Avidbank Holdings, Inc.

Technology risk threatens our ability to secure data, maintain system availability, and meet business, client, and regulatory requirements. As we grow, our technology infrastructure must scale to support increasing transaction volumes and evolving client needs while mitigating cybersecurity threats, including social engineering and AI-driven attacks. To strengthen our defenses, we are transitioning from implementing and following the Cybersecurity Assessment Tool (CAT) to the NIST Cybersecurity Framework (CSF) 2.0 and enhancing our Business Impact Analysis (BIA).

Our Exposure to Software‑as‑a‑Service Borrowers Subjects Us to Risks From Rapid Developments in Artificial Intelligence

We maintain lending relationships with software and technology-enabled companies, including those operating under software‑as‑a‑service (“SaaS”) business models. While SaaS borrowers represent approximately 9% of our total loan portfolio, their operating results and credit profiles may be more sensitive to rapid technological change than those of borrowers in more established industries. In particular, ongoing advances in artificial intelligence (“AI”), including generative AI and automation technologies, may adversely affect the competitive position, revenue stability, and long‑term viability of certain SaaS borrowers.

AI developments may increase competitive intensity by lowering barriers to entry, accelerating product commoditization, and enabling customers or third‑party platforms to replicate or replace functionality traditionally provided by standalone software vendors. These pressures may result in pricing compression, higher customer churn, increased research and development costs, or reduced demand for certain software products. Smaller or less diversified SaaS companies, including those that rely on a limited number of products, customers, or end‑markets, may be less able to adapt quickly to these changes.

As a lender, we do not control our borrowers’ business strategies, product development timelines, or ability to successfully incorporate AI into their offerings. To the extent that AI‑related disruption adversely affects a borrower’s revenues, margins, or access to capital, its cash flows and ability to service debt obligations to us could be impaired. These risks may be amplified during periods of economic uncertainty or tightening financial conditions, when SaaS companies may have reduced access to external financing or equity capital.

While we seek to manage these risks through underwriting standards, portfolio diversification, borrower monitoring, and ongoing credit reviews that consider technological and industry developments, the pace and scope of AI‑driven change remain uncertain. Technological disruption may occur more rapidly or in ways that are difficult to anticipate, which could limit the effectiveness of our risk management practices. A sustained deterioration in the financial condition of certain SaaS borrowers could result in increased nonperforming loans, charge‑offs, or provisions for credit losses and could adversely affect our business, earnings and financial condition.

Technology risk threatens our ability to secure data, maintain system availability, and meet business, client, and regulatory requirements. As we grow, our technology infrastructure must scale to support increasing transaction volumes and evolving client needs while mitigating cybersecurity threats, including social engineering and AI-driven attacks. To strengthen our defenses, we are transitioning from implementing and following the Cybersecurity Assessment Tool (CAT) to the NIST Cybersecurity Framework (CSF) 2.0 and enhancing our Business Impact Analysis (BIA).

Our Exposure to Software‑as‑a‑Service Borrowers Subjects Us to Risks From Rapid Developments in Artificial Intelligence

We maintain lending relationships with software and technology-enabled companies, including those operating under software‑as‑a‑service (“SaaS”) business models. While SaaS borrowers represent approximately 8% of our total loan portfolio, their operating results and credit profiles may be more sensitive to rapid technological change than those of borrowers in more established industries. In particular, ongoing advances in artificial intelligence (“AI”), including generative AI and automation technologies, may adversely affect the competitive position, revenue stability, and long‑term viability of certain SaaS borrowers.

AI developments may increase competitive intensity by lowering barriers to entry, accelerating product commoditization, and enabling customers or third‑party platforms to replicate or replace functionality traditionally provided by standalone software vendors. These pressures may result in pricing compression, higher customer churn, increased research and development costs, or reduced demand for certain software products. Smaller or less diversified SaaS companies, including those that rely on a limited number of products, customers, or end‑markets, may be less able to adapt quickly to these changes.

As a lender, we do not control our borrowers’ business strategies, product development timelines, or ability to successfully incorporate AI into their offerings. To the extent that AI‑related disruption adversely affects a borrower’s revenues, margins, or access to capital, its cash flows and ability to service debt obligations to us could be impaired. These risks may be amplified during periods of economic uncertainty or tightening financial conditions, when SaaS companies may have reduced access to external financing or equity capital.

While we seek to manage these risks through underwriting standards, portfolio diversification, borrower monitoring, and ongoing credit reviews that consider technological and industry developments, the pace and scope of AI‑driven change remain uncertain. Technological disruption may occur more rapidly or in ways that are difficult to anticipate, which could limit the effectiveness of our risk management practices. A sustained deterioration in the financial condition of certain SaaS borrowers could result in increased nonperforming loans, charge‑offs, or provisions for credit losses and could adversely affect our business, earnings and financial condition.

• We are subject to laws regarding the privacy, information security and protection of personal information and any violation of these laws or another incident involving personal, confidential, or proprietary information of individuals, including, among others, system failures, cybersecurity breaches of our network security, or wrongful use of artificial intelligence, could damage our reputation and otherwise adversely affect our business.

In the normal course of business, we collect, process, and retain sensitive and confidential information regarding our clients. Although we devote significant resources and management focus to ensuring the integrity of our systems through information security and business continuity programs, our facilities and systems, and those of our third-party service providers, are vulnerable to external or internal security breaches, acts of vandalism, computer viruses, misplaced or lost data, programming or human errors, or other similar events. We and our third-party service providers have experienced these types of events in the past and expect to continue to experience them in the future. These events could interrupt our business or operations, result in significant legal and financial exposure, supervisory liability, regulatory enforcement action, damage to our reputation, loss of clients and business or a loss of confidence in the security of our systems, products and services. The techniques used in cyber-attacks change rapidly and are increasingly sophisticated, including through the use of generative artificial intelligence and deepfakes, and we expect in the future through the use of quantum computing, and we may not be able to anticipate cyber-attacks or data security breaches. Any of these occurrences could have an adverse effect on our business, financial condition and results of operations.

The development and use of artificial intelligence present risks and challenges that may adversely impact our business.

We intend to selectively incorporate AI technology in certain business processes, fraud detections, services or products, including technologies that process sensitive financial and/or personal data. For example, as an initial step, we currently use a software product with AI technology to enhance our fraud detection capabilities for our clients’ banking activity. We have also selectively employed AI technologies to assist in drafting standardized documents and communications, and to search information on the internet. Furthermore, our third-party vendors, clients or counterparties may develop or incorporate AI technology in their business processes, services or products.

The development and use of AI present a number of risks and challenges to our business. The legal and regulatory environment relating to AI is uncertain and rapidly evolving and includes regulation targeted specifically at AI as well as provisions in intellectual property, privacy, consumer protection, employment and other laws applicable to the use of AI. These evolving laws and regulations could require changes in our implementation of AI technology and increase our compliance costs and the risk of non-compliance, including in relation to data privacy and security requirements under laws such as the Gramm-Leach-Bliley-Act (“GLBA”), which mandates the protection of consumer financial information.

AI models, particularly generative AI models, may produce output or take action that is incorrect, that results in the release of private, confidential or proprietary information, that reflects biases included in the data on which they are trained, that produces output that is, or is perceived to be, discriminatory or unfair, that infringes on the intellectual property rights of others, or that is otherwise harmful.

Similar wording appears in 21 other banks' reports.

While we have policies prohibiting our employees from using non-approved generative AI applications or websites on the Company or the Bank’s network, there can be no assurances that our employees will adhere to these policies or that such policies will be effective in mitigating the risks associated with using AI technology. Furthermore, although we have not authorized the use of any AI tools with personally identifiable or nonpublic information, employees may intentionally or inadvertently violate our policy by using personally identifiable or nonpublic information, including sensitive client information, with AI technologies.

Since personally identifiable or nonpublic information may be used with such technologies, there is a risk that these technologies generate output that improperly discloses such personally identifiable or nonpublic information. The use of personally identifiable or nonpublic information could result in a violation of certain laws, including data privacy laws and the data privacy and security requirements of the GLBA, exposing us to legal liability or regulatory penalties. In addition, the complexity of many AI models makes it challenging to understand why they are generating particular outputs. This limited transparency increases the challenges associated with assessing the proper operation of AI models, understanding and monitoring the capabilities of the AI models, ensuring adherence to our privacy policies, reducing erroneous output, eliminating bias and discrimination and complying with regulations that require documentation or explanation of the basis on which decisions are made. Further, we may rely on AI models developed by third parties, and, to that extent, would be dependent in part on the manner in which those third parties develop and train their models, including risks arising from the inclusion of any unauthorized material in the training data for their models, and the effectiveness of the steps these third parties have taken to limit the risks associated with the output of their models, matters over which we may have limited visibility.

Technology risk threatens our ability to secure data, maintain system availability, and meet business, client, and regulatory requirements. As we grow, our technology infrastructure must scale to support increasing transaction volumes and evolving client needs while mitigating cybersecurity threats, including social engineering and AI-driven attacks. To strengthen our defenses, we are transitioning from implementing and following the Cybersecurity Assessment Tool (CAT) to the NIST Cybersecurity Framework (CSF) 2.0 and enhancing our Business Impact Analysis (BIA).

Technology risk threatens our ability to secure data, maintain system availability, and meet business, client, and regulatory requirements. As we grow, our technology infrastructure must scale to support increasing transaction volumes and evolving client needs while mitigating cybersecurity threats, including social engineering and AI-driven attacks. To strengthen our defenses, we are transitioning from implementing and following the Cybersecurity Assessment Tool (CAT) to the NIST Cybersecurity Framework (CSF) 2.0 and enhancing our Business Impact Analysis (BIA).

In the normal course of business, we collect, process, and retain sensitive and confidential information regarding our clients. Although we devote significant resources and management focus to ensuring the integrity of our systems through information security and business continuity programs, our facilities and systems, and those of our third-party service providers, are vulnerable to external or internal security breaches, acts of vandalism, computer viruses, misplaced or lost data, programming or human errors, or other similar events. We and our third-party service providers have experienced these types of events in the past and expect to continue to experience them in the future. These events could interrupt our business or operations, result in significant legal and financial exposure, supervisory liability, regulatory enforcement action, damage to our reputation, loss of clients and business or a loss of confidence in the security of our systems, products and services. The techniques used in cyber-attacks change rapidly and are increasingly sophisticated, including through the use of generative artificial intelligence and deepfakes, and we expect in the future through the use of quantum computing, and we may not be able to anticipate cyber-attacks or data security breaches. Any of these occurrences could have an adverse effect on our business, financial condition and results of operations.

The development and use of artificial intelligence present risks and challenges that may adversely impact our business.

We intend to selectively incorporate AI technology in certain business processes, fraud detections, services or products, including technologies that process sensitive financial and/or personal data. For example, as an initial step, we currently use a software product with AI technology to enhance our fraud detection capabilities for our clients’ banking activity. We have also selectively employed AI technologies to assist in drafting standardized documents and communications, and to search information on the internet. Furthermore, our third-party vendors, clients or counterparties may develop or incorporate AI technology in their business processes, services or products.

The development and use of AI present a number of risks and challenges to our business. The legal and regulatory environment relating to AI is uncertain and rapidly evolving and includes regulation targeted specifically at AI as well as provisions in intellectual property, privacy, consumer protection, employment and other laws applicable to the use of AI. These evolving laws and regulations could require changes in our implementation of AI technology and increase our compliance costs and the risk of non-compliance, including in relation to data privacy and security requirements under laws such as the Gramm-Leach-Bliley-Act (“GLBA”), which mandates the protection of consumer financial information.

AI models, particularly generative AI models, may produce output or take action that is incorrect, that results in the release of private, confidential or proprietary information, that reflects biases included in the data on which they are trained, that produces output that is, or is perceived to be, discriminatory or unfair, that infringes on the intellectual property rights of others, or that is otherwise harmful.

Similar wording appears in 21 other banks' reports.

While we have policies prohibiting our employees from using non-approved generative AI applications or websites on the Company or the Bank’s network, there can be no assurances that our employees will adhere to these policies or that such policies will be effective in mitigating the risks associated with using AI technology. Furthermore, although we have not authorized the use of any AI tools with personally identifiable or nonpublic information, employees may intentionally or inadvertently violate our policy by using personally identifiable or nonpublic information, including sensitive client information, with AI technologies.

Since personally identifiable or nonpublic information may be used with such technologies, there is a risk that these technologies generate output that improperly discloses such personally identifiable or nonpublic information. The use of personally identifiable or nonpublic information could result in a violation of certain laws, including data privacy laws and the data privacy and security requirements of the GLBA, exposing us to legal liability or regulatory penalties. In addition, the complexity of many AI models makes it challenging to understand why they are generating particular outputs. This limited transparency increases the challenges associated

with assessing the proper operation of AI models, understanding and monitoring the capabilities of the AI models, ensuring adherence to our privacy policies, reducing erroneous output, eliminating bias and discrimination and complying with regulations that require documentation or explanation of the basis on which decisions are made. Further, we may rely on AI models developed by third parties, and, to that extent, would be dependent in part on the manner in which those third parties develop and train their models, including risks arising from the inclusion of any unauthorized material in the training data for their models, and the effectiveness of the steps these third parties have taken to limit the risks associated with the output of their models, matters over which we may have limited visibility.

Similar wording appears in 38 other banks' reports.

Technology risk threatens our ability to secure data, maintain system availability, and meet business, client, and regulatory requirements. As we grow, our technology infrastructure must scale to support increasing transaction volumes and evolving client needs while mitigating cybersecurity threats, including social engineering and AI-driven attacks. To strengthen our defenses, we are transitioning from implementing and following the Cybersecurity Assessment Tool (CAT) to the NIST Cybersecurity Framework (CSF) 2.0 and enhancing our Business Impact Analysis (BIA).

In the normal course of business, we collect, process, and retain sensitive and confidential information regarding our clients. Although we devote significant resources and management focus to ensuring the integrity of our systems through information security and business continuity programs, our facilities and systems, and those of our third-party service providers, are vulnerable to external or internal security breaches, acts of vandalism, computer viruses, misplaced or lost data, programming or human errors, or other similar events. We and our third-party service providers have experienced these types of events in the past and expect to continue to experience them in the future. These events could interrupt our business or operations, result in significant legal and financial exposure, supervisory liability, regulatory enforcement action, damage to our reputation, loss of clients and business or a loss of confidence in the security of our systems, products and services. The techniques used in cyber-attacks change rapidly and are increasingly sophisticated, including through the use of generative artificial intelligence and deepfakes, and we expect in the future through the use of quantum computing, and we may not be able to anticipate cyber-attacks or data security breaches. Any of these occurrences could have an adverse effect on our business, financial condition and results of operations.

The development and use of artificial intelligence present risks and challenges that may adversely impact our business.

We intend to selectively incorporate AI technology in certain business processes, fraud detections, services or products, including technologies that process sensitive financial and/or personal data. For example, as an initial step, we currently use a software product with AI technology to enhance our fraud detection capabilities for our clients’ banking activity. We have also selectively employed AI technologies to assist in drafting standardized documents and communications, and to search information on the internet. Furthermore, our third-party vendors, clients or counterparties may develop or incorporate AI technology in their business processes, services or products.

The development and use of AI present a number of risks and challenges to our business. The legal and regulatory environment relating to AI is uncertain and rapidly evolving and includes regulation targeted specifically at AI as well as provisions in intellectual property, privacy, consumer protection, employment and other laws applicable to the use of AI. These evolving laws and regulations could require changes in our implementation of AI technology and increase our compliance costs and the risk of non-compliance, including in relation to data privacy and security requirements under laws such as the Gramm-Leach-Bliley-Act (“GLBA”), which mandates the protection of consumer financial information.

AI models, particularly generative AI models, may produce output or take action that is incorrect, that results in the release of private, confidential or proprietary information, that reflects biases included in the data on which they are trained, that produces output that is, or is perceived to be, discriminatory or unfair, that infringes on the intellectual property rights of others, or that is otherwise harmful.

Similar wording appears in 21 other banks' reports.

While we have policies prohibiting our employees from using non-approved generative AI applications or websites on the Company or the Bank’s network, there can be no assurances that our employees will adhere to these policies or that such policies will be effective in mitigating the risks associated with using AI technology. Furthermore, although we have not authorized the use of any AI tools with personally identifiable or nonpublic information, employees may intentionally or inadvertently violate our policy by using personally identifiable or nonpublic information, including sensitive client information, with AI technologies.

Since personally identifiable or nonpublic information may be used with such technologies, there is a risk that these technologies generate output that improperly discloses such personally identifiable or nonpublic information. The use of personally identifiable or nonpublic information could result in a violation of certain laws, including data privacy laws and the data privacy and security requirements of the GLBA, exposing us to legal liability or regulatory penalties. In addition, the complexity of many AI models makes it challenging to understand why they are generating particular outputs. This limited transparency increases the challenges associated with assessing the proper operation of AI models, understanding and monitoring the capabilities of the AI models, ensuring adherence to our privacy policies, reducing erroneous output, eliminating bias and discrimination and complying with regulations that require documentation or explanation of the basis on which decisions are made. Further, we may rely on AI models developed by third parties, and, to that extent, would be dependent in part on the manner in which those third parties develop and train their models, including risks arising from the inclusion of any unauthorized material in the training data for their models, and the effectiveness of the steps these third parties have taken to limit the risks associated with the output of their models, matters over which we may have limited visibility.