Increased global information cybersecurity threats and more sophisticated, targeted computer crime pose a risk to the confidentiality, availability and integrity of our data, operations and infrastructure. Our cybersecurity and infrastructure protection technologies, disaster recovery plans and systems, employee training and vendor risk management may not be sufficient to defend us against all unauthorized attempts to access our information or impact our systems. We – and our third-party vendors and service providers – have been and may in the future be subject to cybersecurity events of varying degrees. To date, the impacts of prior events have not had a material adverse effect on us, however, there is no assurance that such an event has not already occurred and we are unaware of it, or that we will not suffer a cybersecurity breach and loss in the future. We devote significant resources to prevent cybersecurity events, incidents, and breaches and to protect our data, but our systems and procedures for identifying and protecting against such attacks and mitigating such risks may prove to be insufficient due to system vulnerabilities, human error or malfeasance, or other factors.
Cybersecurity events involving our information technology systems or those of our third-party vendors and service providers can result in disclosure, unavailability, loss of integrity, theft, destruction, loss, misappropriation or release of confidential financial data, regulated personally identifying or identifiable information, intellectual property and other information; give rise to remediation or other expenses; result in litigation, claims and increased regulatory review or scrutiny; reduce our customers’ willingness to do business with us; disrupt our operations and the services we provide to customers; and subject us to litigation and legal liability under international, U.S. federal and state laws and regulations. Any of such results could have a material adverse effect on our reputation, business, financial condition, results of operations and cash flows.
We are subject to a variety of laws and regulations in Europe, the United States and other jurisdictions regarding privacy, data protection, and data security, including those related to the collection, storage, handling, use, disclosure, transfer, and security of personal data, and impose obligations on us to ensure transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, confidentiality, and accountability. Compliance with and interpretation of various data privacy regulations continue to evolve, and any violation could subject us to legal claims, regulatory penalties, and damage to our reputation.
In addition, the complex and dynamic regulatory environment surrounding artificial intelligence (“AI”), including generative AI, subjects us to a variety of risks. These risks include, but are not limited to, data privacy and security vulnerabilities, intellectual property patent, copyright, and misappropriation claims, unauthorized third-party usage of data associated with training models, and malicious use and advanced deceitful communication methods. AI may be leveraged by threat actors to enhance the volume and sophistication of their attacks, potentially resulting in a cybersecurity event affecting us or our suppliers. Furthermore, we face potential missed innovation opportunities and competitive disadvantages. The evolving nature of AI regulations, such as the European Union Artificial Intelligence Act and other global legislative efforts, adds to the uncertainty and complexity of compliance. Changes in these regulations may require significant adjustments to our AI strategies and operations, potentially leading to increased costs and operational disruptions.