Five Star Bancorp

Information security risks for financial institutions like us have increased recently in part because of new technologies, such as artificial intelligence, the use of the internet, cloud, and telecommunications technologies (including mobile devices) to conduct financial and other business transactions, and the increased sophistication and activities of organized crime, perpetrators of fraud, hackers, terrorists, and others. We also face increased cybersecurity risk as we deploy additional technologies and digital solutions, including our website and digital banking platform with complementary treasury management solutions. Moreover, any cyber-attack or other security breach may persist for an extended period of time without detection. We endeavor to design and implement policies and procedures to identify such cyber-attacks or breaches as quickly as possible; however, we expect that any investigation of a cyber-attack or breach would take substantial amounts of time, and that there may be extensive delays before we obtain full and reliable information. During such time we would not necessarily know the extent of the harm or how best to remediate it, and certain errors or actions could be repeated or compounded before they are discovered and remediated, all of which would further increase the costs and consequences of such an attack or breach. Notwithstanding the strength of defensive measures, cybersecurity threats and the tactics, techniques, and procedures used in cyberattacks change, develop, and evolve rapidly and continuously, including from emerging technologies, such as artificial intelligence, which may be used to enhance the tactics, techniques, and procedures described above and facilitate new cyber threats.

The adoption of artificial intelligence tools by us and our third-party vendors and service providers may increase the risk of errors, omissions, unfair treatment, or fraudulent behavior by our employees, clients, or counterparties, or other third parties.

Similar wording appears in 8 other banks' reports.

Our adoption of artificial intelligence, including generative artificial intelligence, machine learning, and similar tools and technologies that collect, aggregate, analyze, or generate data or other materials or content (collectively, “AI”), for limited internal use has increased our efficiency, and we expect to continue to adopt such tools as appropriate. In addition, we expect our third-party vendors and service providers to increasingly develop and incorporate AI into their product offerings faster than we are able to do so independently. There are significant risks involved in utilizing AI and no assurance can be provided that our or our third-party vendors’ or service providers’ use of AI will enhance our or our third-party vendors’ or service providers’ products or services or produce the intended results. The adoption and incorporation of such tools can lead to concerns around safety and soundness, fair access to financial services, fair treatment of consumers, and compliance with applicable laws and regulations. Such risk can result from models being poorly designed or faulty data being used, inadequate model testing or validation, narrow or limited human oversight, inadequate planning or due diligence, inappropriate or controversial data practices by developers or end-users, and other factors adversely affecting public opinion of AI and the acceptance of AI solutions. Furthermore, given the pace of rapid adoption of such tools by vendors and service providers, we may not be aware of the addition of AI solutions prior to such tools being introduced into our environment. Failure to adequately manage AI risks can result in erroneous results and decisions made by misinformation, unwanted forms of bias, unauthorized access to sensitive, confidential, proprietary or personal information, and violations

Similar wording appears in 6 other banks' reports.

of applicable laws and regulations, leading to operational inefficiencies, competitive harm, reputational harm, ethical challenges, legal liability, losses, fines, and other adverse impacts on our business and financial results. If we do not have sufficient rights to use the data or other material or content on which the AI tools we use rely, or to use the output of such AI tools, we also may incur liability through the violation of applicable laws and regulations, third-party intellectual property, privacy, or other rights or contracts to which we are a party.

Similar wording appears in 6 other banks' reports.

In addition, regulation of AI is rapidly evolving as federal and state legislators and regulators are increasingly focused on these powerful emerging technologies. The technologies underlying AI and its uses are subject to a variety of laws and regulations, including, but not limited to, intellectual property, data privacy and cybersecurity, consumer protection, competition, equal opportunity and fair lending laws, and are expected to be subject to increased regulation and new laws or new applications of existing laws and regulations. AI is the subject of ongoing review by various U.S. governmental and regulatory agencies, and various U.S. states are applying, or are considering applying, existing laws and regulations to AI or are considering general legal frameworks for AI. We may not be able to anticipate how to respond to these rapidly evolving frameworks, and we may need to expend resources to adjust our operations or offerings in certain jurisdictions if the legal frameworks are inconsistent across jurisdictions. Moreover, because AI technology itself is highly complex and rapidly developing, it is not possible to predict all of the legal, operational, or technological risks that may arise relating to the use of AI.