On 26 October 2026 Anthropic filed its registration statement with the US Securities and Exchange Commission. The part worth reading if you deploy AI is in the risk factors, the section where an issuer sets out what it considers material to an investor. Two passages in it matter to anyone running these systems in production.
The first is about insurance. Under a risk factor warning that its "contractual and insurance protections may prove insufficient", the filing says:
"with the scale of harm that could result from a catastrophic AI-related incident, no single insurer, and potentially the insurance industry in the aggregate, may have sufficient capacity or expertise to underwrite insurance commensurate with such exposure."
It goes on to call the insurance market for AI-specific risks "nascent and evolving", and says the company may be unable to obtain cover for some AI-related liabilities "on commercially reasonable terms, or at all".
The second is about severity. The same section records that concerns have been raised, "both within our organization" and by researchers, regulators and policymakers, that sufficiently advanced AI systems could "pose catastrophic or existential risks to humanity" if not developed and operated with appropriate safeguards. That sentence now sits in a document filed under securities law, where its authors are answerable for whether it is accurate.
Read it from the deployer's side
None of this is an admission of wrongdoing. Risk factors are written to be broad, and a careful issuer lists what could happen, not what it expects. That is exactly why they are useful: they are the supplier's own lawyers describing where the exposure sits, without a sales team in the room.
Put the passages next to each other and the picture for a buyer is plain. The filing says Anthropic limits its liability through warranty disclaimers and limitations of liability in its terms, and that those protections "may not be upheld". It says it may face claims that it is liable for harm caused by its agents' autonomous actions "even where the customer configured, deployed, or supervised the agent". And it says the insurance behind all of that may not exist at the scale required.
That middle passage cuts both ways. It points liability towards the supplier: Anthropic is telling investors it may be the one sued. It does not take the claim away from you. The organisation that configured, deployed or supervised the agent still answers to its own customers and regulators, whatever happens between its supplier and a court. Your supplier has capped what it owes you and told investors its own cover may fall short. Whatever part of a serious incident is not absorbed by the supplier, its contract or its insurer lands on the organisation that put the model to work.
When the supplier says the risk may be larger than the insurance market, the transfer you were relying on may not be there. What remains is what you can show you did.
Governance is not paperwork here
The usual case for AI governance is compliance: a regulation exists, so a control is needed. That case is real, and for high-risk systems Article 26 of the EU AI Act places human oversight, monitoring and log-keeping on the deployer. But the filing makes a different and stronger case. If a risk cannot be transferred, it has to be reduced and it has to be evidenced. Those are the two things governance does, and nothing else on the list does either.
Reduction means fewer incidents and smaller ones: scoped permissions for agents, a human checkpoint before consequential actions, a defined boundary on what a model may touch. Evidence means that when something goes wrong, the questions an insurer, an auditor, a regulator or a court will ask have answers on file. Which model produced this. What it was permitted to do. Who reviewed it. What you knew, and when.
An organisation that cannot answer those questions is carrying uninsured risk without a record of how it managed it. That is the worst position available, and it is where an organisation ends up by default unless someone decides otherwise.
What to do this quarter
Read your supplier's liability clause next to its risk factors. Of the two documents, the filing is the more candid. Note every place where the supplier's protection ends and yours has to begin.
Ask your broker what your current policies say about AI. Do not assume a technology errors and omissions policy or a cyber policy covers harm caused by an autonomous agent acting on your behalf. Get the answer in writing, including the exclusions.
Treat oversight records as the asset. For every system that can act rather than only advise, keep a record of what it is allowed to do, who approved that, and what it actually did. If the cover is thin, that record is what stands between an incident and an argument you cannot win.
We are not neutral
ORCAHQ sells governance, and we route work across several model suppliers, Anthropic among them. A firm that builds oversight saying oversight matters more than ever should be read with that in mind.
So take the source rather than our reading of it. The supplier with the most to gain from sounding confident has told the SEC, in its own words, that the worst case may be larger than the insurance industry. If you deploy its models, or anyone's, the question is not whether you are covered. It is whether you can prove you were careful.