Marsh & McLennan Companies Inc.: 10-K Risk Factor Changes

We have a history of making acquisitions and investments, including a total of 86 in the period from 2020 to 2024, including our recent acquisition of McGriff Insurance Services, LLC ("McGriff") and Gerolamo Holding S.À.R.L. ("Cardano"). We may not be able to successfully integrate the businesses that we acquire into our own business, or achieve any expected cost savings or synergies from the integration of such businesses, including McGriff and 25 25 25 Cardano. Subject to standard contractual protections, we may also be responsible for legacy liabilities of companies that we acquire. Moreover, if we acquire a business operating in regions or industries subject to heightened regulatory scrutiny, we may face significant costs or risks in bringing their operations into compliance with applicable laws and our internal policies. Failure to address these compliance risks could result in regulatory enforcement actions, fines or damage to our reputation. In addition, if in the future the performance of our reporting units or an acquired business varies from our projections or assumptions, or estimates about future profitability of our reporting units or an acquired business change, the estimated fair value of our reporting units or an acquired business could change materially and could result in an impairment of goodwill and other acquisition-related intangible assets recorded on our balance sheet or in adjustments in contingent payment amounts. Given the significant size of the Company's goodwill and intangible assets, an impairment could have a material adverse effect on our results of operations in any given period. We expect that acquisitions will continue to be a key part of our business strategy. Our success in this regard will depend on our ability to identify and compete for appropriate acquisition candidates and to finance and complete the transactions we decide to pursue on favorable terms with positive results. When we dispose of businesses, we may continue to be subject to certain liabilities of that business after its disposition relating to the prior period of our ownership and may not be able to negotiate for limitations on those liabilities. We are also subject to the risk that the sales price is less than the amount reflected on our balance sheet. Financial Risks

We have a history of making acquisitions and investments, including a total of 80 in the period from 2019 to 2023. We may not be able to successfully integrate the businesses that we acquire into our own business, or achieve any expected cost savings or synergies from the integration of such businesses. Subject to standard contractual protections, we may also be responsible for legacy liabilities of companies that we acquire. In addition, if in the future the performance of our reporting units or an acquired business varies from our projections or assumptions, or estimates about future profitability of our reporting units or an acquired business change, the estimated fair value of our reporting units or an acquired business could change materially and could result in an impairment of goodwill and other acquisition-related intangible assets recorded on our balance sheet or in adjustments in contingent payment amounts. Given the significant size of the Company's goodwill and intangible assets, an impairment could have a material adverse effect on our results of operations in any given period. We expect that acquisitions will continue to be a key part of our business strategy. Our success in this regard will depend on our ability to identify and compete for appropriate acquisition candidates and to finance and complete the transactions we decide to pursue on favorable terms with positive results. When we dispose of businesses, we may continue to be subject to certain liabilities of that business after its disposition relating to the prior period of our ownership and may not be able to negotiate for limitations on those liabilities. We are also subject to the risk that the sales price is less than the amount reflected on our balance sheet. Financial Risks

We depend in large part on our technology systems for conducting business, as well as for providing the data and analytics we use to manage our business. As a result, our business success is dependent on maintaining the effectiveness of existing technology systems and on continuing to develop and enhance technology systems that support our business processes and strategic initiatives in a cost and resource efficient manner, particularly as our business processes become more digital. We have a number of strategic initiatives involving investments in or 21 21 21 partnerships with technology companies as part of our growth strategy, as well as investments in technology, including generative AI, and infrastructure to support our own systems. These investments may be costly and require significant capital expenditures, may not be profitable or may be less profitable than what we have experienced historically. In addition, investments in technology systems may not deliver the benefits or perform as expected, or may be replaced or become obsolete more quickly than expected, which could result in operational difficulties or additional costs. In some cases, we also depend on key vendors and partners to provide technology and other support for our strategic initiatives. If these vendors or partners fail to perform their obligations or otherwise cease to work with us, our ability to execute on our strategic initiatives could be adversely affected. If we do not keep up with technological changes or execute effectively on our strategic initiatives, our business and results of operations could be adversely impacted. In addition, to remain competitive in many of our business areas, we must anticipate and respond effectively to the threat of digital disruption and other technological change such as generative AI. The threat comes from traditional players, such as insurers, through disintermediation as well as from new entrants, such as technology companies, "Insurtech" start-up companies and others. In the past few years, there has been a substantial increase in private equity investments into these Insurtech companies. These players are focused on using technology and innovation, including AI, digital platforms, data analytics, robotics and blockchain, to simplify and improve the client experience, increase efficiencies, alter business models and effect other potentially disruptive changes in the industries in which we operate. We are actively investing in generative AI tools. While our internal generative AI tool, LenAI, was designed to meet our standards for data security and to address and mitigate the risks associated with this new technology, our use of generative AI in certain products, services and operations may present risks and challenges that remain uncertain due to the relative novelty of this technology. These risks may include operational disruptions or failures, reputational harm, enhanced governmental or regulatory scrutiny, litigation or ethical concerns. The models underlying AI tools may be incorrectly or inadequately designed or implemented and trained on, or otherwise use, data or algorithms that are (and the output generated by such AI tools also may be) biased, unethical, discriminatory, incomplete, inaccurate, misleading or poor-quality, any of which may not be easily detectable. To the extent that we do not have sufficient rights to use the data used in or output generated by such AI tools, we may be subject to litigation by holders of third-party intellectual property, privacy, publicity, contractual or other rights. If any of our employees, contractors, consultants, vendors or service providers use any third-party AI powered software in connection with our business or the services they provide to us, it may lead to the inadvertent disclosure or incorporation of our confidential information into publicly available training sets, which may impact our ability to realize the benefit of, or adequately maintain, protect and enforce our intellectual property or confidential information, harming our competitive position and business. In addition, the use of AI by other companies has resulted in, and our use of AI may in the future result in, data incidents and cybersecurity breaches. While we have implemented certain mitigation measures and governance related to the proliferation of AI tools, these measures may be inadequate or may not satisfy a growing number of legal and regulatory requirements related to AI. Moreover, if we are perceived to exaggerate the effectiveness, safety or ethical design of AI systems, this could lead to regulatory enforcement, litigation or reputational harm. Any misrepresentation, intentional or unintentional, of our AI-related capabilities or initiatives could also erode trust among clients and regulators. There can be no assurance that our use of AI will enhance our products, services or operations or otherwise result in our intended outcomes. Competitive Risks

We depend in large part on our technology systems for conducting business, as well as for providing the data and analytics we use to manage our business. As a result, our business success is dependent on maintaining the effectiveness of existing technology systems and on continuing to develop and enhance technology systems that support our business processes and strategic initiatives in a cost and resource efficient manner, particularly as our business processes become more digital. We have a number of strategic initiatives involving investments in or partnerships with technology companies as part of our growth strategy, as well as investments in technology, including generative AI, and infrastructure to support our own systems. These investments may be costly and require significant capital expenditures, may not be profitable or may be less profitable than what we have experienced historically. In addition, investments in technology systems may not deliver the benefits or perform as expected, or may be replaced or become obsolete more quickly than expected, which could result in operational difficulties or additional costs. In some cases, we also depend on key vendors and partners to provide technology and other support for our strategic initiatives. If these vendors or partners fail to perform their obligations or otherwise cease to work with us, our ability to execute on our strategic initiatives could be adversely affected. If we do not keep up with technological changes or execute effectively on our strategic initiatives, our business and results of operations could be adversely impacted. In addition, to remain competitive in many of our business areas, we must anticipate and respond effectively to the threat of digital disruption and other technological change such as generative AI. The threat comes from traditional players, such as insurers, through disintermediation as well as from new entrants, such as technology companies, "Insurtech" start-up companies and others. In the past few years, there has been a substantial increase in private equity investments into these Insurtech companies. These players are focused on using technology and innovation, including AI, digital platforms, data analytics, robotics and blockchain, to simplify and improve the client experience, increase efficiencies, alter business models and effect other potentially disruptive changes in the industries in which we operate. We are actively investing in generative AI tools. While our internal generative AI tool, LenAI, was designed to meet our standards for data security and to address and mitigate the risks associated with this new technology, our use of generative AI in certain products and services may present risks and challenges that remain uncertain due to 21 21 21 the relative novelty of this technology. These risks may include enhanced governmental or regulatory scrutiny, litigation or ethical concerns. While we are implementing certain mitigation measures and governance to the proliferation of AI tools, these measures may be inadequate or may not meet a growing number of legal and regulatory requirements related to AI. Competitive Risks

There is continued focus, including from governmental organizations, regulators, investors, colleagues and clients, on ESG and sustainability issues. The regulatory landscape related to these issues continues to evolve, with new laws and reporting requirements introduced across various jurisdictions, including in the U.S., the U.K., the European Union (E.U.) and Australia. These laws and regulations may impose additional compliance or disclosure obligations on us. Inconsistent or even conflicting requirements across jurisdictions may also increase compliance challenges, add operational costs, or lead to stakeholder dissatisfaction. As these ESG reporting requirements and standards evolve, we continue to evaluate and update our public disclosures in these areas, including refining our disclosure of metrics and sustainability goals in accordance with the guidance and our own ESG assessments and priorities. These disclosures, metrics and sustainability goals and any failure to accurately report or comply with federal, state or international ESG laws and regulations, or achieve progress on our metrics and sustainability goals on a timely basis, or at all, may result in legal and regulatory proceedings against us and negatively impact our reputation. Implementation of our ESG initiatives also depends in part on third-party performance or data that is outside the Company's control. In addition, heightened regulatory scrutiny of ESG and sustainability-related products, funds, investment strategies and advice has increased the risk that we could be perceived as, or accused of, making inaccurate or misleading statements, or that we have otherwise run afoul of regulation. Such perceptions or accusations could damage our reputation, result in litigation or regulatory enforcement actions, and adversely affect our business. Organizations that provide information to investors on corporate governance and related matters have also developed ratings processes for evaluating companies on their approach to ESG matters, and unfavorable ratings of our company or our industries may lead to negative investor sentiment and the diversion of investment to other companies or industries, exclusion of our stock from ESG-oriented indices or investment funds or harm our relationships with regulators and the communities in which we operate. Moreover, public opinion and potential legal actions regarding ESG-related initiatives remain highly dynamic and can vary across stakeholders and geographies. Balancing these competing expectations globally is complex. 23 23 23 The impact of new laws and regulations, negative public perception, adverse publicity or negative comments in social media could damage our reputation, and be costly to defend, if we do not, or are not perceived to, adequately address these issues. Any harm to our reputation could impact colleague engagement and retention and the willingness of clients and our partners to do business with us.

There is increased focus, including from governmental organizations, regulators (including the SEC in the U.S.), investors, colleagues and clients, on ESG issues such as environmental stewardship, climate change, greenhouse gas emissions, inclusion and diversity, human rights, racial justice, pay equity, workplace conduct, cybersecurity and data privacy. Negative public perception, adverse publicity or negative comments in social media could damage our reputation if we do not, or are not perceived to, adequately address these issues. Any harm to our reputation could impact colleague engagement and retention and the willingness of clients and our partners to do business with us. Additionally, there has been increased regulatory focus on ESG and sustainability. For example, laws and regulations related to ESG issues continue to evolve, including in the U.S., the U.K., the EU and Australia, and these regulations may impose additional compliance or disclosure obligations on us. In particular, heightened 22 22 22 demand for, and scrutiny of, ESG and sustainable-related products, funds, investment strategies and advice has increased the risk that we could be perceived as, or accused of, making inaccurate or misleading statements, commonly referred to as "greenwashing" or that we have otherwise run afoul of regulation. Such perceptions or accusations could damage our reputation, result in litigation or regulatory enforcement actions, and adversely affect our business. Furthermore, perceptions of our efforts to achieve ESG goals or advance ESG and sustainable-related products, funds, investment strategies or advice may differ widely among stakeholders and could present risks to our reputation and business, including litigation risk. For example, in the U.S. there has been increased legal scrutiny on inclusion and diversity-related programs and initiatives. Moreover, as ESG reporting standards continue to evolve, including with guidance from the International Sustainability Standards Board (ISSB) and the European Sustainability Reporting Standards (ESRS) under the Corporate Sustainability Reporting Directive (CSRD), we continue to evaluate and update our public disclosures in these areas, including refining our disclosure of metrics and goals in accordance with the guidance and our own ESG assessments and priorities. These disclosures, metrics and goals and any failure to accurately report or comply with federal, state or international ESG laws and regulations, or to achieve progress on our metrics and goals on a timely basis, or at all, may result in legal and regulatory proceedings against us and negatively impact our reputation. Implementation of our ESG initiatives also depends in part on third-party performance or data that is outside the Company's control. In addition, organizations that provide information to investors on corporate governance and related matters have developed ratings processes for evaluating companies on their approach to ESG matters, and unfavorable ratings of our company or our industries may lead to negative investor sentiment and the diversion of investment to other companies or industries, exclusion of our stock from ESG-oriented indices or investment funds or harm our relationships with regulators and the communities in which we operate.

We strive to foster a culture in which our colleagues act with integrity and feel comfortable speaking up about potential misconduct. We are a people business, and a well-defined and consistently reinforced corporate culture, starting with a strong “tone from the top,” is critical to ensuring compliance with laws and regulations, attracting and retaining top talent and maintaining the trust of our clients, business partners and other stakeholders. As a multinational company operating across many geographies, failure to effectively align our workforce with our core values and ethical principles may impair our ability to achieve our strategic objectives, particularly as we execute operational model changes and integrate acquisitions. If we fail to maintain our corporate culture, there is an increased risk of unethical behavior or regulatory violations, which could result in legal penalties, reputational damage and financial harm.

We strive to foster a culture in which our colleagues act with integrity and feel comfortable speaking up about potential misconduct. We are a people business, and our ability to attract and retain colleagues and clients is dependent upon our commitment to an inclusive and diverse workplace, trustworthiness, ethical business practices and other qualities. Our colleagues are the cornerstone of this culture, and acts of misconduct by any colleague, and particularly by senior management, could erode trust and confidence and damage our reputation among existing and potential clients and other stakeholders. Remote and hybrid work arrangements, particularly following the COVID-19 pandemic, may also negatively impact our ability to maintain and promote our culture, as we believe being together is integral to promoting our culture.