Arthur J. Gallagher & Co.: 10-K Risk Factor Changes

While we maintain some of our critical information technology systems, we are dependent on third-party providers of information technology systems and services, as well as other non-IT services, to meet the needs of our business and our clients around the world. As we do not fully control the actions of these third parties, we are subject to the risk that their decisions, actions, or inactions may adversely impact us, and replacing these service providers could create significant delay and expense. There is a risk that our third-party providers could engage in business practices that are prohibited by our internal policies or violate applicable laws and regulations. A failure by third parties to comply with service-level agreements or regulatory or legal requirements in a high-quality and timely manner, particularly during periods of our peak demand for their services, could result in economic and reputational harm to us. These third parties face their own technology, operating, business and economic risks, and any significant failures by them, including the improper use or disclosure of our confidential client, employee or company information, could cause harm to our business and reputation. An interruption in or the cessation of service by any service provider as a result of systems failures, cybersecurity incidents, capacity constraints, financial difficulties, or for any other reason could disrupt our operations, impact our ability to offer certain products and services, and result in contractual or regulatory penalties, liability claims from clients or employees, damage to our reputation, and harm to our business. See also “Business disruptions could have a material adverse effect on our operations, damage our reputation and impact client relationships.”