ITEM 1 | Business
standards for areas such as group supervision, governance and internal controls, enterprise risk management, and recovery and resolution planning. We currently meet the criteria set forth to identify an IAIG, and the NYDFS, as our group-wide supervisor, has publicly disclosed us as an IAIG on the IAIS’ register of IAIGs.
The IAIS has adopted an enhanced set of supervisory policy measures for the assessment and mitigation of systemic risk in the insurance sector (Holistic Framework). The Holistic Framework recognizes that systemic risk may arise not only from the distress or disorderly failure of an individual insurer, but also from the collective exposures and activities of insurers at a sector-wide level. The FSB has also been engaging with member jurisdictions in order to encourage greater adherence to its “Key Attributes for Effective Resolution Regimes for the Insurance Sector” to ensure that large, internationally active insurers can exit the market in an orderly fashion and avoid the need for taxpayer bailouts. Starting in December 2024, the FSB began publishing an annual list of insurers, including AIG, that are subject to resolution planning requirements which impose on AIG an obligation to provide to our key global regulators a comprehensive resolution plan for the Company along with periodic updates.
As part of ComFrame, the IAIS also developed a risk-based global Insurance Capital Standard (ICS) applicable to IAIGs. The IAIS formally adopted the ICS at its annual general meeting in December 2024. The ICS is intended to be applied as a group-wide prescribed capital requirement, defined as a solvency control level above which the supervisor does not intervene on capital adequacy grounds. In parallel, the United States developed the Aggregation Method (AM) as an alternative approach to the consolidated ICS group-capital calculation. Following a comparability assessment, the IAIS determined in November 2024 that the AM delivers comparable outcomes to the ICS and therefore provides the basis for implementation of the ICS. The AM is expected to be implemented in the United States through the GCC.
The standards issued by the FSB and/or the IAIS are not binding on the United States or other jurisdictions around the world unless and until the appropriate local governmental bodies or regulators adopt laws or regulations implementing such standards.
PRIVACY, DATA PROTECTION, CYBERSECURITY AND ARTIFICIAL INTELLIGENCE REQUIREMENTS
We are subject to various laws and regulations that require financial institutions and other businesses to protect and safeguard personal and other sensitive information and provide notice of their practices relating to the collection, disclosure and other processing of personal information. We also are subject to U.S. federal and state laws and regulations requiring notification to affected individuals and regulators of a data breach. Below we highlight a few key applicable privacy, data protection, cybersecurity and artificial intelligence (AI) laws and regulations.
In the European Union, the EU Digital Operational Resilience Act requires covered entities, including insurance intermediaries, reinsurance intermediaries and ancillary insurance intermediaries to comply with a wide range of organizational and technical requirements to identify, manage and mitigate operational risk arising from use of network and information systems and, in particular, the use of third-party information and communication technology service providers.
In October 2017, the NAIC adopted the Insurance Data Security Model Law (NAIC Data Security Model Law), which, among other things, requires insurers, insurance producers and other entities required to be licensed under state insurance laws to develop and maintain a written information security program, conduct risk assessments, and oversee the data security practices of third-party service providers. As of December 31, 2025, more than 25 jurisdictions had adopted the NAIC Data Security Model Law. In addition, on March 1, 2019, the NYDFS’s cybersecurity regulation became fully effective, requiring covered financial institutions, including insurance entities licensed in New York, to, among other things, implement a cybersecurity program designed to protect information systems. The 2023 amendments to this cybersecurity regulation added obligations for large insurers including enhanced and updated governance, risk assessment, and technology requirements, new notification obligations, and clarifying changes regarding enforcement.
The State of California enacted the California Consumer Privacy Act of 2018 (CCPA), which went into effect as of January 1, 2020, and imposes significant privacy obligations on businesses handling data related to California residents. The law has a number of exceptions; it does not apply to personal information collected, processed, sold, or disclosed pursuant to the federal Gramm-Leach-Bliley Act (GLBA) and implementing regulations or the California Financial Information Privacy Act. The California Privacy Rights Act passed in November 2020 became effective January 1, 2023 and amends the CCPA to create additional privacy rights and obligations in California. A number of other states, including Colorado, Connecticut, Texas and Virginia also enacted comprehensive consumer data privacy laws and many other states have proposed similar laws, albeit with similar exemptions for entities and/or data governed by the GLBA.
These privacy laws impose requirements on covered businesses that are similar to those imposed by the CCPA with respect to privacy notices, data subject rights and data security standards.
The Securities and Exchange Commission (SEC) requires that registrants disclose any material cybersecurity incident on Form 8-K within four business days of determining that the incident the registrant experienced is material. Periodic disclosures of, among other things, (i) details on the company’s cybersecurity policies and procedures, and (ii) cybersecurity governance and oversight policies, including the board of directors’ oversight of any material incidents (individually or in the aggregate) are also required.
AIG | 2025 Form 10-K | 9
ITEM 1 | Business
The scope of the EU General Data Protection Regulation (GDPR) extends to entities established within the European Economic Area (EEA, i.e., EU member states plus Iceland, Liechtenstein and Norway) and to certain entities not established in the EEA (in certain instances, if they solicit or target individuals in the EU by offering goods or services to EEA data subjects or monitoring the personal behavior of EEA data subjects (e.g., in an online context)). The GDPR was also onshored in the UK through the European Union (Withdrawal) Act 2018, with adjustments as provided in subsequent regulations. Sanctions for non-compliance with the GDPR are onerous, with the potential for fines of up to 4 percent of global revenue for the most serious infringements.
We have sought to address the GDPR’s requirements by demonstrating accountability for compliance with the GDPR’s principles relating to processing of personal data, maintaining records of processing and completing mandatory Data Protection Impact Assessments in connection with data processing activities identified by the GDPR as “higher risk.”
The GDPR imposes requirements on the transfer of personal data outside of the EEA, including via standard contractual clauses supplemented by an assessment and due diligence of the legal and regulatory landscape of the jurisdiction of the data importer, the channels used to transmit personal data and the processors or subprocessors of personal data.
Certain U.S. states have adopted or are considering regulations and guidance relating to the use of “big data,” AI, machine learning and other technology innovations in the insurance marketplace. For example, in December 2023, the NAIC adopted a model bulletin on the use of AI by insurers that sets forth governance, risk management and other requirements that insurers using AI are expected to establish. A significant number of states have issued regulatory guidance based on the NAIC model bulletin. In addition, state insurance regulators in the United States, including NYDFS, have issued and will continue to consider regulations or proposed guidelines in the use of external data, algorithms and AI in insurance practices, including underwriting, marketing, and claims practices.
The EU has also taken steps to regulate the use of data and algorithms used for the purpose of AI and automated decision-making. For example, the European Union Artificial Intelligence Act, which entered into force on August 1, 2024, with various requirements becoming effective at different points in time, broadly regulates the use of AI. European countries, and supranational political organizations like the EU and the Council of Europe, are expected to continue taking an active role in regulating AI in ways that may impact the insurance industry.
We also are subject to other international laws and regulations that require financial institutions and other businesses to protect personal and other sensitive information and provide notice of their practices relating to the collection, disclosure and other processing of personal information and to obtain consent for specific processing activities. We are also subject to laws and regulations requiring notification to affected individuals and regulators of security breaches and laws and regulations regarding data localization and the cross-border transfer of information.
SUSTAINABILITY
In recent years, federal- and state-level lawmakers and regulators in the United States and in other major countries in which we operate have increased their scrutiny on financial institutions and other companies’ governance, risk oversight, disclosures, plans, policies and practices in connection with climate change and other sustainability topics, which continue to evolve and diverge across jurisdictions. There have been active and significant regulatory developments on these issues in the form of newly proposed, issued or implemented laws, rules, regulations, guidance and frameworks regarding climate change that impose, or will impose if and when effective, new requirements and expectations, including in connection with climate- related governance, risk management, disclosures, stress testing and scenario analysis. Regulators in several jurisdictions are considering the so-called protection gap as it relates to climate – instances in which populations are under-insured or there is insufficient coverage to protect policyholders against the risks associated with climate change. We continue to actively monitor the regulatory landscape surrounding these issues.
10 | AIG | 2025 Form 10-K