Company: INGVF
Filing Date: 2025-03-06
Form Type: 20-F
Source: 0001628280-25-010764
Chunk: 25

Company: ING GROEP NV
Filing Date: 2025-03-06
Form: 20-F
Item: Item 3
Chunk 25
---
 EU General Data Protection Regulation (GDPR) and EU Payment Services Directive (PSD2) and the new Digital Operational Resilience Act (DORA) which entered into force in January 2025. Failure to appropriately manage and monitor our IT risk profile could affect our ability to comply with these regulatory requirements, to securely and efficiently serve our clients or to timely, completely or accurately process, store and transmit information, and may adversely impact our reputation, business and results. For further description of the particular risks associated with cybercrime, which is a specific risk to ING as a result of its strategic focus on technology and innovation, see 'We are subject to increasing risks related to cybercrime and compliance with cybersecurity regulation' below.
In addition, as finance industry participants are increasingly incorporating artificial intelligence into their processes and systems, the risk of data and information leaks is correspondingly increasing. Our or our customers’ sensitive, proprietary, or confidential information could be leaked, disclosed, or revealed as a result of or in connection with our or our third-party providers’ use of generative or other artificial intelligence technologies. Any such information that we input into a third-party generative or other artificial intelligence or machine learning platform could be revealed to others, including if information is used to train the third party's artificial intelligence models. Additionally, where an artificial intelligence model ingests 

personal information and makes connections using such data, those technologies may reveal other sensitive, proprietary, or confidential information generated by the model.
Widespread outbreaks of communicable diseases may impact the health of our employees, increasing absenteeism, or may cause a significant increase in the utilisation of health benefits offered to our employees, either or both of which could adversely impact our business. Further, a significant portion of our staff continue to work from home on a full- or part-time basis, which may raise operational risks, including with respect to information security, data protection, availability of key systems and infrastructure integrity. In addition, other events including unforeseeable and/or catastrophic events can lead to an abrupt interruption of activities, and our operations may be subject to losses resulting from such disruptions. Losses can result from destruction or impairment of property, financial assets, trading positions, and the loss of key personnel. If our business continuity plans are not able to be implemented, are not effective or do not sufficiently take such events into account, losses may increase further.
We are subject to increasing risks related to cybercrime and compliance with cybersecurity regulation.
Like other financial institutions and global companies, we are regularly the target