Directors & Officers in the Hot Seat: Where Corporate Law, Litigation Risk and Insurance Coverage Intersect

In this episode of Nossaman's Corporate Conversations podcast, we delve into the evolving risk landscape for Directors and Officers (D&O) liability. Nossaman's Anna Tang, joined by corporate litigation partner Patrick Richard and insurance recovery partner Joe Saka, explore the growing complexities of D&O liability, driven by factors such as cybersecurity breaches, AI-related claims and shifts in state corporate laws that have prompted companies to reconsider Delaware as their domicile.

The discussion covers the essentials of D&O duties, the impact of legislative changes, and practical steps directors and officers can take to minimize exposure, including understanding indemnification provisions, securing adequate D&O insurance and ensuring robust corporate governance practices.

Transcript for: Directors & Officers in the Hot Seat: Where Corporate Law, Litigation Risk and Insurance Coverage Intersect

_{0:00:00.5 Anna Tang: Directors and officers are increasingly finding themselves in the hot seat. AI claims are rising. Cyber risks are growing. State corporate laws are shifting fast. Join us as we break down the new D&O risk landscape and offer practical steps to protect corporate leaders.}

_[music]

_{0:00:18.4 Speaker 2: Welcome to Nossaman's Corporate Conversations podcast, where our corporate attorneys bring practical insights into the deals, disputes, and legal decisions shaping today's corporate world.}

_{0:00:31.8 AT: Hi everyone. My name is Anna Tang and I'm a corporate and M&A lawyer here at Nossaman. Today we're tackling one of the hottest topics in corporate law right now: the evolving risk landscape for directors and officers. We're gonna cover everything from the basics of D&O liability and insurance to the new frontier of AI-related claims, cybersecurity exposure, and the big shifts in state corporate law that have companies seriously rethinking whether Delaware is still home. I'm very excited today to have two guests with me. First, Patrick Richard, a seasoned corporate litigator who's been advising boards and officers on these exact issues for years. And joining him is co-chair of our insurance recovery group, Joe Saka, who helps companies navigate the often confusing world of D&O policies and claims. Patrick and Joe, welcome.}

_{0:01:28.9 Patrick Richard: Great to be here, Anna.}

_{0:01:30.2 Joe Saka: Thanks for having us, Anna. It's a very timely conversation.}

_{0:01:35.3 AT: Let's jump right in. Patrick, let's start with the big picture. Directors and officers were once considered above the corporate fray when it came to corporate responsibility, but we're now seeing them increasingly in the hot seat. What do you think is driving that shift?}

_{0:01:53.7 PR: I'd say it's a combination of things. Historically, that's still the general rule that directors and officers do not face personal liability, certainly for the debts of a corporation. But you have the classic piercing the corporate veil doctrine where a company, corporation failed to observe corporate formalities. Typically it's a smaller company. And directors and officers can also be liable to the corporation for their own gross negligence. Or in some states like California, officers can be liable for their own negligent discharge of their duties. The potential liability really comes, becomes more of an issue, at least from my perspective, if a receiver or trustee is appointed, who is then charged with recouping losses for the failed business. So oversight and good governance standards have certainly broadened in recent years. I think tracing it back 20 years or so ago to Sarbanes-Oxley brought a new focus on individual corporate responsibility for good stewardship of our corporations.}

_{0:03:00.0 AT: Joe, from the insurance side, how are you seeing this play out? I ask because from a transactional side, I'm definitely seeing ripple effects. So boards, when I'm working on an M&A deal, are asking more questions. Buyers, when they're reviewing D&O tail policies, for example, are more careful. And on my M&A deals, I'm certainly seeing the parties spending a lot more time and are being much, much more aggressive in negotiating indemnification provisions, for example, than they were, say, five years ago.}

_{0:03:32.5 JS: Yeah, I mean, I think that tracks with what we're seeing on the claim side as well. And so after any major deal, you have to anticipate the risk that there's gonna be a claim that's made relating to the transaction. So the type of claims that we're seeing triggering D&O policies have really multiplied. It used to be that D&O claims were mostly about traditional securities fraud or shareholder derivative suits, things of that nature. But now we're dealing with cybersecurity incidents, the failure to disclose what your cybersecurity risks are, AI-related disclosures, ESG-related claims. Geopolitical risk, ESG risk, and it just keeps on growing and growing. So the universe of potential claims have really expanded dramatically, and that creates real challenges on the coverage landscape.}

_{0:04:18.3 AT: Patrick, let's break this down. Could you walk us through the legal duties that directors and officers actually owe? Because I think for a lot of business professionals, the specifics here are a little fuzzy.}

_{0:04:31.1 PR: Yes, it's easy to state the two big duties generally owed to the enterprise and to the shareholders to some extent, and that's the duty of loyalty and the duty of care. And under the duty of loyalty, generally that means no self-dealing. Where that gets fuzzy is in some of the details of is this a personal benefit to an insider or not? When I say "is this", the decision that the board made. The duty of care, and that's really where we saw a lot of personal liability after the financial crisis and the lawsuits that followed against directors and officers of failed banks. What would the ordinary prudent person do as a director or officer? And we'll talk more about this, but directors need to be proactive, inform yourself and ask those questions. That all goes to the duty of care. It's basically a negligence or gross negligence standard.}

_{0:05:37.4 AT: And then there's that big shield that you mentioned earlier, the business judgment rule. How strong is that protection really in practice?}

_{0:05:46.2 PR: Well, it's a real thing, and it's addressed in any case where a director or former director or officer has been sued for negligence or gross negligence. But the nuances of that rule, especially here in California, show that it's not a get-out-of-jail-free card, so to speak. In general, courts are reluctant to second-guess a board's business decisions if those decisions were made on an informed basis, in good faith, and a genuine belief that they were serving the company's best interest. Those requirements often present a fact issue, especially for decisions, big decisions that were not well documented so. And of course, California courts and others have always held that it's against public policy to preclude liability for intentional misconduct. So, fraud, embezzlement, things like that. And the business judgment rule certainly wouldn't protect any officer or director from that type of conduct, nor from reckless conduct.}

_{0:06:58.4 PR: That's why gross negligence fails to meet the standards of actually acting to inform yourself, acting in good faith. So I've seen the business judgment rule, we've litigated it in California and federal courts. It's tossed around, but when you get into it, it actually does have predicate requirements that should provide, I would say, warning to directors and officers that you need to discharge your duties, beginning with being well-informed, asking questions. A lot of literature on the importance of being an active rather than a passive board member. That doesn't mean you have to be correct when you're judged with hindsight. It does mean you need to be active and inform yourself.}

_{0:07:44.9 JS: So, Anna, do you mind if I jump in with a question right here?}

_{0:07:49.6 AT: Sure.}

_{0:07:51.0 JS: So this is directed to you corporate attorneys, but what's the practical takeaway? How can individual directors and officers then kind of minimize their exposure in view of the potential limitations to the business judgment rule?}

_{0:08:06.3 AT: No worries, I can take this one, Joe. I would probably boil it down to three key steps. So the first, I think, is that directors should understand the indemnification provisions in their corporate governance documents. So look at the bylaws and making sure that the bylaws require, and I emphasize the word require here, not just permit. So they should require the company to indemnify both current and former directors to the fullest extent permitted by law. And as lawyers, we all know that there's a huge difference between the words may indemnify and shall indemnify. The second step, I think, is that officers and directors should push for the company to get adequate D&O liability insurance. So this is, Joe, where you come in. They need to ensure that the organization has checks and balances in place to catch those mistakes and to really tighten their corporate governance so officers have a complete picture or information when it comes to what their subordinates are actually doing.}

_{0:09:10.7 AT: So you can't say that I didn't know when really what you failed to do was ask the right questions. The final practical step, I would say, is to not only fully investigate and discuss all major decisions, but to also document that process. So the more that you can show that there was an informed decision-making process, the stronger your business judgment rule protection becomes. And this last step seems basic, but I think it's oftentimes overlooked. Let's go back to something that you mentioned earlier, D&O insurance. For our listeners who only deal with these types of insurance at renewal time, maybe put it in a drawer and then forget about it later, can you give us a one-minute overview of what D&O insurance actually covers?}

_{0:10:03.9 JS: Yeah, so I would break it down into coverage for the individuals and coverage for the company itself. Because at its core, D&O insurance protects the personal assets of directors and officers when they're sued either for regulatory proceedings or from shareholders or anything else in their corporate role. But it really extends beyond just the individual, and I think that's a common misconception. So there's side A. There's typically known to be three sides of D&O insurance. Side A is going to cover the individuals for claims made against them. Side B is going to reimburse the company itself when the company indemnifies its directors and officers. And side C, which is sometimes called entity coverage, is going to cover the company itself. And there's going to be a distinction for the coverage between public companies and private companies.}

_{0:10:55.0 JS: For public companies, that side C is going to be limited to securities claims, whereas private companies may have far broader coverage under their D&O insurance policy. So I think that's something that's commonly misunderstood. And one other really important feature of D&O coverage is that it's written on a claims-made basis. That means that it's going to respond to claims first made during the policy period, regardless of when the conduct took place. And this is going to be fundamentally different from most of your commercial general liability or occurrence-based policies, and it makes the timing of notice so much more important.}

_{0:11:39.0 AT: And what are the common exclusions or roadblocks that companies need to be ready for?}

_{0:11:47.8 JS: So I think the first one really is understanding your notice provisions because we see far too many issues relating to late notice. But it also ties into prior notice issues, prior claims exclusions, or known circumstances exclusions. So those can become major issues if the insurer is arguing that there was an earlier demand or an earlier claim, which is when the claim was first made. We'll also commonly see exclusions for fraudulent, dishonest, or intentional wrongful conduct. But those exclusions generally need to be read very carefully because many of them require final adjudication language. So an allegation standing alone is not enough for the carrier to avoid its coverage obligation. Another one that's become a hotly contested issue is the professional services exclusion. And that can be a real battleground because a lot of times carriers are leaving the term professional service undefined.}

_{0:12:51.0 JS: And so the question becomes, what is a professional service and does the claim arise from or relate to a professional service? And then obviously, nothing's gonna be crystal clear in the insurance world. Policies are commonly drafted to be unclear, and so you have a lot of hidden limitations. So two that jump out at me, one is you want to look not just at your exclusions, but at your definitions. And so a lot of the litigation that we've seen over the years relates to the definition of loss in insurance policies and what's carved out from that definition. And then sublimits have become another hotly contested issue where the carrier places a sublimit on certain coverage and is saying that the sublimit restricts rather than expands the coverage. But I think the kind of key takeaway here is language is really critical, and when you're litigating on behalf of policyholders, the tie is typically gonna go to the policyholder, meaning that if there's any ambiguity, it's gonna be construed in the policyholder's favor.}

_{0:13:55.8 AT: Let me ask something that comes up in distress situations, Joe. Just curious, how does bankruptcy or solvency issues impact D&O risks?}

_{0:14:06.3 JS: This is becoming a really big issue. So when a company is approaching insolvency, the D&O policy often is becoming the most valuable asset because the directors and officers themselves don't have the funds available to pay claims. But the tension is, in bankruptcy, the estate often wants to access that D&O policy to pay claims, and there can be fights between the company's creditors, the trustee, the receiver, and the individual directors and officers as to who gets access to the policy proceeds and who gets access to them first. So there's a bespoke insurance policy called Side A D&O insurance, and this is exactly why it's so important because where you have a standalone Side A policy, it's only the directors and officers that are gonna be able to access that coverage. So I think smart directors and officers really need to be considering that as at least part of the solution.}

_{0:15:05.8 AT: Joe, before we move on, let's talk about something that comes up in coverage disputes but is often overlooked, and that's the significance of Delaware law. And I'm not talking about corporate governance, which we'll get into a little bit later, but specifically for you, how does Delaware law matter in the context of D&O insurance coverage?}

_{0:15:27.2 JS: Yeah, it's become one of the most critical issues for D&O insurance right now. And lot of time... To take a step back, insurance law is state law specific, meaning that the same exact dispute can come out completely differently depending on which state's law applies. And so typically you would assume that the place of the company's headquarters is gonna be which law applies, or the place where the policy is delivered is gonna be the state whose law applies. But in Delaware, if you're incorporated in Delaware, which, hint, there's a lot of companies that are incorporated there, Delaware law may apply to their D&O coverage disputes even if the company is headquartered elsewhere or if the policy is delivered elsewhere. So the choice of law fight alone can often be outcome-determinative. So there's been any number of really significant D&O insurance cases in the recent years.}

_{0:16:28.2 JS: So the practical lesson for any in-house counsel who are listening is that when a claim arises, be very careful about which state's law is gonna apply to any coverage disputes. And if you're incorporated in Delaware, you want to be thinking about that.}

_{0:16:40.8 AT: Thanks, Joe. Let's shift to what I think is the most buzzworthy topic in the D&O world right now, artificial intelligence. Patrick, the materials that we've seen all say AI-related developments are transforming the business environment and translating into a new category of D&O risk exposure. Can you tell us more about that?}

_{0:17:03.2 PR: Sure. On the one hand, it is one of the fastest evolving areas just because AI, so much money has gone into that research and promotion and it just dominates so much of our business discussions. On the other hand, it's still the same legal framework in terms of disclosures and being accurate and honest both as to your own AI capabilities and as to the risks posed by AI developments in the marketplace. So for example, from a D&O perspective, we're seeing claims emerge in what's known as AI washing, companies that overstate AI capabilities or prospects to investors. That's the same old thing that's always been done. Our technology can accomplish X. We can determine all of your health issues from a drop of blood. Well, turns out it wasn't true. So a different subject matter for the same motivation of overstating capabilities and raising money.}

_{0:18:10.3 PR: And the SEC, I think it's the Innodata case, goes into... That was filed last year in the Southern District of New York, and there's criminal, parallel criminal proceedings. It's worth looking at because if there's any doubt as to your AI capabilities, you cannot be raising money overstating those capabilities. That's just straight up, straight up fraud. So I would say what's changed is that it's just so much more prevalent and therefore the temptation is that much greater. But one of the other things that we're seeing is sometimes the hype doesn't match the near-term financial results. So if you've priced for perfection because you've wrapped yourself in the AI narrative, and that's going around, even a slight wobble in guidance can cause a massive share price decline. I mean, I'm not saying there's anything untoward, but just looking at IBM, shot up a few weeks ago and then, [chuckle] oh well, there's a difference here between the expectation and the reality.}

_{0:19:26.6 PR: It's actually gonna take longer or not be as effective as folks thought. So time will tell on that front, and I know we'll get into this a little bit further. But the thing I find interesting in terms of disclosed risks and directors and officers is understanding the risks from your competitors, the risks in the marketplace due to the development of AI impacting traditional revenue sources, et cetera.}

_{0:19:55.7 AT: And Joe, from your perspective, is AI changing how underwriters look at D&O risk?}

_{0:20:03.9 JS: Absolutely, but it's still very much kind of a developing landscape. So I think we're starting to see underwriters increasingly ask a lot more questions to companies about their AI governance frameworks and their disclosure practices around AI capabilities. And part of that results from the AI washing claims that we've talked about from the SEC. There was the $65 million Snap settlement that we've mentioned. Carriers are paying close attention to all of these trends. But I think there's also a growing conversation about whether D&O policies are going to cover AI risks or whether they should be channeled into some other type of policy. So I think right now the conventional wisdom is that most D&O policies don't have an explicit AI exclusion and are not going to have one. But I think the coverage landscape is rapidly changing. I think the insurance market's trying to figure out how they want to handle AI risks.}

_{0:21:01.3 JS: And so I could definitely see a situation where AI-related claims are not going to fit neatly into one coverage bucket. So you might see a single claim that makes you look at your D&O policy, your cyber policy, your tech E&O policy, your CGL policy, all at the same time. Policyholders really need to be ready for that.}

_{0:21:25.1 PR: That discussion with all those policies, not that it makes my head spin, Joe, but [chuckle] I'm glad that you love reading insurance policies. But the discussion does remind me of this third category of AI risk that I think we're gonna see grow, and I touched on this earlier. And that is, again, from the director and officer perspective, understanding the risks due to AI in the marketplace and making sure that your disclosures and your public statements are not understating those risks. For example, if web-based advertising is where you drive most your revenue and then Google switches to AI-based search summaries that dramatically reduce click-throughs, that can impact those revenues rather quickly.}

_{0:22:18.4 S?: So the risk of underestimating a known risk is real. And if you underestimate or omit a material known fact, you may be looking at the Reddit situation where it's alleged in a recent complaint that they underestimated Google's AI tools... Which posed not just a theoretical risk, but a lasting threat to Reddit's traffic-dependent revenues.}

_{0:22:40.3 PR: So the critical insight is that it's not just a company's own use of AI that creates risk and overstating your own capabilities. It's understanding that the adoption of AI tools by your customers, competitors, vendors, suppliers, and potentially regulators can reshape your business. And if you don't adequately take a look at that and disclose those risks, you could face liability or investigation, certainly from the SEC.}

_{0:23:09.2 AT: And I think that's a really important point that you make, Patrick, there. The risk isn't just internal, is it? It's coming from the entire ecosystem.}

_{0:23:17.8 PR: I think that's right. And as we move forward and see how the AI washing cases... I think we'll see that those become relatively less significant and that the undisclosed risk cases that we've been talking about, because in hindsight, motivated regulators or shareholders will show, "Well, look, this thing, that this risk came to pass. You were impacted and you should have understood it at the time and disclosed it. And you didn't because you knew that it would impact share price." So undisclosed AI risks from the marketplace, I think, are something to keep an eye on moving forward.}

_{0:24:02.1 AT: Let's stay in the technology lane and talk about cybersecurity. I know this is not a new risk, but it's an area that is constantly evolving. What's the state of play here, Patrick?}

_{0:24:15.9 PR: So this is something that I've always thought is a governance issue, and I've talked to board members about it, that it's a little like for litigators early on not understanding ESI, electronically stored information. You could get a pass early on. Okay, that was 20, 25 years ago. Now the rules of professional conduct require every lawyer, every litigator to understand enough about electronically stored information to understand the pitfalls. I think the same is true for cybersecurity, that corporate leaders are being held personally accountable for their company's cyber governance. Obviously, the prior administration was focused on cybersecurity disclosure guidelines. It's part of consumer protection. You want to know that your personal information hasn't been hacked. And companies obviously don't want to disclose that in great detail because it can impact share price and the success of their business.}

_{0:25:23.1 PR: So from the individual director or officer, you need to ask the questions: what is our cybersecurity policy? What are the protections that are in place? And make sure that the information you're relying on is from a reasonable source. So, for example, I'm sure you've seen it that the DOJ, Department of Justice, recently settled a case with a life sciences company for almost $10 million based on allegations that the company sold products with cybersecurity vulnerabilities to federal agencies. Well, that's gonna draw you right into the False Claims Act. False Claims Act has been around since the Civil War, where you can't sell defective guns to the federal government and get away with it. Well, now, instead of ammunition or guns, we're talking about infected products that fail to meet basic cybersecurity standards. So that's, again, if you're the company that's in that arena and you're a director or officer, ask the questions and ask the hard questions.}

_{0:26:28.7 JS: Yeah, and that kind of dovetails with what we're seeing on the insurance side as well. And I'll note, specific to the False Claims Act, it's become a much more increasingly used tool by this administration, and there is potentially coverage for that under D&O insurance policies. And on the cybersecurity risk front, I think Patrick is exactly right. There's increased responsibility for cyber preparedness, and with that, there's also the risk of claims. And so I think companies are rightly reviewing their D&O insurance policies to make sure that there's not any gaps in coverage there. And so the question isn't just, did the company have a breach? It's also, was the company prepared with their cybersecurity risk, and is the company accurately disclosing what their risks are? So companies really need to make sure that they have both dedicated cyber insurance as well as robust D&O insurance, because the same incident can trigger claims under both.}

_{0:27:31.6 JS: But here's what I'm really telling most of our clients right now: you need to look at these policies together, not just in isolation, because you don't want to be in a situation where you have coverage under neither of your D&O or cyber insurance policies. You really want to understand how they work together.}

_{0:27:48.0 AT: All right, let's pivot to what I think is the most interesting corporate law development of the last two years. And I say this because I've been living and breathing this the most as a transactional lawyer. So what I'm referring to is the movement away from Delaware. We're hearing the term "dexit" being thrown around a lot lately. And honestly, I have to say, a year or two ago, I would have thought that this is just a storm in a teacup, but it's actually turned into something much, much more significant and much bigger. So, Joe, as you mentioned, for decades, Delaware has in the past been the default choice for companies in the US. I think we're seeing figures saying over 65% of Fortune 500 companies are incorporated in Delaware. And this traditionally has been because Delaware has a sophisticated court system. It has a really well-developed body of law, corporate law in particular, and a specialized Court of Chancery for dealing with business disputes.}

_{0:28:51.4 AT: But I think in the last three or so years, and more so gaining a lot of traction through 2024, there has been a growing number of people arguing that Delaware courts have become too aggressive and the courts are starting to second-guess board decisions. Patrick, from the litigation side, you've seen this frustration firsthand, haven't you?}

_{0:29:15.5 PR: I've seen the perception firsthand, absolutely. And the perception, whether it's fair or not, is that Delaware had tipped the scales, perhaps. On the other hand, it could just be more of what the judge in the Maffei versus Palkon decision last year described as a race to the bottom. So whether it was tipping scales or just not moving far enough and fast enough to protect companies and their boards, you have this competition between states: Nevada, Texas, Delaware. "We're the most protective." And so, and of course, Delaware's responded to that. So, yes, the perception's a real thing. I think there are a combination of factors at play on that, though.}

_{0:30:06.1 AT: Yeah. Let's talk a little bit more about what you just mentioned, Patrick. So it seems to me that people are viewing Delaware as leaving the door open to other states. And what you mentioned before about things moving quickly, it seems to me that Nevada and Texas have taken or seized that opportunity and sprinted through that door. Nevada, as we all know, already has no income tax and has a business judgment rule that's arguably broader than Delaware's, but in the last two years, they've gone further. So in February last year, Nevada moved to amend its state constitution to create a specialized business court. So Nevada is basically telling all corporations that what Delaware is known for, we can now offer you the same level of protection. Texas has also been equally aggressive. May last year, Texas created its own business court, and it set a minimum ownership requirement for folks to bring derivative claims and adopted a business judgment rule that appears again to be broader than Delaware's. So all of these changes are making Nevada and Texas very attractive alternatives for boards that feel exposed under Delaware law.}

_{0:31:21.1 PR: It's true, and I would say it's not just cosmetic. Whether you call them reforms or changes, the minimum ownership requirement, for example, will have a real impact and will be a real barrier to smaller-stake shareholder litigation. And the prohibition on fee-only disclosure settlements, that probably eliminates an entire category of what some would call nuisance litigation, right?}

_{0:31:53.0 AT: Yeah, exactly. And you mentioned earlier that Delaware has responded quickly to some of these, and that's in the form of Senate Bill 21, which restricts shareholder rights on claims involving controlling shareholders, particularly in conflict-of-interest transactions. And like Texas, Delaware has also restricted the scope of what constitute corporate documents that are accessible to shareholders. So what I'm seeing is Delaware is trying to address the concerns of its critics to make it harder for plaintiffs to challenge board decisions. But ironically, Patrick, as you mentioned, the Maffei and Palkon case, while the state legislature is trying to keep companies within the state, it seems that the Delaware Supreme Court has made it arguably easier for companies to leave.}

_{0:32:47.1 PR: Well, yes and no. In that case, it was what standard applies to a company's decision to reincorporate from Delaware to Nevada. And one of the contentions from folks who opposed it was, well, this is benefiting some of the major shareholders who were insiders and not others. And that led to, well, which standard applies? Is it the business judgment rule, which we've talked about, or is it the more rigorous entire fairness standard, which gives courts wider discretion to take a second look at a corporation's decision? And the Delaware court said no, simply if reincorporation eliminates the risk of a claim as opposed to an actual claim, we're gonna give the benefit of the doubt to the reincorporation. I view it more as preserving the breadth of the business judgment rule than a broad pronouncement about whether it's, Delaware is taking, whether Delaware courts are taking a position on companies reincorporating elsewhere.}

_{0:33:58.5 PR: But the judge did refer to, or the Court of Appeal did refer to a race to the bottom. Because look, we haven't talked about it, but the flip side is to the extent that you limit shareholder suits, you're removing one aspect of governance that historically you want a remedy for cases of terrible breach of fiduciary duty or self-dealing. So it depends on your perspective. Are those lawsuits just another burden on corporate America or do they promote governance? And certainly I've seen enough of those lawsuits that there's a full spectrum to support either view in that regard.}

_{0:34:40.2 AT: Yeah, and we're also seeing some very high-profile endorsements of dexit. For example, Andreessen Horowitz, the largest venture capital firm in the country, has publicly announced that it's leaving Delaware for Nevada and not only doing that, but also encouraging its portfolio companies to do the same. Of course, that's generated a lot of responses from Delaware supporters stating that this is a very... This is a view that doesn't take into account the bigger picture. But the fact that the country's most prominent VC firm is taking this view tells you that this is no longer a periphery discussion. I'm advising clients on this question a lot now. It comes up as standard part of any corporate restructuring conversation that I'm having with clients. Joe, from your D&O perspective, what does this all mean? If companies move to states where it's harder to sue directors and officers, does that change the risk calculation here?}

_{0:35:46.0 JS: I mean, I think theoretically yes, but I would be very hesitant to think that it's gonna meaningfully change the D&O insurance market. And I think two reasons for that. One, you need a significant volume of data before the insurance market is gonna react to a theoretical reduction in risk. So unless companies really do start moving away from Delaware and the insurance market really does see a dramatic decline in the types of claims out there, I don't think it's gonna really impact how they approach it. And the second reason is, irrespective of what claims are out there at the state law level, it's not gonna change what claims are available under the federal securities law. So those claims are still gonna be out there regardless of where companies are incorporated.}

_{0:36:38.8 PR: Well, and that's exactly right. We hadn't touched on that regardless of changes in state law, those only affect state law claims, breach of fiduciary duty, derivative actions, books and records and the like. But federal class actions under 10b, 10b-5 are governed by federal law. So a significant slice of D&O exposure remains unchanged really regardless of where you incorporate.}

_{0:37:03.2 AT: Okay, let me ask one question, and I think this question has gotten a lot of attention that I think connects directly to this conversation that we're having. How do changes in the political and regulatory environment affect D&O exposure? I ask because as a transactional lawyer, I'm seeing boards grapple with this issue in real time. So they're trying to structure deals, they're trying to come up with a governance framework in an environment where the rules of the road keep shifting. So we've seen changes in SEC enforcement policies, even the current administration's approach to ESG and DEI, Patrick, as you mentioned, is changing. How does all of this factor into the risk picture for directors and officers?}

_{0:37:47.5 PR: Well, certainly the political environment can create a kind of whiplash for corporate governance. Under the prior administration, as I mentioned, companies faced enormous pressure to advance certain policies or initiatives. Some companies arguably overstated their sustainability commitments, so-called greenwashing claims, and they got sued by shareholders. Now under the current administration, companies face scrutiny from the other direction. I think bottom line, the safer course, and this sounds a little like lawyer advice, is to make well-documented, good faith decisions based on what you individually genuinely believe serves the company's long-term interests. And you have to disclose that approach transparently. I would say the political changes and those competing, "Should I be going left? Should I be going right?" reminds me of the lending environment in the run-up to the financial crisis.}

_{0:38:45.0 PR: You had, I mean, think of Warren Buffett. His risk tolerance doesn't change over time. And yet you had a lot of lenders who said, "We're leaving money on the table. Let's make riskier and riskier loans." And then when they blow up, they get sued for it. So you can't just be going with, "Well, this is how the market or the political scene is currently running" or how the wind is blowing. You need to exercise your individual best judgment, inform yourself and document it, and always, always be able to say, "I had the best interests of the company in mind."}

_{0:39:20.9 JS: Yeah. And I think from a coverage perspective, it's very similar, which is that you need to be ready to adapt. And that really strengthens the case for a robust D&O coverage case because you don't know how the wind's gonna blow. So we could go from an aggressive federal government to a federal government that pulls back, but that doesn't mean that your risks go away. Usually they're just changing. So you really just need to make sure that your D&O coverage is designed to address whatever weather is out there.}

_{0:39:55.0 AT: And Joe, I think one thing that's worth mentioning is also the role of state attorneys general in this environment. How does that affect D&O exposure?}

_{0:40:05.2 JS: Yeah, it's a big part of the picture, particularly for individual directors and officers and under private entity D&O coverage. So I think that there was a misconception at the beginning of the Trump administration that the federal government was just gonna stop enforcement. And that's not really what happened. The priorities just shifted. But where those priorities shifted, a lot of times the state attorneys general continue to remain very active. So in consumer protection, antitrust, privacy, and data security, where the federal government may have taken a step backward, the state attorneys general have really filled that void. So from a D&O coverage perspective, you really want to make sure that your policies are designed to cover investigations by both the federal government as well as state attorneys general, because that can create very substantial defense costs and lead to follow-on litigation.}

_{0:41:02.7 AT: Joe, how about the D&O insurance market itself? Because I know that's top of mind for anyone who's managing a corporate insurance program. And I think, honestly, I've seen it come up in virtually every single M&A deal that I've worked on, especially when we're negotiating tail insurance. Where are we in the cycle?}

_{0:41:23.3 JS: We've been in a prolonged soft market, meaning coverage is not only cheaper, but it's easier to get favorable terms. But I think we're starting to see a little bit of a shift. Prices are gonna start going up and it's gonna be harder to get terms. And so I think right now, before that change happens, I think it's really important for companies to take a look at their directors and officers policies, remove as many restrictions as they can, and broaden their coverage as much as possible before it becomes harder to do so.}

_{0:41:56.1 AT: That's very good advice. [chuckle] You also mentioned earlier, Joe, notice. And I want to circle back to that because I think it's one of those issues that seems simple but catches a lot of companies off guard. Why is notice such a recurring problem in D&O claims?}

_{0:42:13.3 JS: Right. It doesn't sound hard, right? When a claim, when a lawsuit hits your desk, report it. The problem is it's not always clear under D&O insurance policies what constitutes a claim. So in some policies, it can be a written or oral demand. In some policies, it can be a request for mediation. So you really need to understand how claim is defined in your insurance policies in order to be able to comply with your notice requirements. And then I think a sub-issue is a lot of times companies are assuming that they only need to report to their primary carrier, and that's a mistake. You really want to look up the tower to the excess carriers as well to make sure that you're not failing to comply with the provision under those policies.}

_{0:42:59.7 AT: And what are some examples of things that might not look like a claim but should be reported?}

_{0:43:06.1 JS: So we mentioned written demands. I think the harder cases are subpoenas, civil investigative demands, Wells notices, informal inquiries. All of those can constitute a claim, depending on the policy. So the mistake companies make is assuming something is too early to report. And so my advice is always don't assume. You want to take a look at the policy, read the definition... Everyone enjoys reading insurance policies... And consider whether you're required to report the issue as a claim. And one other thing that's always worth considering is whether to report it as notice of circumstances or a notice of potential claim. And all that means is you report something that's not yet a claim, but if it comes in at a later point, it's treated as having been made under the existing policy.}

_{0:43:55.6 AT: This is great. I think you've given our listeners a lot of nuggets there, Joe. Let's bring us back to practical advice as we wind down. I know we've covered a lot of ground from directors' duties, insurance, AI, political risk. Patrick, if you could give our listeners three things they could go back and do Monday morning, what would they be?}

_{0:44:17.9 PR: Well, if it's Monday morning, you should probably start with your coffee or drink of choice. [chuckle] But then the thing you're gonna want to do right after that is review your indemnification provisions and bylaws. Do it right now. I thought that point made earlier, Anna, that the difference between a policy that mandates indemnification to the fullest extent permitted by law versus what we see in some language, one that just permits it. Because sometimes when those policies are originally adopted, well, let's just keep our options open. But that can come back to bite you. So, yeah, after your coffee, take a look at those indemnification provisions and make sure that they cover former directors and officers as well, not just current ones. Number two, I'd probably say take a hard look at your board's oversight of AI and cybersecurity. As we discussed, they're not just IT issues anymore.}

_{0:45:16.8 PR: They are, without question, governance issues. And if your board doesn't have a regular reporting cadence on these topics, create one so that you can document that meaningful discussions, not just checking a box, but meaningful reports are going forward and that the directors are being educated on those evolving risks and capabilities. And then number three, and we touched on this, have a serious conversation about the state of incorporation. I'm not saying everyone or anyone should rush to Nevada or Texas, but every board should be making a deliberate, informed decision about where the company is incorporated and why, and just get the current information, request a report and deliberate on it. That's what the duty of the director requires, and that's what I would suggest. So, yeah, those are some of my takeaways from our discussion today.}

_{0:46:17.4 AT: If I could add one more to your list, Patrick, I would say if a company is considering reincorporation, I would advise them not to treat it as a pure governance issue, because I think you need to be bringing your transactional lawyers, like the me in the room, your litigators, like Patrick, and your insurance advisors, like Joe. We should all be having this conversation together in the same room because I think the question of reincorporation touches on all three of these disciplines, so.}

_{0:46:51.9 PR: Good point. I don't want to step on your toes, but it does remind me of in law school, our tax professor said you should never make any business decision based solely on taxes. Don't make an investment based purely on saving money on taxes. So you're absolutely right. You have to look at the broader context.}

_{0:47:10.5 AT: I'm glad you agree with me, Patrick. [chuckle] Joe, same question to you from the insurance side.}

_{0:47:20.6 JS: Yeah, I guess three things from the discussion today. One is try to improve your D&O insurance policy. And I think there's a lot of people out there who think that policies can't be changed. So that's not the case. So you want to take advantage of the current market that we have and keeping in mind that these are really complex legal instruments at the end of the day. So you want to have a seasoned attorney review your insurance policies, see where they can be improved, look for gaps related to AI and cyber. Second is make sure that your policies are responding to your risks. So every single company is going to have a slightly different risk profile depending on the industry, depending on what they do. Consider how your policies are gonna, are going to respond to the risk that you actually face. And third, and this goes back to Patrick's point about indemnification, make sure that you're gonna have dedicated Side A coverage that isn't shared with the entity. And this is both when you don't have indemnification either because the company won't indemnify you or because the company is insolvent. And so you want to be protected under those situations.}

_{0:48:24.1 AT: Fantastic advice, guys. Any final thoughts before we wrap up?}

_{0:48:30.0 PR: Yeah, I guess I'd just say, I mean, having worked with and defended and frankly sued directors and officers over the last several decades, I would just emphasize that in this environment, being proactive makes all the difference. Directors and officers who get into trouble were passive or weren't paying attention or thought someone else was taking care of governance. Anna, there were a thousand companies that had some form of backdating of stock options. And the usual explanation was, "Well, that's how we did it at our last company." Well, that's not a prudent exercise of your governance obligations as a director, certainly, and not as an officer. So you can't assume that another board committee is handling governance or handling the issue of the day. You need to be aware of the risks, ask the questions, be proactive, and document the basis for your decisions. I think that's still the fundamental approach to stay out of governance trouble. And then when you do all those things and you still get sued, you gotta make sure you have the insurance, right, Joe?}

_{0:49:39.0 JS: And that's exactly what I was gonna say. And same basic advice, be proactive. Whenever you get something that smells like a claim or that is a claim, you're gonna want to go to Patrick first so you can make sure that you have your defense in place. But your second, the second thing you should do is make sure that you're considering insurance and making sure that you're evaluating coverage for any potential claim or claims.}

_{0:50:02.8 AT: Thank you so much, guys. I really enjoyed today's conversation and I hope our listeners did as well. To our listeners, whether you're in-house counsel, sitting on a board, or running a company, I hope this conversation gave you some concrete ideas for managing some of the risks we discussed. The landscape is shifting, as we discussed, but with the right corporate governance practices, the right insurance program, and the right advisors, it is possible to navigate this successfully. For additional information on this topic or other corporate transactional, litigation, or insurance matters, please visit our website at nossaman.com. And don't forget to subscribe to Corporate Conversations wherever you listen to podcasts so you don't miss an episode. Until next time.}

_[music]

_{0:50:51.1 S2: Corporate Conversations is presented by Nossaman LLP and may not be copied or rebroadcast without consent. Content reflects the personal views and opinions of the participants. Statements provided in this podcast are for informational purposes only, are not intended as legal advice, and do not create an attorney-client relationship. Listeners should not act solely upon this information without seeking professional legal counsel.}