AmazonScience/document-haystack

1Beginning after the conclusion of the five-year monitoring period in 2024, the IAIS has agreed to a second phase of implementation in 2which the ICS will be applied as a group-wide prescribed capital requirement, defined as a solvency control level above which the 3supervisor does not intervene on capital adequacy grounds. However, in recognition that the United States and potentially other 4interested jurisdictions are developing an alternative approach to a group capital calculation that, as with the GCC, utilizes an 5aggregation methodology of available capital and required capital of all insurance group members (Aggregation Method or AM), the 6IAIS is assessing whether the AM provides comparable outcomes to ICS Version 2.0, including by collecting data from interested 7jurisdictions. The IAIS aims to be in a position by the end of the monitoring phase to assess whether the AM provides substantially the 8same outcome as the ICS, in which case it will be considered an outcome-equivalent approach to the ICS. 9The standards issued by the FSB and/or the IAIS are not binding on the United States or other jurisdictions around the world unless 10and until the appropriate local governmental bodies or regulators adopt laws or regulations implementing such standards. 11PRIVACY, DATA PROTECTION, CYBERSECURITY AND ARTIFICIAL INTELLIGENCE REQUIREMENTS12We are subject to various laws and regulations that require financial institutions and other businesses to protect and safeguard 13personal and other sensitive information and provide notice of their practices relating to the collection, disclosure and other processing 14of personal information. We also are subject to U.S. federal and state laws and regulations requiring notification to affected individuals 15and regulators of a data breach(es). Below we highlight a few key privacy, data protection, cybersecurity and artificial intelligence (AI) 16laws and regulations.17In October 2017, the NAIC adopted the Insurance Data Security Model Law (NAIC Data Security Model Law), which, among other 18things, requires insurers, insurance producers and other entities required to be licensed under state insurance laws to develop and 19maintain a written information security program, conduct risk assessments, and oversee the data security practices of third-party 20service providers. As of December 31, 2023, more than 20 jurisdictions had adopted the NAIC Data Security Model Law. In addition, 21on March 1, 2019, the NYDFS’s cybersecurity regulation became fully effective, requiring covered financial institutions, including 22insurance entities licensed in New York, to, among other things, implement a cybersecurity program designed to protect information 23systems. On November 1, 2023 the NYDFS published amendments to this cybersecurity regulation, which include additional 24obligations for large insurers including enhanced and updated governance, risk assessment, and technology requirements, new 25notification obligations, and clarifying changes regarding enforcement. 26The State of California enacted the California Consumer Privacy Act of 2018 (CCPA), which went into effect as of January 1, 2020, 27and imposes significant and often first-of-their-kind privacy obligations on businesses handling data related to California residents. 28The law has a number of exceptions as a result of amendments however; it does not apply to personal information collected, 29processed, sold, or disclosed pursuant to the federal Gramm-Leach-Bliley Act (GLBA) and implementing regulations or the California 30Financial Information Privacy Act (FIPA). These amendments reduce the impact of the law on AIG in some, but not all, areas. The 31California Privacy Rights Act (CPRA) passed in November 2020 became effective January 1, 2023 and amends the CCPA to create 32additional privacy rights and obligations in California. Colorado, Connecticut, Utah and Virginia also enacted comprehensive 33consumer data privacy laws and many other states have proposed similar laws, albeit with similar exemptions for entities and/or data 34governed by the GLBA. 35These privacy laws impose requirements on covered businesses that are similar to those imposed by the CCPA with respect to 36privacy notices, data subject rights and data security standards.37The Securities and Exchange Commission (SEC) Rules of Cybersecurity Risk Management, Strategy, Governance and Incident 38Disclosure by Public Companies require among other things, disclosure by registrants of any material cybersecurity incident on Form 398-K within four business days of determining that the incident the registrant has experienced is material. They also require periodic 40disclosures of, among other things, (i) details on the company’s cybersecurity policies and procedures, and (ii) cybersecurity 41governance and oversight policies, including the board of directors’ oversight of any material incidents (individually or in the 42aggregate). 43The EU General Data Protection Regulation (GDPR) took effect in May 2018. The GDPR’s scope extends to entities established 44within the EEA (i.e., EU member states plus Iceland, Liechtenstein and Norway) and to certain entities not established in the EEA (in 45certain instances, if they solicit or target individuals in the EU by offering goods or services to EEA data subjects or monitoring the 46personal behavior of EEA data subjects (e.g., in an online context)). The GDPR was also onshored in the UK through the European 47Union (Withdrawal) Act 2018, with adjustments as provided in the Data Protection, Privacy and Electronic Communications 48(Amendments etc.) (EU Exit) Regulations 2019. Sanctions for non-compliance with the GDPR are onerous, with the potential for fines 49of up to 4 percent of global revenue for the most serious infringements of the GDPR.50We have sought to address the GDPR’s requirements by demonstrating accountability for compliance with the GDPR’s principles 51relating to processing of personal data, maintaining records of processing and completing mandatory Data Protection Impact 52Assessments in connection with higher risk data processing activities.53ITEM 1 | Business54AIG | 2023 Form 10-K 11