Company: SNY
Filing Date: 2025-02-13
Form Type: 20-F
Source: 0001121404-25-000010
Chunk: 20

Company: Sanofi
Filing Date: 2025-02-13
Form: 20-F
Chunk 20
---
 the following events which pose a risk to the security and availability of these systems and networks, and the confidentiality, integrity, and availability of our sensitive data: breakdown, outages, service disruption or impairment, data loss or deterioration in the event of a system malfunction or increasing threat of data theft or corruption in the event of a cyber-attack, security breach, industrial espionage attacks, insider threat attacks, cybercrimes, including state- sponsored cybercrimes, malware, misplaced or lost data, programming or human errors or other similar events. Also, in the event of an attack, US and European legislation related to the financing of terrorism imposes increasing restrictions on payments of ransom. As a result, our ability to recover the data might be limited. Therefore, our business continuity could be at risk if we are unable to recover data through back-ups and restorations. In addition, in the EU, a number of existing and forthcoming rules and laws – including NIS2, the European Health Data Space (EHDS), the Data Act, the Cyber Resilience Act and the AI Act – are changing privacy and cybersecurity compliance requirements, and creating new potential enforcement risks. We are increasingly using generative artificial intelligence (AI) to enhance our business processes. Although we have set up a governance body to control the AI initiatives taken on a company-wide scale and have made a generative AI charter available to all our employees, this new technology, like other AI technology, entails risks linked to transparency, fairness, data privacy and confidentiality, eco-responsibility, and cybersecurity. These risks could result in unintended consequences such as unethical practices, business and reputational harm, cyber-attacks, and security breaches (see “— We may fail to develop or take advantage of digitalization and prioritizing data as an organizational asset” below). There is a global trend towards more comprehensive regulation of AI that may require us to modify existing or adopt new compliance procedures or developments. Each of these events could negatively impact important processes, such as scientific research and clinical studies, the submission of outcomes to health authorities for marketing authorizations, the functioning of production processes and the supply chain, compliance with legal requirements, trade secrets, security strategies and other key activities, including Sanofi’s employees’ ability to communicate between themselves as well as with third parties (see also “— Product liability claims could adversely affect our business, results of operations and financial condition” above). This could result in material financial, legal, competitive, operational, business, or reputational harm. Although we maintain relevant insurance coverage