Company: AIZ
Filing Date: 2025-02-20
Form Type: 10-K
Source: 0001267238-25-000008
Chunk: 34

Company: ASSURANT, INC.
Filing Date: 2025-02-20
Form: 10-K
Item: Item 1
Chunk 34
---
. Since the enactment of EU General Data Protection Regulation (“GDPR”), multiple countries where we conduct business have or are in the process of enacting comprehensive data protection laws that largely model GDPR. In the United States, we are subject to a variety of federal and state privacy and data security laws and regulations. At the state level, the NAIC Insurance Data Security Model Law has been enacted in multiple states, imposing an array of detailed security measures, reporting and attestation requirements on insurance companies. The accelerated rate of adoption poses challenges for businesses as implementation and compliance may necessitate modifications to businesses processes, technological infrastructure, security measures and customer-facing websites. 

Cybersecurity risks and incidents remain a focus for regulators. For example, in July 2023, the SEC adopted new rules for public companies requiring disclosure of material cybersecurity incidents and periodic disclosures regarding cybersecurity risk management, strategy and governance. Furthermore, in November 2023, the New York Department of Financial Services (the “NYDFS”) finalized amendments to its cybersecurity rule applicable to financial institutions licensed by the NYDFS.

In addition, we are monitoring increased regulatory activity related to artificial intelligence, including machine learning tools. For example, the NAIC has adopted a model bulletin, The Use of Artificial Intelligence Systems by Insurers, to inform and articulate general expectations on how insurers will govern the development, acquisition and use of certain artificial intelligence technologies.  Approximately 20 states have adopted the bulletin with additional adoption expected in 2025, and several other states, such as Colorado, New York and California have adopted their own AI regulations or guidance specific for the insurance industry. Internationally, on August 1, 2024, the European Union Artificial Intelligence Act, the first comprehensive legal framework for the regulation of artificial intelligence systems across the EU, went into force, with enforcement beginning in 2026.  

Climate-Related Regulation 

We are subject to various federal, state, and international regulations regarding climate risk disclosure. In March 2024, the SEC adopted new rules for disclosing climate-related risks, Scope 1 and Scope 2 GHG emissions, and climate-related financial metrics. However, these rules were stayed in April 2024 due to ongoing federal litigation in the US Court of Appeals for the Eighth Circuit, leaving their implementation uncertain. 

     Furthermore, our European subsidiaries will be required to comply with the European Union’s Corporate Sustainability Directive (“CSRD”), and our U.S. operations may be subject to a series of climate-related disclosures in California. Proposals to delay compliance deadlines failed to pass during