Company: GEF
Filing Date: 2025-11-19
Form Type: 10-KT
Source: 0001628280-25-053146
Chunk: 26

Company: GREIF, INC
Filing Date: 2025-11-19
Form: 10-KT
Chunk 26
---
 or effectiveness through threat actors’ use of artificial intelligence technologies, which are becoming more widely adopted and increasingly sophisticated. Any such threat could compromise our networks and the information stored there could be accessed, publicly disclosed, lost or stolen. Furthermore, use of GenAI systems involves processing large volumes of data, some of which may be sensitive, proprietary, or confidential. If our employees, contractors, or third-party partners use GenAI tools in ways that inadvertently expose confidential information, we may face cybersecurity breaches, loss of trade secrets, or violations of foreign, federal, state and local data protection and privacy laws (such as the European Union’s General Data Protection Regulation or the California Consumer Privacy Act). Such incidents could result in reputational harm, regulatory scrutiny, or financial liability. A security breach of our computer systems or third-party systems with our data could interrupt or damage our operations or harm our reputation, or both. In addition, we could be subject to legal claims or proceedings, liability under laws that protect the privacy of personal information and regulatory penalties if confidential information relating to customers, suppliers, employees or other parties is misappropriated from our computer system or third-party systems with our data. To date, we have seen no material impact on our business or operations from these threats. However, we cannot ensure that our security efforts will prevent unauthorized access or loss of functionality to our or our third-party providers’ systems. For further discussion pertaining to cybersecurity strategy and related roles and responsibilities, see Part I, Item 1C of this Form 10-KT.

The regulatory framework for privacy issues continues to evolve worldwide with increased regulatory and enforcement focus on data protection in the U.S. and abroad, and an actual or alleged failure to comply with applicable U.S. or foreign data protection laws, regulations or other data protection standards in the countries in which we do business may expose us to litigation (including in some instances, class action litigation), fines, sanctions or other penalties, which could harm our business reputation, and could have an adverse effect on our financial condition, results of operations and cash flows. The data privacy landscape is continuously expanding and has significantly increased responsibilities for companies collecting, using and processing personal data, as well as significantly increased penalties for noncompliance of security and data breach obligations, specifically in the EU under the General Data Protection Regulation, in China under the Personal Information Protection Law, and in Brazil under the General Personal Data Protection Law, in addition to U.S. privacy laws in numerous states. Many of these regulations are complex and their interpretation, application and enforcement