First National Corp

We rely on the secure processing, storage, and transmission of confidential and other information in our and our vendors' computer systems and networks. While we have policies and procedures designed to prevent or limit the effect of a possible security breach, our computer systems, software, and networks, including those of our vendors, may be vulnerable to unauthorized access, computer viruses, or other malicious code, and other events that could have a security impact. To date, the Company has not experienced a significant compromise, significant data loss or any material financial losses related to cybersecurity attacks, but the Company’s systems and those of its customers and third-party service providers are under constant threat and it is possible that the Company could experience a significant event in the future. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of internet banking, mobile banking and other technology-based products and services by the Company and its customers. The continued evolution and increased usage of artificial intelligence technologies may further increase these risks. If one or more such events occur, this potentially could jeopardize our customers’ confidential and other information processed and stored in, and transmitted through, our computer systems and networks or those of our vendors, or otherwise cause interruptions or malfunctions in our or our customers’ operations or result in the loss of money. We may be required to expend significant additional resources to modify our protective measures or to investigate and remediate vulnerabilities or other exposures, and we may be subject to litigation and financial losses that are either not insured against or not fully covered through any insurance maintained by us.

Further, the Company may utilize new technology, such as AI, in connection with its business and operations. AI may be developed internally, or may be provided by third- or fourth-party service providers. Any such new technology could have a significant impact on the effectiveness of the Company's system of internal controls. Failure to successfully manage these risks in the development and implementation of new lines of business, products or services and/or technologies could have a material adverse effect on the Company's business, financial condition and results of operations. AI may introduce the Company to novel or intensified legal, regulatory, ethical, operational, reputational or other risks. AI usage is subject to a range of existing laws and regulations. AI is also expected to be governed by new laws and regulations, or new applications of existing laws and regulations. AI is under ongoing scrutiny by various governmental and regulatory bodies, with federal, state and international authorities either implementing or considering legal frameworks that could impact the Company's ability to leverage AI effectively. The Company may find it challenging to predict and adapt to these rapidly evolving legal requirements. AI models employed by the Company or its service providers might be flawed due to improper design, implementation, or training or outputs based on data or algorithms that are incomplete, inadequate, misleading, biased or of poor quality. These flaws may not be easily identifiable. Additionally, there is no certainty that the Company's use of AI will successfully enhance its business operations or achieve its intended outcomes, and its competitors may adopt AI more swiftly or effectively than the Company does.