Brown & Brown Inc.: 10-K Risk Factor Changes

We have completed several acquisitions that have introduced us to various new geographic markets, subjecting us to additional non-U.S. laws, regulations and policies which did not previously apply to us. These laws and regulations are complex, change frequently, have become more stringent over time, could increase our cost of doing business, and could result in conflicting legal requirements. These laws and regulations include international labor and employment laws and data privacy requirements. We will be subject to the risk that we, our employees and our agents may take actions determined to be in violation of any of these laws, regulations or policies, for which we might be held responsible. Actual or alleged violations could result in substantial fines, sanctions, civil or criminal penalties, curtailment of operations in certain jurisdictions, competitive or reputational harm, litigation or regulatory action and other consequences that might adversely affect our results of operations, financial condition or strategic objectives. 18 18 18

In 2022, the Company acquired GRP (Jersey) Holdco Limited and its business and the general insurance operating companies of BdB Limited companies and in 2023 Kentro Capital Limited (the “Acquisitions”). The Acquisitions introduce us to several new geographic markets, subjecting us to additional non-U.S. laws, regulations and policies which did not previously apply to us. These laws and regulations are complex, change frequently, have become more stringent over time, could increase our cost of doing business, and could result in conflicting legal requirements. These laws and regulations include international labor and employment laws and data privacy requirements. We will be subject to the risk that we, our employees and our agents may take actions determined to be in violation of any of these laws, regulations or policies, for which we might be held responsible. Actual or alleged violations could result in substantial fines, sanctions, civil or criminal penalties, curtailment of operations in certain jurisdictions, competitive or reputational harm, litigation or regulatory action and other consequences that might adversely affect our results of operations, financial condition or strategic objectives.

At December 31, 2024, our executive officers, directors and certain of their family members collectively beneficially owned approximately 15.6% of our outstanding common stock, of which J. Hyatt Brown, our chairman of the board, and his sons, J. Powell Brown, our president and chief executive officer, and P. Barrett Brown, our executive vice president and the president of our Retail segment, beneficially owned approximately 15.0%. As a result, our executive officers, directors and certain of their family members have significant influence over (i) the election of our board of directors, (ii) the approval or disapproval of any other matters requiring shareholder approval and (iii) our affairs and policies. 17 17 17

At December 31, 2023, our executive officers, directors and certain of their family members collectively beneficially owned approximately 16.3% of our outstanding common stock, of which J. Hyatt Brown, our chairman of the board, and his sons, J. Powell Brown, our president and chief executive officer, and P. Barrett Brown, our executive vice president and the president of our Retail segment, beneficially owned approximately 15.8%. As a result, our executive officers, directors and certain of their family members have significant influence over (i) the election of our board of directors, (ii) the approval or disapproval of any other matters requiring shareholder approval and (iii) our affairs and policies.

We are subject to a variety of continuously evolving and developing laws and regulations globally regarding privacy, data protection and data security, including those related to the collection, storage, retention, handling, use, processing, disclosure, transfer, destruction and security of personal data. Significant uncertainty exists as privacy and data protection laws evolve and may be interpreted and applied differently from jurisdiction to jurisdiction may create inconsistent or conflicting requirements. These laws apply to transfers of information among our affiliates, as well as to transactions we enter into with third-party vendors. For example, the European Union’s General Data Privacy Regulation (“GDPR”) requires companies to satisfy requirements regarding the handling of personal and sensitive data, including its processing, protection and the ability of persons whose data is stored to correct or delete such data about themselves. Failure to comply with GDPR requirements could result in penalties of up to 4% of worldwide revenue. Additionally, a judgement by the Court of Justice of the European Union on Schrems II made cross border data transfers to organizations outside of the European Economic Area more onerous and uncertain. In addition, legislators and regulators in the U.S. have enacted and are proposing new and more robust privacy and cybersecurity laws and regulations in light of the broad-based cyber-attacks at a number of companies, including the New York State Department of Financial Services Cybersecurity Requirements for Financial Services Companies and the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act. Some jurisdictions provide right of action for data breaches or for collection of certain categories of personal information without consent, which may result in increased litigation. We expect additional jurisdictions to continue to adopt new privacy regulations and that existing regulations may be amended as governments continue to legislate with respect to personal data. Additionally, we are also subject to the terms of our privacy policies and contractual obligations to third parties related to privacy, data protection and information security. We also expect to be subject to a variety of laws and regulations governing AI and RPA, such as the EU AI Act, which was enacted in August 2024. These laws and regulations are still evolving, and while we are assessing how regulators may apply existing consumer protection, data protection and other similar laws to AI, there is uncertainty regarding the scope of new laws and how existing laws will apply. Due to this uncertainty, we may face challenges complying with existing and new laws, and our policies and governance frameworks may not be successful in mitigating these risks. Many statutory requirements, both in the United States and abroad, include obligations for companies to notify individuals of security breaches involving certain personal information, which could result from breaches experienced by us or our vendors. In addition to government regulation, privacy advocates and industry groups have and may in the future propose self-regulatory standards from time to time. These and other industry standards may legally or contractually apply to us, or we may elect to comply with such standards. We expect that there will continue to be new proposed laws and regulations concerning data privacy and security, and we cannot yet determine the impact such future laws, regulations and standards may have on our business. Data protection laws also include strict notification requirements for organizations related to confirmed or suspected breaches. With such a limited time available to validate indicators, there is an increased risk of reporting a false alarm or immaterial breach, which may lead to reputational damage despite there not being an actual data breach. These and similar initiatives around the world could increase the cost of developing, implementing or securing our servers and require us to allocate more resources towards enhanced technologies, further contributing to our technology and compliance costs. In addition, enforcement actions and investigations by regulatory authorities related to data security incidents and privacy violations continue to increase. The enactment of more restrictive laws, rules, regulations or future enforcement actions or investigations could impact us through increased costs or restrictions on our business, and noncompliance could result in regulatory penalties and significant legal liability.

We are subject to a variety of continuously evolving and developing laws and regulations globally regarding privacy, data protection and data security, including those related to the collection, storage, retention, handling, use, processing, disclosure, transfer and security of personal data. Significant uncertainty exists as privacy and data protection laws evolve and may be interpreted and applied differently from country to country and may create inconsistent or conflicting requirements. These laws apply to transfers of information among our affiliates, as well as to transactions we enter into with third-party vendors. For example, the European Union adopted a comprehensive General Data Privacy Regulation (“GDPR”) in May 2016, which replaced the former EU Data Protection Directive and related country-specific legislation. The GDPR became fully effective in May 2018 and requires companies to satisfy new requirements regarding the handling of personal and sensitive data, including its processing, protection and the ability of persons whose data is stored to correct or delete such data about themselves. Failure to comply with GDPR requirements could result in penalties of up to 4% of worldwide revenue. Complying with the enhanced obligations imposed by the GDPR may result in significant costs to our business and require us to revise certain of our business practices. Additionally, a judgement by the Court of Justice of the European Union on Schrems II has made cross border data transfers to organizations outside of the European Economic Area more onerous and uncertain. In addition, legislators and regulators in the U.S. have enacted and are proposing new and more robust privacy and cybersecurity laws and regulations in light of the recent broad-based cyber-attacks at a number of companies, including but not limited to the New York State Department of Financial Services Cybersecurity Requirements for Financial Services Companies, the California Consumer Privacy Act of 2018 and the California Privacy Rights Act. Some states provide right of action for data breaches or for collection of certain categories of personal information without consent, which may result in increased litigation. Many statutory requirements, both in the United States and abroad, include obligations for companies to notify individuals of security breaches involving certain personal information, which could result from breaches experienced by us or our vendors. In addition to government regulation, privacy advocates and industry groups have and may in the future propose self-regulatory standards from time to time. These and other industry standards may legally or contractually apply to us, or we may elect to comply with such standards. We expect that there will 17 17 continue to be new proposed laws and regulations concerning data privacy and security, and we cannot yet determine the impact such future laws, regulations and standards may have on our business. Data protection laws also include strict notification requirements for organizations related to confirmed or suspected breaches. With such a limited time available to validate indicators, there is an increased risk of reporting a false alarm or immaterial breach, which may lead to reputational damage despite there not being an actual data breach. These and similar initiatives around the world could increase the cost of developing, implementing or securing our servers and require us to allocate more resources to improved technologies, adding to our technology and compliance costs. In addition, enforcement actions and investigations by regulatory authorities related to data security incidents and privacy violations continue to increase. The enactment of more restrictive laws, rules, regulations or future enforcement actions or investigations could impact us through increased costs or restrictions on our business, and noncompliance could result in regulatory penalties and significant legal liability.

For the years ended December 31, 2024, 2023 and 2022, no more than 5% of our total core commissions was derived from insurance policies underwritten by one insurance company. Should any insurance company or intermediary seek to terminate its arrangements with us or to otherwise decrease the number of insurance policies underwritten for us, we believe that other insurance companies or intermediaries are available to underwrite the business, although some additional expense and loss of market share could result.

For the year ended December 31, 2023, 2022 and 2021, no more than 5.0% of our total core commissions was derived from insurance policies underwritten by one insurance company. Should any insurance company seek to terminate its arrangements with us or to otherwise decrease the number of insurance policies underwritten for us, we believe that other insurance companies are available to underwrite the business, although some additional expense and loss of market share could result.

Our success depends on our ability to attract, retain and develop skilled and experienced personnel. There is significant competition within the insurance industry and from businesses outside the industry for exceptional employees, especially in key positions. If we are not able to successfully attract, retain, develop and motivate our employees, our business, financial results and reputation could be materially and adversely affected. Our success and future performance depend in part upon the continued services of our executive officers, senior management, and other highly skilled personnel. Losing employees who manage or support substantial customer relationships or possess substantial experience or expertise could adversely affect our ability to secure and complete customer engagements and/or innovate, which would adversely affect our results of operations. This risk may be increased by remote or hybrid working arrangements, which may make our employees more vulnerable to solicitations by competing firms. Competition for skilled professionals remains intense, and employers are implementing new offerings to attract talent, including increasing compensation, enhancing health and wellness solutions, and providing in-office and remote work options. We may be unable to retain our employees if we do not offer employment terms that are competitive with the rest of the labor market. We may have to devote significant resources to attract and retain talent, which could negatively affect our business, results of operations and financial condition. Also, if any of our key employees were to join a competitor or form a competing company, some of our customers could choose to use the services of that competitor instead of our services. While our key employees are generally prohibited by contract from soliciting our employees and customers for a two-year period following separation from employment with us, they are not prohibited from competing with us. Similarly, if an employee joins us from a competitor and is subject to enforceable restrictive covenants, we may be delayed in optimizing the employee’s potential. In addition, regulation or legislation impacting the workforce or the ability to enforce employment-related restrictive covenants (due to applicable laws or regulations), may lead to increased uncertainty and competition for talent. Our key personnel, including our executive officers, may be subject to targeted cybersecurity or physical threats, which, if realized, could adversely affect our business. In addition to the potential impact to us if these risks are realized, which may include reputational harm, the loss of such key personnel or their inability to continue their service with us, we may incur additional expenses to offer monitoring or protection for such key personnel against these threats. In addition, we could be adversely affected if we fail to adequately plan for the succession of our senior leaders and key executives, fail to successfully execute such plan, or if such plans are not well-received by our investors, customers, business partners or employees. The succession plans and employment arrangements we have in place with certain key executives do not guarantee that the services of these executives will continue to be available to us. The loss of our senior leaders or other key employees, or our inability to continue to identify, recruit and retain such personnel, could materially and adversely affect our business, results of operations and financial condition.

Our success depends on our ability to attract, retain and develop skilled and experienced personnel. There is significant competition from within the insurance industry and from businesses outside the industry for exceptional employees, especially in key positions. If we are not able to successfully attract, retain, develop and motivate our employees, our business, financial results and reputation could be materially and adversely affected. Our success and future performance depends in part upon the continued services of our executive officers, senior management, and other highly skilled personnel. Losing employees who manage or support substantial customer relationships or possess substantial experience or expertise could adversely affect our ability to secure and complete customer engagements, which would adversely affect our results of operations. This risk may be increased by remote or hybrid working arrangements, which may make our employees more vulnerable to solicitations by competing firms. Also, if any of our key employees were to join an existing competitor or form a competing company, some of our customers could choose to use the services of that competitor instead of our services. While our key employees are generally prohibited by contract from soliciting our employees and customers for a two-year period following separation from employment with us, they are not prohibited from competing with us. Similarly, if an employee joins us from a competitor and is subject to enforceable restrictive covenants, we may be delayed in optimizing the employee's potential. In addition, regulation or legislation impacting the workforce or the ability to enforce employment-related restrictive covenants (due to state or federal laws or regulations), may lead to increased uncertainty and competition for talent. In addition, we could be adversely affected if we fail to adequately plan for the succession of our senior leaders and key executives. The succession plans and employment arrangements we have in place with certain key executives do not guarantee that the services of these executives will continue to be available to us. The loss of our senior leaders or other key employees, or our inability to continue to identify, recruit and retain such personnel, could materially and adversely affect our business, results of operations and financial condition.

We rely on information technology and third-party vendors to provide effective and efficient service to our customers, process claims, and timely and accurately report information to carriers, which often involves secure processing of confidential, sensitive, proprietary and other types of information. We face potential threats due to new and increasingly sophisticated methods of attack. Cybersecurity breaches of any of the systems we rely on may result from circumvention of security systems, denial-of-service attacks or other cyber-attacks, software bugs, malicious or destructive code, hacking, social engineering attacks (including “phishing” attacks and digital or telephonic impersonation), computer viruses, ransomware, malware, employee or insider error or threats, malfeasance, social engineering, physical breaches or other actions, any of which could expose us to unauthorized access, exfiltration, manipulation, corruption, loss or disclosure of proprietary, customer, employee or other data, the inability to render services due to system outages or other business disruptions, regulatory action and scrutiny, monetary and reputational damages and significant increases in compliance costs. Any of the foregoing may be exacerbated by a delay or failure to detect a cybersecurity incident or the full extent of such incident. A compromise may not manifest itself for months, or even years, and we may not be able to detect a compromise in a timely manner. In addition, disclosure or media reports of actual or perceived security vulnerabilities to our systems or those of our third-party service providers, even if no breach has been attempted or occurred, could lead to reputational harm, loss of customers and revenue, or increased regulatory actions and scrutiny. The risk of such cybersecurity breaches may be increased by our reliance on work-from-home or other remote work technologies. An interruption of our access to, or an inability to access, our information technology, telecommunications or other systems could significantly impair our ability to perform such functions on a timely basis. If sustained or repeated, such a business interruption, system failure or service denial could result in a deterioration of our ability to write and process new and renewal business, provide customer service, pay claims in a timely manner or perform other necessary business functions. We have from time to time experienced cybersecurity incidents, such as malware infections, phishing campaigns, ransomware and vulnerability exploit attempts, which to date have not had a material impact on our business. 12 12 12 We are an acquisitive organization, and the process of integrating the information systems of the businesses we acquire is complex and exposes us to additional risks as we might not adequately identify weaknesses in the acquired company’s information systems, which could expose us to unexpected liabilities or make our own systems more vulnerable to attack. In the future, any material breaches of cybersecurity, or media reports of the same, even if untrue, could cause us to experience reputational harm, loss of customers and revenue, loss of proprietary data, regulatory actions and scrutiny, sanctions or other statutory penalties, litigation, liability for failure to safeguard customers’ information, impairment of invested capital or financial losses. Such losses may not be insured against or not fully covered through insurance we maintain. Despite our efforts to mitigate cybersecurity threats, we cannot guarantee our measures will prevent, contain, detect, or remediate all incidents. The costs and operational consequences of enhancing system protections could rise significantly as threats increase. While we endeavor to design and implement technologies, policies and procedures to identify such incidents as quickly as possible, any response could take substantial time, and there may be extensive delays before we obtain full and reliable information. During such time we would not necessarily know the extent of the harm or how best to remediate it, and certain errors or actions could be repeated or compounded before they are discovered and remediated, all of which may further increase the costs and consequences of such incident. Any of these losses may not be insured against or be fully covered by insurance we maintain. Additionally, our control over and ability to monitor the cybersecurity practices of our third-party vendors and service providers, and other third parties with whom we do business, remains limited, and there can be no assurance that we can prevent, mitigate, or remediate the risk of any compromise or failure in the cybersecurity infrastructure owned or controlled by such third parties. Additionally, any contractual protections with such third parties, including our right to indemnification, if any, may be limited or insufficient to prevent a negative impact on our business from such compromise or failure. As these threats evolve, cybersecurity incidents will be more difficult to detect, defend against, mitigate and remediate. Any of the foregoing may have a material adverse effect on our business, financial condition and reputation.

We rely on information technology and third-party vendors to provide effective and efficient service to our customers, process claims, and timely and accurately report information to carriers and which often involves secure processing of confidential sensitive, proprietary and other types of information. Cybersecurity breaches of any of the systems we rely on may result from circumvention of security systems, denial-of-service attacks or other cyber-attacks, hacking, “phishing” attacks, computer viruses, ransomware, malware, employee or insider error, malfeasance, social engineering, physical breaches or other actions, any of which could expose us to data loss, monetary and reputational damages and significant increases in compliance costs. The risk of such cybersecurity breaches may be increased by our increased reliance on work-from-home or other remote work technologies. An interruption of our access to, or an inability to access, our information technology, telecommunications or other systems could significantly impair our ability to perform such functions on a timely basis. If sustained or repeated, such a business interruption, system failure or service denial could result in a deterioration of our ability to write and process new and renewal business, provide customer service, pay claims in a timely manner or perform other necessary business functions. We have from time to time experienced cybersecurity incidents, such as malware infections, phishing campaigns and vulnerability exploit attempts, which to date have not had a material impact on our business. Additionally, we are an acquisitive organization and the process of integrating the information systems of the businesses we acquire is complex and exposes us to additional risk as we might not adequately identify weaknesses in the targets’ information systems, which could expose us to unexpected liabilities or make our own systems more vulnerable to attack. In the future, any material breaches of cybersecurity, or media reports of the same, even if untrue, could cause us to experience reputational harm, loss of customers and revenue, loss of proprietary data, regulatory actions and scrutiny, sanctions or other statutory penalties, litigation, liability for failure to safeguard customers’ information or financial losses. Such losses may not be insured against or not fully covered through insurance we maintain. We cannot entirely eliminate all risk of improper access to private information, and the cost and operational consequences of implementing, maintaining and enhancing further system protections measures could increase significantly as cybersecurity threats increase. As 13 13 these threats evolve, cybersecurity incidents will be more difficult to detect, defend against and remediate. Any of the foregoing may have a material adverse effect on our business, financial condition and reputation.

Our growth strategy partially includes the acquisition of other insurance intermediaries and related businesses. Our ability to successfully identify suitable acquisition candidates, negotiate transactions on favorable terms, complete acquisitions, successfully integrate acquired businesses into our operations, and expand into new markets requires us to implement and continuously improve our operations and our financial and management information systems. Integrated, acquired businesses may not achieve levels of revenues or profitability comparable to our existing operations, or otherwise perform as expected. In addition, we compete for acquisition and expansion opportunities with firms and banks that may have substantially greater resources than we do. If we are unable to identify appropriate acquisition targets, or if our competitors are more successful in identifying acquisition targets at favorable valuations, we may fail to achieve desired strategic goals and capabilities, and our results of operations may be adversely affected. Additionally, failure to successfully identify and complete acquisitions would likely result in slower growth. Acquisitions also involve a number of risks, such as diversion of management’s attention; difficulties in the integration of acquired operations and retention of employees; increase in expenses and working capital requirements, which could reduce our return on invested capital; entry into unfamiliar markets or lines of business; unanticipated problems or legal liabilities; estimation of acquisition earn-outs; and tax and accounting issues, some or all of which could have a material adverse effect on our results of operations, financial condition and cash flows. Post-acquisition deterioration of operating performance could also result in lower or negative earnings contribution and/or goodwill impairment charges. Additional post-acquisition risks include integration into our existing culture, risks related to retention of personnel, entry into unfamiliar or complex markets or lines of business, contingencies or liabilities, such as violations of sanctions laws or anti-corruption laws, risk relating to ensuring compliance with licensing and regulatory requirements and tax and accounting issues. We may enter new lines of business, implement new technologies, or offer new products and services within existing lines of business either through acquisitions or through initiatives to generate organic revenue growth. These new lines of business, technologies, products, and services may present us with additional risks, particularly in instances where the markets are new or not fully developed or where participants in such markets are new entrants. Such risks include the investment of significant time and resources; the possibility that these efforts will not be successful and could result in reputational damage to us; the possibility that the marketplace does not accept our products or services, that new technologies are not effective, or that we are unable to retain customers that adopt our new products or services; and the risk of new or additional liabilities associated with these efforts, including potential errors and omissions or other claims. External factors, such as compliance with new or revised regulations, competitive alternatives and shifting market preferences may also impact the successful implementation of a line of business, product or service. Additionally, when we dispose of businesses, such as the sale of our third-party claims administration and adjusting services business in the fourth quarter of 2023, we face certain risks, including the risk that we continue to be subject to certain liabilities of those businesses following those dispositions and may not be able to negotiate for limitations on those liabilities. We are also subject to the risk that the sales price is less than the amount reflected on our balance sheet.

Our growth strategy partially includes the acquisition of other insurance intermediaries. Our ability to successfully identify suitable acquisition candidates, complete acquisitions, successfully integrate acquired businesses into our operations, and expand into new markets requires us to implement and continuously improve our operations and our financial and management information systems. Integrated, acquired businesses may not achieve levels of revenues or profitability comparable to our existing operations, or otherwise perform as expected. In addition, we compete for acquisition and expansion opportunities with firms and banks that may have substantially greater resources than we do. If we are unable to identify appropriate acquisition targets, or if our competitors are more successful in identifying acquisition targets at favorable valuations, we may fail to achieve desired strategic goals and capabilities, and our results of operations may be adversely affected. Acquisitions also involve a number of risks, such as diversion of management’s attention; difficulties in the integration of acquired operations and retention of employees; increase in expenses and working capital requirements, which could reduce our return on invested capital; entry into unfamiliar markets or lines of business; unanticipated problems or legal liabilities; estimation of the acquisition earn-out payables; and tax and accounting issues, some or all of which could have a material adverse effect on our results of operations, financial condition and cash flows. Post-acquisition deterioration of operating performance could also result in lower or negative earnings contribution and/or goodwill impairment charges.

Frequent technological changes, new products and services and evolving industry standards are influencing the insurance business. The internet, for example, is increasingly used to securely transmit benefits and related information to customers, operate our day-to-day activities, and to facilitate business-to-business information exchange and transactions. We are continuously taking steps to upgrade and expand our information systems capabilities, including how we electronically interact with our customers, vendors, insurance carriers and other intermediaries. Maintaining, protecting and enhancing these capabilities to keep pace with evolving industry and regulatory standards, and changing customer preferences, requires an ongoing commitment of significant resources. If the information we rely upon to run our businesses was found to be inaccurate or unreliable or if we fail to effectively maintain our information systems and data integrity, we could experience operational disruptions, regulatory or other legal problems, increases in operating expenses, loss of existing customers, difficulty in attracting new customers and/or maintaining third-party relationships or suffer other adverse consequences. Our technological development projects may not deliver the benefits we expect once they are completed or may need to be replaced or become obsolete more quickly than expected, which could result in the accelerated recognition of expenses or write-offs. If we do not effectively and efficiently manage and upgrade our technology portfolio regularly, or if the costs of doing so are higher than we expect, our ability to provide competitive services to new and existing customers in a cost-effective manner and our ability to implement our strategic initiatives could be adversely impacted. Additionally, we use artificial intelligence (“AI”) and robotic processing automation (“RPA”) in our business, including with respect to services provided to our customers. We have internal policies governing the use of AI and RPA by our employees designed to protect us from breaches of data privacy, errors and omissions liability and regulatory enforcement risk; however, our employees could violate these policies and expose us to such risks. Furthermore, our exposure to these risks may increase if our vendors, suppliers, or other third-party providers employ AI or RPA in relation to the products or services they provide to us, as we have limited control over such use in third-party products or services. These risks include the input or processing of confidential information, including material non-public information, in contravention of our policies or contractual restrictions to which any of the foregoing are subject, or in violation of applicable laws or regulations, including 14 14 14 those relating to data protection. If any of these risks materialize, such information could become part of a dataset that is accessible by other third-party AI or RPA applications and/or users. Additionally, AI and RPA heavily rely on the collection and analysis of extensive data sets and interaction between systems. Due to the impracticality of incorporating all relevant data into the models or algorithms used by AI and RPA it is inevitable that data sets within these models will contain inaccuracies and errors, and potential biases. This could potentially render such models inadequate or flawed, negatively impacting the effectiveness of the technology. We are exposed to the risks associated with these inaccuracies, errors and biases, along with the adverse impacts that such flawed models could have on our business and operations. Furthermore, governance and ethical issues relating to the use of AI or RPA may also result in reputational harm, liability and/or financial losses. AI, RPA and related applications are developing rapidly. The use of these technologies by our competitors may give them a competitive advantage that cannot be predicted at this time, and it may negatively affect our assumptions regarding the competitive landscape of our business. Consequently, it is difficult to predict all risks associated with these new technologies, which may eventually impact our business, results of operations, or financial condition.

Frequent technological changes, new products and services and evolving industry standards are influencing the insurance business. The internet, for example, is increasingly used to securely transmit benefits and related information to customers and to facilitate business-to-business information exchange and transactions. 14 14 We are continuously taking steps to upgrade and expand our information systems capabilities, including how we electronically interact with our customers and insurance carriers. Maintaining, protecting and enhancing these capabilities to keep pace with evolving industry and regulatory standards, and changing customer preferences, requires an ongoing commitment of significant resources. If the information we rely upon to run our businesses was found to be inaccurate or unreliable or if we fail to effectively maintain our information systems and data integrity, we could experience operational disruptions, regulatory or other legal problems, increases in operating expenses, loss of existing customers, difficulty in attracting new customers, or suffer other adverse consequences. Our technological development projects may not deliver the benefits we expect once they are completed or may be replaced or become obsolete more quickly than expected, which could result in the accelerated recognition of expenses. If we do not effectively and efficiently manage and upgrade our technology portfolio regularly, or if the costs of doing so are higher than we expect, our ability to provide competitive services to new and existing customers in a cost-effective manner and our ability to implement our strategic initiatives could be adversely impacted.