First Bancshares Inc

We necessarily collect, use and hold personal and financial information concerning individuals and businesses with which we have a banking relationship. This information includes non-public, personally identifiable information that is protected under applicable federal and state laws and regulations. As such, we rely heavily on communications and information systems to conduct our business. Any failure, interruption or breach in security of these systems could result in failures or disruptions in our customer relationship management, deposit, loan and other systems. While we have policies and procedures designed to prevent or limit the effect of the failure, interruption or security breach of our information systems, there can be no assurance that we can prevent any such failures, interruptions, cyber security breaches or other security breaches or, if they do occur, that they will be adequately addressed. Furthermore, developments in generative artificial intelligence (“AI”) may heighten these risks by enabling more sophisticated cyber threats, including AI-generated phishing attacks and automated vulnerability exploitation. We have been, and likely will continue to be, subject to various forms of external security breaches, which may include computer hacking, acts of vandalism or theft, malware, computer viruses or other malicious codes, phishing, employee error or malfeasance, catastrophes, unforeseen events or other cyber-attacks. To date, we have seen no material impact on our business or operations from these attacks or events. Any future significant compromise or breach of our data security, whether external or internal, or misuse of customer, associate, supplier or Company data could damage our reputation, result in a loss of customer business, subject us to additional regulatory scrutiny, or expose us to civil litigation and possible financial liability, any of which could have a material adverse effect on our financial condition and results of operations. In addition, as the regulatory environment related to information security, data collection and use, and privacy becomes increasingly rigorous, with new and constantly changing requirements applicable to our business, compliance with those requirements could also result in additional costs.

The development and use of generative artificial intelligence presents risks and challenges that may adversely impact the Company’s business.

Similar wording appears in 4 other banks' reports.

The Company or its third-party (or fourth party) vendors, clients or counterparties may develop or incorporate AI technology in certain business processes, services, or products. The legal and regulatory environment relating to AI is uncertain and rapidly evolving, both in the U.S. and internationally, and includes regulatory schemes targeted specifically at AI as well as provisions in intellectual property, privacy, consumer protection, employment, and other laws applicable to the use of AI. These evolving laws and regulations could require changes in the Company’s implementation of AI technology and increase the Company’s compliance costs and the risk of non-compliance. AI model, particularly generative AI models, may produce output or take action that is incorrect, that reflects biases included in the data on which they are trained, that results in the release of private, confidential, or proprietary information, that infringes on the intellectual property rights of others, or that is otherwise harmful. In addition, the complexity of many AI models makes it difficult to understand why they are generating particular outputs. This limited transparency increases the challenges associated with assessing the proper operation of AI models, understanding and monitoring the capabilities of the AI models, reducing erroneous output, eliminating bias, and complying with regulations that require documentation or explanation of the basis on which decisions are made. Further, the Company may rely on AI models developed by third

Similar wording appears in 30 other banks' reports.