Company: BCDRF
Filing Date: 2025-02-28
Form Type: 20-F
Source: 0000891478-25-000054
Chunk: 1015

Company: Banco Santander, S.A.
Filing Date: 2025-02-28
Form: 20-F
Chunk 1015
---
, rules, regulations and standards. While we have taken steps to mitigate the impact of risks and uncertainties in connection with applicable privacy, data protection and cybersecurity laws, regulations, rules and standards by implementing supplementary measures designed in accordance therewith, the efficacy and longevity of any steps we may take to mitigate their impact remain uncertain due to the fast-moving legal and regulatory environment.

Internationally, virtually every jurisdiction in which we operate has established its own privacy, data protection and cybersecurity

| 941 |

| Contents |     | Cross-reference to Form 20-F |     | Consolidated director's report |     | Consolidated financial statements |     | Supplemental information |

legal and regulatory framework with which we must comply. For more information on applicable U.S. privacy, data protection and cybersecurity laws, regulations, rules and standards, see ‘United States supervision and regulation – Privacy, data protection and cybersecurity’. For more information on risks related to compliance with applicable privacy, data protection and cybersecurity laws, regulations, rules and standards, see risk factor ‘2.1.2 We are subject to extensive regulation and regulatory and governmental oversight which could adversely affect our business, operations and financial conditions. – Privacy, data protection and cybersecurity’.

Artificial intelligence

We utilize, and are continuing to explore further uses of, AI in connection with our business, products and services, including AI designed to enhance transaction monitoring and sanctions screening, improve customer experience and reduce operational risk. However, regulation of AI is rapidly evolving worldwide as legislators and regulators are increasingly focused on these powerful emerging technologies. The technologies underlying AI and its uses are subject to a variety of laws and regulations, including intellectual property, privacy, data protection, cybersecurity, consumer protection, competition, and equal opportunity laws, and are expected to be subject to increased regulation and new laws or new applications of existing laws and regulations.

For example, in Europe, the AI Act entered into force on 1 August 2024. The AI Act establishes, among other things, a risk-based governance framework for regulating AI systems operating in the EU market. This framework categorizes AI systems based on the risks associated with such AI systems’ intended purposes as creating “unacceptable”, “high”, “limited” or “minimal” risks. There is a risk that our current or future AI-powered software or applications may be categorized as certain risk categories that may obligate us to comply with the applicable requirements of the AI Act, which may impose additional costs on us, increase our risk of liability, or adversely affect our business. For example, “high