropriate. So is this a appropriate use of AI? Am I being fiscally responsible in this particular use case? What sort of potential future reliance on a third party model and, you know, cost profile that I perhaps have not modeled in with my finance team, am I introducing with this particular use of AI? So there's the responsible piece, there's the appropriate piece, and then this is the newest piece that I'm hearing now from compliance teams, which is defensible.
Can I recreate what the model did in the event that I need to prove that the output was reliable? Because if you look at the terms of use to go back around to the anthropic filing, if you look at Anthropic's terms of service, what you see in there is you see a lot of discussion about the output. So, you know, harm caused by the output is something that you, as the company are taking on, except in very limited circumstances.
Well, can you show what caused the output?
Can you recreate prompts can you get the model to do the same thing that it did the last time? Can you show what documents went into the sandbox that caused the model to behave in that way in the first place?
What are the steps that you as an organization are taking to figure out places where an employee might be relying on the output in a way that they shouldn't be relying on the output or a customer is relying on the output in a way that they shouldn't be relying on the output? Right.
This defensibility question, can I. In five years, when somebody says how did you get from A to Z? Are you, do you have a prayer of being able to show how you did that?
And, and I think in the enthusiasm for the remarkably incredible things that AI can do, we have lost sight of that responsibility piece of it.
And I think, you know, a lot of compliance teams now are trying to figure out how to think through the defensibility piece. In the event that I had to show that what the model did was a reliable output. How am I going to do that?
[00:13:21] Speaker A: Well, speaking of responsibility, Anthropic Safety and Risk Committee has two board members on it. Now from a corporate governor's perspective, given the nature of the risk within Anthropic's business, what does this structure tell you?
[00:13:36] Speaker B: I hope they're recruiting, Bill. That's what it tells me.
[00:13:40] Speaker A: This is the question I wanted to ask you the most in this entire thing and I knew you would deliver, so please go ahead.
[00:13:46] Speaker B: No, I mean like think and setting aside the internal structure that is figuring out what particular metrics they are reporting up to that committee.
Think about that remit for a second.
Right? Think about that remit for a second. Think about that pre read for a second, Bill. Like
[00:14:06] Speaker A: both
[00:14:06] Speaker B: of the people that are on that committee, I am confident are highly competent, brilliant individuals. There are two of them, right? There are two of them.
And that workload is, is going to be unsustainable. So not uncommon for these kinds of committees to be very small pre ipo, but I am very hopeful that they are recruiting for additional independent directors. That would become a part of that conversation because from, if we, if we take a step back and we think about the responsibility of independent directors. You know, Bill, you and I have talked about this in the past. The responsibility of an independent director is to engage in clear eyed, independent, appropriate oversight of the company's key risk factors. Right? That, that's, that's the remit. You are standing in the shoes of investors and other stakeholders and you are engaged in independent oversight. Oversight requires information, oversight requires attention, and oversight requires bandwidth. Right. And the bandwidth piece is the piece that I'm most concerned about with a committee with that remit. I mean, you rattled it off at the beginning.
It's safety, it's cyber security, it's compliance, it's. I mean, that is
[00:15:24] Speaker A: legal regulation.
[00:15:25] Speaker B: Enormous legal and regulatory right. That is an enormous remit of responsibility for two individuals from an independent director perspective. And I'm certain that they are coordinating closely with management on all of the other things that one would expect in these kinds of circumstances. But there is simply no way that two people can do that work. Right. You've got to have additional brains in the room. You've got to have more people asking questions in the room. Right. You. It is, it is impossible for two people to handle that level of responsibility on their own.
[00:16:04] Speaker A: Well, Erica, thank you so much for weighing in on this. This is a great episode and I figured it would be. But I am sure this is only the beginning of what the world of business integrity has to learn from this historic IPO and everything it entails. So, once again, thank you for taking time out of your day to join us. And thank you so much for sharing your insights with Everybody in the ENC world on this.
[00:16:22] Speaker B: Oh, absolutely, Bill. 100%, my pleasure. And for those of you out there who are listening in to Bill and I, who are curious about the defensibility piece, we did a whole webinar on that earlier this year that I would encourage anybody listening to check out, really thinking through this question of like, you know, what are the pieces that I'm going to need to be able to retain? Is my records retention policy updated? So that would be one takeaway, and then the other takeaway is to the extent you're not already besties with your information security team, please go buy them coffee and build that, build that bridge. Because, you know, you in all likelihood, as an ethics and compliance team, have a role to play in AI governance if you're not primarily responsible for it. Inside of your organizations, you are sitting on the steering committee, you are thinking about these issues carefully, and your information security team is the funnel to get information on what's changing in these models that increasingly many of our businesses are relying on on a day to day basis.
And, you know, look, when they push an update, you need to know what's happening because you need to be able to go and check and make sure that all the things that you've programmed are still working. So those are my two main takeaways, Bill. Go listen to our defensibility webinar and go buy your information security team a cup of coffee.
[00:17:34] Speaker A: Absolutely. Absolutely. Well, everyone, thank you so much for joining us. We hope you've enjoyed this episode. For plenty of free resources, including on demand webinars on risk assessment, corporate governance, AI governance, and more, please visit the Ethisphere resource
[email protected] resources. There you'll also find the state of AI adoption and ethics and Compliance, our survey report in which we explore how organizations can close the AI adoption gap between broader business and their own ethics and compliance functions. It's mandatory reading, so check that out. In the meantime, don't forget to subscribe to the Ethiccast on YouTube, Apple Podcasts, and Spotify for new episodes each week. And if you'd like to appear on this show as a guest to share your ethics compliance success story, best practice or innovation, drop us a
[email protected] ethicast or message Erica or myself right here on LinkedIn. That's all for now, but until next time, remember, strong ethics is good business. We'll see you soon.
[00:18:25] Speaker B: Bye. All.
Right,
