Company: CFG-PE
Filing Date: 2025-03-10
Form Type: DEF 14A
Source: 0000759944-25-000044
Chunk: 32

Company: CITIZENS FINANCIAL GROUP INC/RI
Filing Date: 2025-03-10
Form: DEF 14A
Chunk 32
---
. In addition, our customers use personal computers, smartphones, tablets, and other mobile devices to access our products and services. As such, we are subject to a variety of cybersecurity risks.

| Cybersecurity Program                                                                                                                                                                                                                                                                                                  
 •We manage our cybersecurity risk through a comprehensive Cybersecurity Program (the "Program") under the guidance of ourChief Security Officer.                                                                                                                                                                       
 •The Program incorporates all of our security policies and covers the core elements of access control, infrastructure security, cybersecurity event and incident management, data protection, third-party vendor cyber risk oversight, and training and awareness.                                                     
 •TheAudit Committeeoversees the Program under its risk oversight responsibilities as it relates to financial controls and together withthe Board, receives regular cybersecurity updates.                                                                                                                              
 •TheRisk Committeeoversees the management of cybersecurity risk consistent with the ERMGF.  It receives an annual cybersecurity briefing from the Chief Security Officer, including an overall assessment of the effectiveness of the Program and an outlook for the upcoming year, and approves the Program annually. 
 •The Board participates inannual cybersecurity trainingto ensure it maintains the appropriate knowledge for providing effective oversight, with any additional training provided as requested.                                                                                                                         |

#### Artificial Intelligence Oversight
We have a long-standing commitment to developing and maintaining a strong enterprise-wide corporate governance and risk framework which goes beyond compliance to create and encourage an ethical culture that promotes the long-term interests of customers, colleagues, communities, and shareholders. It is through that lens that we pursue the responsible and ethical use of artificial intelligence ("AI") with the programs, policies and procedures that make up our ERMGF seeking to ensure all AI-related risks are effectively identified, assessed, and managed.

In its oversight role, the Board is focused on ensuring that a measured approach to AI is applied within a foundational governance structure that provides appropriate guardrails. The Board participates in educational sessions on AI provided by external and industry experts, and receives regular updates on the Company’s use of AI through strategic business presentations and risk reporting. In addition, each Committee considers AI as it relates to the matters under its purview. For example, the Risk Committee oversees management of AI-related risk under the ERMGF, and the Compensation and HR Committee considers how the latest technology trends impact the modern workforce.

#### Sustainability Oversight
Our environmental, social, governance and sustainability activities are overseen by the Board. The Nominating and Corporate Governance Committee has primary responsibility for oversight of this work, including our overall Sustainability & Impact strategy and reporting. In addition, each Board committee addresses