AMERICAN INTERNATIONAL GROUP, INC.

Technology risk is defined as the risk that technology fails to perform as intended, resulting in missed enterprise objectives. It is associated with the ownership, involvement and adoption of Information Technology within an enterprise. It includes vulnerabilities associated with information technology, operational technology, and communications technology.

AIG strives to reduce the probability and impact of technology risks as much as reasonably practicable while maintaining the ability to conduct business.

Cybersecurity Risk

AIG, like other global companies, continues to witness the increased sophistication and activities of unauthorized parties attempting cyber and other computer-related penetrations such as “denial of service” attacks, phishing, untargeted but sophisticated and automated attacks, and other disruptive software in an effort to compromise systems, networks and obtain sensitive information.

ERM supports the risk management practices of Information Technology, the Information Security Office and the business units and functions that form the lines of defense against the cybersecurity risks that we face.

For additional information regarding the privacy data protection and cybersecurity regulations to which we are subject, see Part I, Item 1. Business – Regulation – Privacy, Data Protection, Cybersecurity and Artificial Intelligence Requirements. For additional discussion of cybersecurity risks, see Part I, Item 1A. Risk Factors – Business and Operations. For additional information regarding our cybersecurity risk management as well as strategy and governance, please see Part I, Item 1C. Cybersecurity.