Company: RWT-PA
Filing Date: 2025-03-03
Form Type: 10-K
Source: 0000930236-25-000007
Chunk: 185

Company: REDWOOD TRUST INC
Filing Date: 2025-03-03
Form: 10-K
Item: Item 1A
Chunk 185
---
 unauthorized access and activity has been immaterial to our business and financial results, there can be no assurance that future incidents would also be immaterial. Furthermore, because of frequent changes in, and increasing sophistication of, the techniques and tools used by bad actors to obtain unauthorized access to, or to sabotage, systems or data, or to deceive our or our service providers’ employees to allow unauthorized or fraudulent access or activity, we may be unable to anticipate these techniques, or to implement adequate preventative measures. We may also experience security breaches that may remain undetected for an extended period, including breaches or attacks that are effectively dormant or undetectable until activated against us.

16

In addition to the risks described above, we are subject to certain federal and state laws and regulations (collectively, “Data Privacy Laws”) relating to the collection, retention, use, transfer, and/or protection of various types of ‘personal information’ or ‘personal data’ (or similar term(s), each as defined under applicable law), and which grant data subjects certain rights in, to, and over their personal information. In some cases, Data Privacy Laws apply not only to our interactions with and data transfers to third parties, but may also restrict transfers of personal information between Redwood and its subsidiaries depending on the purpose of the transfer. Legislators in a variety of jurisdictions have passed laws and corresponding regulators have promulgated rules and regulations in this area; some of these jurisdictions are considering imposing additional restrictions, and they and others have laws that are being developed or are pending review and/or decision (including the federal government, which continues to consider enacting additional comprehensive federal privacy laws). In addition, with the recent proliferation of artificial intelligence-enabled products and services, certain state and federal lawmakers and regulators have begun developing, or have developed and promulgated, laws regarding the development and use of artificial intelligence (“AI Laws”). For example, the State of Colorado passed the Colorado AI Act during 2024, which will require developers and deployers of “high-risk” AI systems to abide by statutory requirements, such as developing comprehensive policies and procedures around the use or development of AI systems and managing the risks associated therewith. The Colorado AI Act primarily focuses on the prevention of algorithmic discrimination in connection with certain “consequential decisions,” which include decisions that have a material impact on, e.g., consumer financial or lending services and housing. Most provisions of the Colorado AI Act are expected to come into effect in February 2026. Other jurisdictions have followed Colorado in proposing or enacting their