Pinnacle Financial Partners, Inc.

•The increasing use of artificial intelligence and complex models introduces operational, legal, regulatory, reputational, and data integrity risks, including risks related to accuracy, bias, explainability, and compliance.

In the current competitive banking environment, overall revenue growth must outpace operating costs, which requires the successful execution of both growth and efficiency initiatives. In addition, we must continue to implement strategies to grow our product and service offerings and keep pace with changing technologies and client expectations in order to realize continued earnings growth and to remain competitive with the other banks and non-bank financial services providers in the markets we serve. We are continuously implementing strategic initiatives to achieve growth, reduce expense, and unlock efficiencies. Our current initiatives include, but are not limited to, growing our middle market commercial banking, specialty lending, and corporate and investment banking divisions, implementing a more unified approach to wealth management, expanding our treasury and payment solutions, capital markets offerings, and third-party payments, and investing in the bank of the future through automation, artificial intelligence, digital applications, and analytics. While we have realized growth and efficiency gains as a result of current and past initiatives, there is no guarantee that these initiatives will be successful in supporting growth or achieving the expected level of future savings and revenue enhancements that we anticipate. Additionally, any new service and product offerings could compete directly with other Pinnacle Bank product and service offerings. Consequently, any realized revenue from such growth initiatives may correspond to decreased revenue from other Pinnacle Bank product and service offerings.

The financial services market, including banking services, is continuing to undergo rapid changes with frequent introductions of new technology-driven products and services, primarily related to increased digitization of banking services and capabilities (including those related to or involving artificial intelligence, machine learning, blockchain, and other technologies) and increased demand for mobile banking solutions. Our future success will depend, in part, on our ability to keep pace with these technological changes and to use technology to satisfy and grow client demand for our products and services and to create additional efficiencies in our operations. Our substantial investments in digital banking solutions, technology, and information systems will increase our dependency on third-party service providers, and such investments may underperform expectations and could result in unexpected losses. Some of our competitors have substantially greater resources to invest in technological improvements and have invested more heavily than us, and will continue to be able to do so, in developing and adopting new technologies, which may put us at a competitive disadvantage. Some of these competitors consist of financial technology providers who are beginning to offer more traditional banking products and may either acquire a bank charter or obtain a bank-like charter, such as the Fintech charter provided by the OCC. We may not be able to effectively implement new technology-driven products and services, be successful in marketing these products and services to our clients, or keep pace with our competitors in this arena. As a result, our ability to effectively compete to retain or acquire new business may be impaired, and our business, financial condition, or results of operations may be adversely affected.

Fraud continues to be a significant risk for us and for all banks. Card fraud and deposit fraud (check kiting, wire fraud, etc.) continue to be significant sources of fraud attempts and losses in our consumer banking business. Moreover, our commercial clients have experienced increased levels of financial fraud risk as well, often requiring our involvement and assistance because of our banking relationship with these clients. The methods used to perpetrate and combat fraud continue to evolve as technology changes and more tools for access to financial services emerge, such as real-time payments. In addition to cybersecurity risks, new techniques have made it easier for bad actors to obtain and use client personal information, mimic signatures, and otherwise create false documents that look genuine. Fraud schemes are broad and can include debit card/credit card fraud, check fraud, NSF fraud, mechanical devices attached to ATM machines, social engineering and phishing attacks to obtain personal information, impersonation of our clients through the use of falsified or stolen credentials, employee fraud, information fraud, and other malfeasance. Criminals are turning to new sources, including AI, to steal personally identifiable information in order to impersonate our clients to commit fraud.

The development and use of artificial intelligence presents risks and challenges that may adversely impact our business.

We or our third-party (or fourth-party) vendors, clients or counterparties may develop or incorporate AI technology in certain business processes, services, or products. The development and use of AI presents a number of risks and challenges to our business. The legal and regulatory environment relating to AI is uncertain and rapidly evolving, both in the U.S. and internationally, and includes regulatory schemes targeted specifically at AI as well as provisions in intellectual property, privacy, consumer protection, employment, and other laws applicable to the use of AI. These evolving laws and regulations could require changes in our implementation of AI technology and increase our compliance costs and the risk of non-compliance. AI models, particularly generative AI models, may produce output or take action that is incorrect, that reflects biases included in the data on which they are trained, that results in the release of private, confidential, or proprietary information, that infringes on the intellectual property rights of others, or that is otherwise harmful. In addition, the complexity of many AI models makes it difficult to understand why they are generating particular outputs. This limited transparency increases the challenges associated with assessing the proper operation of AI models, understanding and monitoring the capabilities of the AI models, reducing erroneous output, eliminating bias, and complying with regulations that require documentation or explanation of the basis on which decisions are made. Further, we may rely on AI models developed by third parties, and, to that extent, would be dependent in part on the manner in which those third parties develop and train their models, including risks arising from the inclusion of any unauthorized material in the training data for their models and the effectiveness of the steps these third parties have taken to limit the risks associated with the output of their models, matters over which we may have limited visibility. Any of these risks could expose us to liability or adverse legal or regulatory consequences and harm our reputation and the public perception of our business or the effectiveness of our security measures.

Third parties provide key components of our business operations such as our core technology infrastructure, cloud-based operations, data processing, recording and monitoring transactions, online banking interfaces and services, internet connections, and network access. We have selected these third-party vendors carefully and have conducted the due diligence consistent with regulatory guidance and best practices. While we have ongoing programs to review third-party vendors and assess risk, we do not control their actions. Any problems caused by these third parties, including those resulting from disruptions in communication services provided by a vendor, issues at a third-party vendor of a vendor, failure of a vendor to handle current or higher volumes, cyberattacks and security breaches at a vendor, failure of a vendor to provide services for any reason, or poor performance of services, could adversely affect our ability to deliver products and services to our clients and otherwise conduct our business. Financial or operational difficulties of a third-party vendor could also hurt our operations if those difficulties interfere with the vendor's ability to serve us. Furthermore, our vendors could also be sources of operational and information security risk to us, including from breakdowns or failures of their own systems or capacity constraints. Replacing these third-party vendors could also create significant delay and expense. Accordingly, use of such third parties creates an unavoidable inherent risk to our business operations. Our digital services growth initiatives, core technology upgrades, development and use of artificial intelligence, and digital asset initiatives constitute specific increases in third-party risk as such initiatives are distinctly dependent on the performance of our third-party partners.

We are operating in an uncertain economic environment. Global trade tensions, AI impacts, and inflation risks continue to affect the global economic environment. The 2025 government shutdown has negatively impacted U.S. economic growth, and

Cybersecurity risks for banking organizations have significantly increased in recent years in part because of the proliferation of new technologies, and the use of the internet and telecommunications technologies to conduct financial transactions. For example, cybersecurity risks may increase in the future as we continue to increase our mobile-payment and other internet-based product offerings and expand our internal use of web-based and cloud-based products and applications. Even the most advanced internal control environment may be vulnerable to compromise. Targeted social engineering attacks are becoming more prevalent and sophisticated and are extremely difficult to prevent. The rapid evolution and increased adoption of generative artificial intelligence is further increasing risks in this area, including by making fraud detection more difficult, particularly with detection devices that use voice recognition or authentication. The techniques used by bad actors change frequently, may not be recognized until launched and may not be recognized until well after a breach has occurred. Additionally, the existence of cyberattacks or security breaches at third parties with access to our data, such as vendors, may not be disclosed to us in a timely manner. Consistent with industry trends, we remain at risk for attempted electronic fraudulent activity, as well as attempts at security breaches and cybersecurity-related incidents. Cloud technologies are also critical to the operation of our systems, and our reliance on cloud technologies is growing. Service disruptions in cloud technologies or intrusion into those of our systems hosted on cloud-based technologies may lead to unauthorized access of, delays in accessing, or the loss of, data that is important to our businesses and may hinder our clients’ access to our products and services, which would negatively impact our operations which in turn could have a material adverse effect on our financial condition, results of operations and liquidity.

Our current or future use of artificial intelligence or machine learning tools in our business operations could expose us to new or additional costs and risks, including the potential introduction of new vulnerabilities or cybersecurity risks within our information technology systems and the potential inadvertent or unauthorized release of confidentiality or personal information resulting from the use (whether or not authorized) of artificial intelligence or machine learning tools by our employees, contractors, agents, representatives or affiliates. In addition, the artificial intelligence tools we may incorporate into certain aspects of our operations may not generate the intended efficiencies and may impact our business results.