Anthropic - the maker of Claude, the AI system operating inside New Zealand financial services, legal, and insurance operations - filed its IPO prospectus this week warning that its technology could pose "catastrophic or existential risks to humanity" if not developed with appropriate safeguards. It simultaneously announced a Nasdaq listing expected to exceed US$1.8 trillion, disclosed H1 losses of US$80.7 billion against revenues of US$16.3 billion, and said it aimed to be "bold but sane."
In the same filing, Anthropic disclosed uncertainty about "where and how it might be held liable for actions taken by its systems." It named regulatory action arising from AI model harms including suicide and child safety as a risk factor. It noted a wave of cybersecurity incidents involving AI agents operating with a degree of autonomy.
Every New Zealand organisation using Claude in its operations carries a version of that uncertainty inside its own risk profile. The question most boards have not yet formally asked is: under which policy does that uncertainty become a claim?
New Zealand company directors face duties under the Companies Act 1993 to act with reasonable care and diligence regarding material operational risks. An AI system that its own developer cannot fully guarantee will not cause harm is a material operational risk. The Anthropic filing is not a warning about a possible future, it is disclosure of a known, current, unresolved risk - formalised in a legal document by the company that built the system and knows it best.
As Insurance Business has reported, AI adoption is outpacing governance frameworks across the region, with firms without documented AI governance frameworks now facing coverage denials at renewal. The Anthropic filing is the most prominent evidence yet that the governance gap is real, acknowledged at the highest level of the AI industry, and creating unpriced liability for every organisation in its path.
D&O underwriters writing cover for New Zealand boards should be asking specifically: does this policy contemplate a claim arising from a board's failure to govern an AI system that its own vendor disclosed could cause catastrophic harm? If the answer is unclear, the policy language needs reviewing before the next renewal.
The Privacy Act 2020 and the Office of the Privacy Commissioner's guidance on automated decision-making already create specific obligations relevant to AI deployment. The Algorithm Charter for Aotearoa establishes accountability expectations for algorithmic systems. New Zealand's consumer protection framework - the Fair Trading Act and the Commerce Act - creates potential exposure when AI systems produce misleading outputs or discriminatory decisions. None of those frameworks was designed for AI agents that their own developers describe as posing existential risks.
As Insurance Business has reported, conventional policies were never built for AI agents. In New Zealand, where test cases on AI liability have yet to be litigated at scale, the legal framework for who pays when an AI system causes harm is genuinely unsettled. That uncertainty favours neither claimants nor defendants - it favours dispute, which is the worst outcome for both.
OpenAI's IPO follows early next year.
