Company: AYR
Filing Date: 2025-04-23
Form Type: 10-K
Source: 0001628280-25-019189
Chunk: 107

Company: Aircastle LTD
Filing Date: 2025-04-23
Form: 10-K
Item: Item 1A
Chunk 107
---
 result in severe criminal or civil penalties, and we may be subject to other liabilities.

The General Data Protection Regulation (“GDPR”) requires us to protect certain personal data of E.U. citizens.  While we have implemented processes and controls to comply with GDPR requirements, the manner in which the E.U. will interpret and enforce certain provisions remains unclear and we could incur significant fines of up to 4% of worldwide revenue, individual damages and reputational risks if the E.U. determines that our controls and processes are ineffective and we have failed to adequately comply with the requirements.

21

We are dependent upon information technology systems, which are subject to disruption, damage, failure and risks associated with implementation and integration.

We are dependent upon information technology systems to manage, process, store and transmit information associated with our operations, which may include proprietary business information and personally identifiable information of our customers, suppliers and employees.  Our information technology systems are subject to disruption, damage or failure from a variety of sources, including malware, ransomware, security breaches, cyber-attacks, cybersecurity incidents, employee error and defects in design.  There may also be an elevated risk of cyber-attacks and cybersecurity incidents by certain countries based on geopolitical tensions and events.  Damage, disruption, or failure of information technology systems may result in interruptions to our operations or may require a significant investment to fix or replace them or may result in significant damage to our reputation.  Although various measures have been implemented to manage our risks related to the information technology systems and network disruptions, our resources and technical sophistication may not be adequate to prevent all types of cyber-attacks and cybersecurity incidents that could lead to the payment of fraudulent claims, loss of sensitive information, including our own proprietary information or that of our customers, suppliers and employees, and could harm our reputation and result in lost revenues and additional costs and potential liabilities.

Risks Related to Our Organization and Structure

We are a holding company with no operations and rely on our operating subsidiaries to provide us with funds necessary to meet our financial obligations.

Aircastle Limited is a holding company with no material direct operations.  Our principal assets are the equity interests we directly or indirectly hold in our operating subsidiaries.  As a result, we are dependent on loans, dividends, distributions and other payments from our subsidiaries to generate the funds necessary to meet our financial obligations, including our debt service obligations.  Although there are currently no material legal restrictions on our operating subsidiaries’ ability to distribute assets to us, legal restrictions, including governmental regulations and contractual obligations, or future