Company: AHL
Filing Date: 2025-03-19
Form Type: 20-F
Source: 0001267395-25-000019
Chunk: 129

Company: ASPEN INSURANCE HOLDINGS LTD
Filing Date: 2025-03-19
Form: 20-F
Item: Item 4
Chunk 129
---
 data transfers continue to develop, we could suffer additional costs, complaints and/or regulatory investigations or fines; we may have to stop using certain tools and vendors and make other operational changes; we may have to implement revised standard contractual clauses for existing intragroup, customer and vendor arrangements within required time frames; and/or it could otherwise affect the manner in which we provide our services, and could adversely affect our business, operations and financial condition.

On January 17, 2025, the E. U. Digital Operational Resilience Act (“ DORA”) entered into effect. DORA applies to “financial entities” including: (i) insurance and reinsurance undertakings, and insurance intermediaries, reinsurance intermediaries and ancillary insurance intermediaries and (ii) ICT third-party service providers to financial entities. DORA imposes regulatory obligations to reinforce the digital operational resilience of entities operating in the financial services industry, and to adequately manage and remediate risks related to the engagement of ICT third-party service providers. In addition to financial entities, DORA only imposes direct regulatory obligations on ICT third-party service providers that are considered “critical” within the meaning of DORA. Non-critical ICT third-party service providers are only indirectly impacted by DORA, by virtue of the mandatory contractual terms that DORA requires financial entities to implement with ICT third-party service providers.

DORA does not provide for minimum or maximum monetary sanctions but empowers E. U. Member State competent authorities to enforce DORA and determine the appropriate sanction on the basis of the factors set out in DORA, including the gravity and duration of the infringement. Sanctions may be administrative or criminal in nature, and DORA also provides that individual members of the management body can be held personally liable for any non-compliance.

E. U. / U. K. AI Laws and Regulations. The EU has developed a standalone law to govern the offering and use of AI systems in the EU (the “ AI Act”) which entered into force on August 1, 2024. The AI Act will apply in phases depending on the regulatory requirement in question from February 2025 to August 2027, when all provisions of the AI Act will apply. The AI Act imposes regulatory requirements onto AI system providers, importers, distributors, and deployers, in accordance with the level of risk involved with the AI system (“unacceptable”, “high”, “limited”, and “minimal” risk). General-purpose AI systems have also been made subject to a number of requirements - mostly akin to the