Princeton Bancorp, Inc.

AI Artificial Intelligence

We use AI in connection with our business and operations, which exposes us to inherent risks that may expose us to material harm.

AI in the banking industry refers to the use of advanced algorithms, machine learning, and automation to enhance operational efficiency, improve customer experiences, strengthen security, and optimize financial decision-making. Banks leverage AI for fraud detection, risk assessment, predictive analytics, chatbots for customer service, personalized financial recommendations, and automated regulatory compliance. By analyzing vast amounts of data in real time, AI helps institutions reduce costs, mitigate risks, detect anomalies, and deliver more efficient and secure banking services.

The Bank does not utilize AI for decision-making processes as any automation within the Bank is driven by macros and predefined rule-based workflows rather than AI-driven models. AI technology, however, is employed within select third-party solutions integrated into our operations. These include Sophos for advanced cybersecurity threat detection and response, Verafin for fraud detection and AML compliance, the Glia Chatbot for enhancing customer service interactions, and CATO Networks for AI-driven network security and optimization. These third-party tools that utilize a limited AI model support security, risk management, and operational efficiency but do not influence credit, lending, or other decision-making functions within the Bank. We do not believe that these products pose a material risk on the Company’s business or financial results.

AI is complex and rapidly evolving, and the introduction of AI, a relatively new and emerging technology in the early stages of commercial use, into our business and operations may subject us to new or heightened legal, regulatory, ethical, operational, reputational, or other risks. The models underlying AI may be incorrectly or inadequately designed or implemented and trained on, or otherwise use, data or algorithms that are, and output that may be, incomplete, inadequate, misleading, biased, poor-quality or otherwise flawed, any of which may not be easily detectable. Further, inappropriate or controversial data practices by developers and end-users or other factors adversely affecting public opinion of AI could impair the acceptance of AI, including those incorporated in our business and operations. If the AI that we use is deficient, inaccurate or controversial, we could incur operational inefficiencies, competitive harm, legal and regulatory action, brand or reputational harm, or other adverse impacts on our business and financial results. Further, there can be no assurance that our use of AI will be successful in enhancing our business or operations or otherwise result in our intended outcomes, and our competitors may incorporate AI into their businesses or operations more quickly or more successfully than us.

AI and the use thereof is also subject to a variety of existing laws and regulations, including fair lending, consumer protection, intellectual property, cybersecurity, data privacy, and equal opportunity, and is expected to be subject to new laws and regulations or new applications of existing laws and regulations. AI is the subject of evolving review by various governmental and regulatory agencies, and changes in laws and regulations governing AI may adversely affect our ability to use AI. Additionally, various federal, state and foreign governments and regulators have implemented, or are considering implementing, general legal and regulatory frameworks for the appropriate use of AI. It is possible that we will not be able to anticipate how to respond to these rapidly developing laws and regulations. Further, if we do not have sufficient rights to use the data or algorithms on which our AI solutions rely or the output generated thereby, we also may incur liability through the violation of applicable laws and regulations, such as fair lending laws and regulations, third-party intellectual property, privacy or other rights, or contracts to which we are a party. We may not be able to sufficiently mitigate or detect any of the foregoing risks or concerns given our and other market participants’ lack of experience with using AI, the pace of technological change, and rapid adoption of AI by our business partners and competitors. Any actual or perceived failure to address risks or concerns relating to the use of AI, whether unfounded or not, could adversely affect our business and operations.

Cybersecurity risks for banking organizations have significantly increased in recent years in part because of the proliferation of new technologies, including AI, and the use of the internet and telecommunications technologies to conduct financial transactions. For example, cybersecurity risks may increase in the future as we continue to increase our mobile-payment and other internet-based product offerings and expand our internal usage of web-based products and applications. In addition, cybersecurity risks have significantly increased in recent years in part due to the increased sophistication and activities of cyber threat actors, such as organized crime affiliates, terrorist organizations, state-sponsored actors, hostile foreign governments, disgruntled employees or vendors, activists, and other external parties, including those involved in corporate espionage, any of whom may enhance their efforts through the use of AI. Even the most advanced internal control environment may be vulnerable to compromise. Due to increasing geopolitical tensions, nation state cyber-attacks and ransomware are both increasing in sophistication and prevalence. Targeted social engineering and email attacks (i.e., “spear phishing” attacks) are becoming more sophisticated and are extremely difficult to prevent. In such an attack, an attacker will attempt to fraudulently induce colleagues, contractors, customers, clients, or other users of our systems and infrastructure to disclose sensitive information in order to gain access to our, our customers’, or our clients’ systems and infrastructure, or the confidential, proprietary, personal, or other information stored or processed thereon. Persistent attackers may succeed in penetrating defenses given enough resources, time, and motive. The techniques used by cyber threat actors change frequently, may not be recognized until launched, and may not be recognized until well after a cyber-attack or other information or security breach has occurred. The speed at which new vulnerabilities are discovered and exploited, often before security patches are published, continues to rise. Remote work further increases the risk that we may experience cyber-attack or other information or security breaches as a result of our employees, colleagues, contractors, and other third parties with which we do business or upon which we rely working remotely on less secure systems and environments.

AI Artificial Intelligence

We use AI in connection with our business and operations, which exposes us to inherent risks that may expose us to material harm.

AI in the banking industry refers to the use of advanced algorithms, machine learning, and automation to enhance operational efficiency, improve customer experiences, strengthen security, and optimize financial decision-making. Banks leverage AI for fraud detection, risk assessment, predictive analytics, chatbots for customer service, personalized financial recommendations, and automated regulatory compliance. By analyzing vast amounts of data in real time, AI helps institutions reduce costs, mitigate risks, detect anomalies, and deliver more efficient and secure banking services.

The Bank does not utilize AI for decision-making processes or internal bot usage as any automation within the Bank is driven by macros and predefined rule-based workflows rather than AI-driven models. AI technology, however, is employed within select third-party solutions integrated into our operations. These include SentinelOne for advanced cybersecurity threat detection and response, Verafin for fraud detection and AML compliance, the Glia Chatbot for enhancing customer service interactions, and CATO Networks for AI-driven network security and optimization. These third-party tools that utilize a limited AI model support security, risk management, and operational efficiency but do not influence credit, lending, or other decision-making functions within the Bank. We do not believe that these products pose a material risk on the company’s business or financial results.

AI is complex and rapidly evolving, and the introduction of AI, a relatively new and emerging technology in the early stages of commercial use, into our business and operations may subject us to new or heightened legal, regulatory, ethical, operational, reputational, or other risks. The models underlying AI may be incorrectly or inadequately designed or implemented and trained on, or otherwise use, data or algorithms that are, and output that may be, incomplete, inadequate, misleading, biased, poor-quality or otherwise flawed, any of which may not be easily detectable. Further, inappropriate or controversial data practices by developers and end-users or other factors adversely affecting public opinion of AI could impair the acceptance of AI, including those incorporated

in our business and operations. If the AI that we use is deficient, inaccurate or controversial, we could incur operational inefficiencies, competitive harm, legal and regulatory action, brand or reputational harm, or other adverse impacts on our business and financial results. Further, there can be no assurance that our use of AI will be successful in enhancing our business or operations or otherwise result in our intended outcomes, and our competitors may incorporate AI into their businesses or operations more quickly or more successfully than us.

AI and the use thereof is also subject to a variety of existing laws and regulations, including fair lending, consumer protection, intellectual property, cybersecurity, data privacy, and equal opportunity, and is expected to be subject to new laws and regulations or new applications of existing laws and regulations. AI is the subject of evolving review by various governmental and regulatory agencies, and changes in laws and regulations governing AI may adversely affect our ability to use AI. Additionally, various federal, state and foreign governments and regulators have implemented, or are considering implementing, general legal and regulatory frameworks for the appropriate use of AI. It is possible that we will not be able to anticipate how to respond to these rapidly developing laws and regulations. Further, if we do not have sufficient rights to use the data or algorithms on which our AI solutions rely or the output generated thereby, we also may incur liability through the violation of applicable laws and regulations, such as fair lending laws and regulations, third-party intellectual property, privacy or other rights, or contracts to which we are a party. We may not be able to sufficiently mitigate or detect any of the foregoing risks or concerns given our and other market participants’ lack of experience with using AI, the pace of technological change, and rapid adoption of AI by our business partners and competitors. Any actual or perceived failure to address risks or concerns relating to the use of AI, whether unfounded or not, could adversely affect our business and operations.

Cybersecurity risks for banking organizations have significantly increased in recent years in part because of the proliferation of new technologies, including AI, and the use of the internet and telecommunications technologies to conduct financial transactions. For example, cybersecurity risks may increase in the future as we continue to increase our mobile-payment and other internet-based product offerings and expand our internal usage of web-based products and applications. In addition, cybersecurity risks have significantly increased in recent years in part due to the increased sophistication and activities of cyber threat actors, such as organized crime affiliates, terrorist organizations, state-sponsored actors, hostile foreign governments, disgruntled employees or vendors, activists, and other external parties, including those involved in corporate espionage, any of whom may enhance their efforts through the use of AI. Even the most advanced internal control environment may be vulnerable to compromise. Due to increasing geopolitical tensions, nation state cyber-attacks and ransomware are both increasing in sophistication and prevalence. Targeted social engineering and email attacks (i.e., “spear phishing” attacks) are becoming more sophisticated and are extremely difficult to prevent. In such an attack, an attacker will attempt to fraudulently induce colleagues, contractors, customers, clients, or other users of our systems and infrastructure to disclose sensitive information in order to gain access to our, our customers’, or our clients’ systems and infrastructure, or the confidential, proprietary, personal, or other information stored or processed thereon. Persistent attackers may succeed in penetrating defenses given enough resources, time, and motive. The techniques used by cyber threat actors change frequently, may not be recognized until launched, and may not be recognized until well after a cyber-attack or other information or security breach has occurred. The speed at which new vulnerabilities are discovered and exploited, often before security patches are published, continues to rise. Remote work further increases the risk that we may experience cyber-attack or other information or security breaches as a result of our employees, colleagues, contractors, and other third parties with which we do business or upon which we rely working remotely on less secure systems and environments.