Company: BCS
Filing Date: 2025-02-13
Form Type: 20-F
Source: 0000312069-25-000114
Chunk: 496

Company: BARCLAYS PLC
Filing Date: 2025-02-13
Form: 20-F
Chunk 496
---
 management strategy and whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the issuer, its business strategy, results of operations or financial condition. In addition, Barclays PLC and Barclays Bank PLC must annually describe Barclays’ board of directors’ oversight of risks from cybersecurity threats, the board committee responsible for the oversight of such risks, and the processes by which the board or such committee is informed of these risks; and details of management’s expertise and role in assessing and managing material risks from cybersecurity threats. If Barclays PLC or Barclays Bank PLC are required or determine to disclose material cybersecurity incidents under home country or stock exchange rules, they are required to also furnish this information with the SEC on the SEC's website, in accordance with their obligations as foreign private issuers. In late 2023, NYDFS amended its cybersecurity regulation applying to the New York Branch of Barclays Bank PLC, with various implementation deadlines through November 2025. The NYDFS's amended cybersecurity regulation contains significant updates, including enhanced notification requirements, cybersecurity governance obligations, and requirements applicable to cybersecurity policies and procedures (e.g., encryption and multi-factor authentication, business continuity and incident response plans, and vulnerability management). The existing and anticipated requirements specified in the UK, EU, and US for increased controls will serve to improve industry standardisation and resilience capabilities, enhancing Barclays' ability to deliver services during periods of potential disruption. Such measures are resulting in increased technology and compliance costs for the Group. Artificial intelligence A number of jurisdictions where the Barclays Group operates have adopted or are considering adopting laws regulating artificial intelligence (AI). The EU’s Artificial Intelligence Act (EU AI Act), which entered into force on 1 August 2024, provides rights and duties designed to ensure the safe and ethical deployment of AI. The EU AI Act requires organisations to ensure suitable levels of AI literacy within their workforce and categorises AI systems based on their level of risk. It has a phased approach to compliance, with the first set of requirements prohibiting certain uses of AI applying from 2 February 2025. It also establishes a rigorous compliance regime for high-risk AI applications (which provisions apply from 2 August 2027). The extraterritorial effect of the of EU AI Act means entities established outside the EU fall with the EU AI Act’s ambit if they provide or deploy AI in the EU or the output of their AI is used in the EU. Similarly, several U.S. states are considering enacting or have already enacted regulations concerning the use