Company: CNDT
Filing Date: 2025-02-19
Form Type: 10-K
Source: 0001677703-25-000029
Chunk: 28

Company: CONDUENT Inc
Filing Date: 2025-02-19
Form: 10-K
Item: Item 1A
Chunk 28
---
 potential for new regulations. Several jurisdictions where we operate are considering or have proposed or enacted legislation and policies regulating AI and non-personal data, 

CNDT 2024 Annual Report19

such as the European Union’s AI Act and the U.S.’s Executive Order on AI, and the recent elections may influence the regulatory landscape in the United States. New or expanded AI laws could raise compliance costs and pose unpredictable risks, which could materially adversely affect our results of operations and financial condition.

Legal, Compliance and Data Security Risks

We are subject to laws of the United States and foreign jurisdictions relating to individually identifiable information and personal health information, and failure to comply with those laws, whether or not inadvertent, could subject us to legal actions and negatively impact our operations.

We receive, process, transmit and store information relating to identifiable individuals, both in our role as a service provider and as an employer. As a result, we are subject to numerous laws and regulations in the United States (both federal and state) and foreign laws and regulations designed to protect both individually identifiable information and personal health information, including the Health Insurance Portability and Accountability Act of 1996, as amended ("HIPAA"), and the regulations promulgated under HIPPA governing, among other things, the privacy, security and electronic transmission of individually identifiable health information, and the European Union General Data Protection Regulation ("GDPR"), which imposes stringent data protection requirements and significant penalties for non-compliance and has had a significant impact on how we process and handle certain data. 

Additional laws of the United States and foreign jurisdictions apply to our processing of individually identifiable information. These laws have been subject to frequent changes, and new legislation in this area may be enacted at any time. For example, the GDPR and the invalidation of the U.S.-EU Safe Harbor regime have required us to implement alternative mechanisms for some of our data flows from Europe to the United States to comply with applicable law. Changes to existing laws, the introduction of new laws in this area or our failure to comply with existing laws that are applicable to us may subject us to, among other things, additional costs or changes to our business practices, liability for monetary damages, fines and/or criminal prosecution, unfavorable publicity, restrictions on our ability to obtain and process information and allegations by our customers and clients that we have not performed our contractual obligations, any of which could materially adversely affect our results of operations and financial condition.

We are subject to laws of the United States and foreign jurisdictions relating to processing certain financial transactions, including