First Financial Corp

The occurrence of a cybersecurity incident involving us, third-party service providers, or our customers, regardless of its origin, could damage our reputation and result in a loss of customers and business and subject us to additional regulatory scrutiny, and could expose us to litigation and possible financial liability. Furthermore, as technology, including the increasing use of artificial intelligence, machine learning, large language models, artificial intelligence agents, generative artificial intelligence, and other similar technologies (collectively referred to as “AI”), and cyberattacks change over time, we may be required to expend significant additional resources to modify our protective measures or to investigate and remediate vulnerabilities or other exposures arising from operational and security risks. Any of these events could have a material adverse effect on our financial condition and results of operations.

The Corporation relies on external vendors to provide products and services necessary to maintain day-to-day operations of the Corporation. Accordingly, the Corporation’s operations are exposed to risk that these vendors or their employees, agents, or other representatives will not perform in accordance with the contracted arrangements under service level agreements. Additionally, the Corporation may be exposed to certain risks involved with the use of AI tools of vendors and their employees or agents, as further discussed in the Risk Factor titled “The increased prevalence, use and development of AI may subject the Corporation to increased regulatory risk, reputational risk and may have material adverse effects on the Corporation’s business, financial condition and results of operations.” The failure of an external vendor to perform in accordance with the contracted arrangements under service level agreements, because of changes in the vendor’s organizational structure, use of AI tools, financial condition, support for existing products and services, strategic focus, or for any other reason, could be disruptive to the Corporation’s operations, which could have a material adverse impact on the Corporation’s business and, in turn, the Corporation’s financial condition and results of operations.

The financial services industry is continually undergoing rapid technological change with frequent introductions of new technology-driven products and services, including cryptocurrency and stablecoin related products and services, products and services implementing AI and AI tools and other new financial technologies. The effective use of technology can increase efficiency, provide cutting-edge products and/or services, and enable financial institutions to better serve customers and to reduce costs. The Corporation’s future success depends, in part, upon its ability to address customer needs by using technology to provide products and services that will satisfy customer demands, as well as to create additional efficiencies in the Corporation’s operations. The Corporation may not be able to effectively implement new technology-driven products and services, be successful in marketing these products and services to its customers, or incur significant costs in implementing new technology-driven products and services. Further, many of our competitors have substantially greater resources to invest in technological improvements and may do so in a more cost effective manner. Failure to successfully keep pace with technological change affecting the financial services industry could negatively affect the Corporation’s growth, revenue, profit, financial condition and results of operations.

The increased prevalence, use and development of AI may subject the Corporation to increased regulatory risk, reputational risk, and may have material adverse effects on the Corporation’s business, financial condition, and results of operations.

The growth of AI has spurred a new industry of technological advances. Users of AI tools may not fully understand the implications of the use of such tools , including the scope of capabilities for these tools, protection of confidential information when using AI tools, cybersecurity risks inherent with the use of AI tools, as well as unknown or unidentified risks inherent with the development of new technology. The use of AI tools is being implemented by both individuals and commercial entities, increasing the risks from the use of these tools to the users and any systems that interact with AI tools.

Increased customer use of AI tools can potentially result in increased of a customer unintentionally exposing their personal information, banking credentials or other sensitive or confidential information, and increase opportunities for bad actors to conduct fraudulent activities with respect to a customer’s account(s). While the Corporation and the Bank have implemented commercially reasonable policies and procedures to protect against and mitigate these risks, we cannot assure protection against all risks from the use of these AI tools by customers. These AI tools are powerful technological advances and the customer’s use of such tools can result in cybersecurity risks to the customer and the Corporation. Such risks, if realized, could result in financial and litigation risk to us and/or our customers, which could negatively affect the Corporation’s growth, reputation, revenue, expenses, financial condition, and results of operations.

As competitors, whether traditional competitors of the Corporation or new entrants into the financial services industry, incorporate AI tools into their products and services, the Corporation faces risk with respect to competition and industry reputation. Successful implementation of AI tools by competitors may impair our ability to attract and retain business. Additionally, if competitors realize issues with the incorporation of AI tools into their products and services and the cyberattack, inadvertent disclosure of personal information, banking credentials or other sensitive or confidential information, financial loss or other risks discussed herein related to AI tools are realized, the Corporation could suffer from reputational harm to the financial services industry as a whole.

Vendor use of AI tools may increase the risk of cyberattacks, unauthorized use or disclosure of personal information, banking credentials or other sensitive or confidential information, financial loss, or other risks discussed herein related to AI tools. In conducting due diligence of vendors, we request detailed information regarding vendor use of AI and seek to mitigate risks related to a vendor’s employment of AI tools through service level agreements. While we seek to mitigate these risks, a possibility exists that vendors may employ AI tools without disclosing their use to the Corporation, the AI tools disclosed to us may increase capabilities, features, services, or technologies that increase cybersecurity risks, employees of vendors may use undisclosed AI tools in performing services on behalf of the vendor, employees of vendors may inadvertently or inappropriately use AI tools in performing duties on behalf of the Corporation, or vendors may not understand which AI tools are being utilized while performing services on behalf of the Corporation. Vendor use of AI tools increase cybersecurity risks, including the risk of inadvertent or deliberate exposure of personal information, banking credentials or other sensitive or confidential information, or may otherwise expose the Corporation to risks that have not yet been determined as a result of the exponential growth of the power, capabilities and frequency of use with respect to these tools, which could negatively affect the Corporation’s growth, reputation, revenue, expenses, financial condition, and results of operations.

The Corporation’s implementation of AI tools may subject the Corporation to increased regulatory risk, reputational risk and may have material adverse effects on the Corporation’s business, financial condition, and results of operations.

The Corporation implemented a form of AI with its intelligent digital assistant, Gabby, available through the Bank’s website. Use of AI can expose us to new or increased operation risks, including risks related to our internal controls. As the use of AI expands and grows, it may become subject to additional regulations or restrictions on use from the U.S. government and/or our banking regulators. Additionally, ineffective implementation or failures by any implemented AI could have an adverse effect on our reputation, cause the Corporation to incur additional costs to make the implementation successful, or otherwise result in a loss of expenses incurred if the Corporation decides to terminate the pursuit of a failed AI implementation. Further, many of our competitors have substantially greater resources to invest in technological improvements and may do so in a more cost effective manner. The realization of these risks could result in the Corporation failing to realize any anticipated benefits from the implementation of AI and could negatively affect the Corporation’s growth, reputation, revenue, expenses, financial condition, and results of operations.

Additionally, the frequency of use of AI tools by individuals increases risks to the Corporation. While the Corporation has incorporated policies and procedures with respect to AI, it is possible that employees fail to comply with such policies and procedures and increase the risk of cyberattacks, unauthorized use or disclosure of personal information, banking credentials or other sensitive or confidential information, financial loss, or other risks discussed herein related to AI tools. The realization of these risks with respect to improper employee use of AI tools could result in the Corporation could negatively affect the Corporation’s growth, reputation, revenue, expenses, financial condition, and results of operations.

The Corporation’s internal operations are subject to risks, including, but not limited to, data processing system failures and errors, improper or inappropriate use of AI tools, customer or employee fraud, and catastrophic failures resulting from terrorist acts or natural disasters. We regularly review and update our internal controls, disclosure controls and procedures, and corporate governance policies and procedures. Any system of controls and any system to reduce risk exposure, however well designed and operated, is based in part on assumptions and can provide only reasonable, not absolute, assurances that the objectives of the system are met. Additionally, instruments, systems, and strategies used to hedge or otherwise manage exposure to various types of market compliance, credit, liquidity, operational, and business risks and enterprise-wide risk could be less effective than anticipated. As a result, the Corporation may not be able to effectively mitigate its risk exposures in particular market environments or against particular types of risk, which could adversely affect the Corporation’s financial condition and results of operations.

The occurrence of a cybersecurity incident involving us, third-party service providers, or our customers, regardless of its origin, could damage our reputation and result in a loss of customers and business and subject us to additional regulatory scrutiny, and could expose us to litigation and possible financial liability. Furthermore, as technology, including the increasing use of artificial intelligence, machine learning, large language models, and other similar technologies, and cyberattacks change over time, we may be required to expend significant additional resources to modify our protective measures or to investigate and remediate vulnerabilities or other exposures arising from operational and security risks. Any of these events could have a material adverse effect on our financial condition and results of operations.

The implementation of artificial intelligence, machine learning, and other large language models and similar technologies may subject the Corporation to increased regulatory risk, reputational risk, and may have material adverse effects on the Corporation’s business, financial condition, and results of operations.

The growth of artificial intelligence, machine learning, and other large language models and similar technologies (collectively referred to as “AI”), has spurned a new industry of technological advances. The Corporation implemented a form of AI with its intelligent digital assistant, Gabby, available through the Bank’s website. Use of AI can expose us to new or increased operation risks, including risks related to our internal controls. As the use of AI expands and grows, it may become subject to additional regulations or restrictions on use from the U.S. government and/or our banking regulators. Additionally, ineffective implementation or failures by any implemented AI could have an adverse effect on our reputation, cause the Corporation to incur additional costs to make the implementation successful, or otherwise result in a loss of expenses incurred if the Corporation decides to terminate the pursuit of a failed AI implementation. Further, many of our competitors have substantially greater resources to invest in technological improvements and may do so in a more cost effective manner. The realization of these risks could result in the Corporation failing to realize any anticipated benefits from the implementation of AI and could negatively affect the Corporation’s growth, reputation, revenue, expenses, and results of operations.