When the company building Claude needs an auditor, every Big Four firm has a conflict of interest — turns out you can't audit what you're also using to stay competitive.
The Summary
- Anthropic published its second Risk Report under its Responsible Scaling Policy, the framework it uses to gate model releases based on capability thresholds
- The company is selecting EY as its auditor after conflicts disqualified the other Big Four accounting firms, all of which use Claude in their own operations
- The auditor choice matters because it signals both IPO readiness and the growing entanglement between AI builders and the institutions meant to verify them
The Signal
Anthropic's second risk assessment is the latest artifact from a company that gates its own releases. The Responsible Scaling Policy works like this: before shipping a new model, measure its capabilities against defined risk thresholds. If it crosses into dangerous territory (bio-weapons knowledge, autonomous replication, persuasion at scale), you either add safeguards or don't ship. It's self-imposed restraint in an industry that historically ships first and apologizes during the Senate hearing.
The risk report itself is a snapshot. What can Claude do now that it couldn't six months ago. What new threat surfaces opened up. Whether the safety guardrails held. Anthropic's framework is adaptive, which is Silicon Valley speak for "we're making this up as we go, but at least we're writing it down."
"The choice of EY highlights the growing complexity of AI partnerships and their impact on regulatory compliance."
But the real story is who gets to verify that framework. EY appears to be Anthropic's pick for auditor, not because EY is the best at AI auditing (no one is), but because the other three Big Four firms are conflicted out. PwC, Deloitte, and KPMG all use Claude. They're customers. You can't audit the books of the company whose product is embedded in your own revenue engine.
This is the new shape of conflict. Not financial holdings or board seats, but operational dependence. The FT noted that the auditor question matters for two reasons: it's a signal Anthropic is preparing for public markets, and it exposes how quickly AI companies have woven themselves into the infrastructure of the institutions meant to check them.
Key implications of the auditor selection:
- IPO prep requires clean financials and a credible third-party validator
- The Big Four are AI customers now, not just service providers
- Independence standards written for industrial companies don't map cleanly to platform firms
The risk report is governance theater until someone outside the company can verify it. But "outside" is getting harder to define when your product is the default reasoning engine for law firms, accounting firms, and the consultancies that advise everyone else. Anthropic's adaptive governance model only works if the governance is actually independent.
EY wins by default, which is not exactly a ringing endorsement of the system. It's a reminder that we're building verification frameworks for technologies that move faster than verification can keep up. The risk isn't just what Claude can do. It's whether anyone outside Anthropic's walls can credibly say they checked.
The Implication
If you're building AI agents, the Anthropic playbook is worth watching. Self-imposed scaling gates and public risk reports buy you credibility and regulatory goodwill. But the auditor problem is universal. As models get embedded deeper into enterprise ops, independent oversight becomes structurally harder. The company that makes the agent economy possible also makes independence nearly impossible.
For public market investors, the EY selection is a tell. Anthropic is cleaning up for an IPO, which means liquidity is coming for early backers and a valuation reality check is coming for the AI sector. Watch who else starts publishing risk reports and hiring auditors in the next six months.