1 

EU-US INSURANCE DIALOGUE PROJECT

INNOVATION AND TECHNOLOGY WORKSTREAM

June 2023 Summary Report

I. Introduction and Background

The EU-US Insurance Dialogue Project’s Innovation and Technology Workstream was created 

to further explore topics relating to big data and artificial intelligence/machine learning 

(AI/ML) including the appropriate regulatory framework for monitoring an insurance 

company’s governance of complex models using big data and AI/ML and the impact of these 

practices on historically underrepresented groups. Further, the workstream shared experiences 

relating to the use of supervisory technology (Suptech) as a regulatory tool for both prudential 

and market conduct supervision. Lastly, brief high-level updates were exchanged to flag other 

key technology and innovation developments in the US and EU markets as relevant (including 

cybersecurity developments). 

II. Summary of Discussed Topics

A. Big Data/AI/ML 

1. Regulatory and supervisory developments 

Supervisors in the US and EU recognize big data and AI/ML is shaping the insurance 

marketplace of today and the future with data-driven business models seen throughout all the 

stages of the insurance value chain. In the discussions at the workstream, it was clear that while

the use of complex algorithms and AI/ML can provide new opportunities for businesses and 

consumers across the insurance sector in the US and EU, it also raises new challenges such as 

consumer privacy and the need to protect against both intended and unintended unfair 

discrimination that may result from the use of algorithms. Supervisors in the US and EU are 

working to enable stakeholders to harness the benefits of AI innovation, but also working to 

ensure that adequate governance and risk management frameworks are in place enabling the 

use of trustworthy AI systems. The discussions within the workstream illustrated common 

challenges and opportunities and how these are being addressed from a regulatory perspective 

in both the US and EU. 

In the EU, in April 2021, the European Commission presented its legislative proposal for 

harmonized rules on AI (commonly referred as the AI Act)1

 and the potential implications for 

the insurance sector; the proposal, which is under legislative review, aims to introduce new 

governance and risk management rules for the use of AI in different sectors of the EU economy, 

including insurance. The legislative proposal follows a risk-based approach, establishing 

different requirements depending on the likelihood and potential harm of different use cases. 

1 European Commission, Proposal for a Regulation of the European Parliament and of the Council Laying 

Down Harmonised Rules on Artificial Intelligence (Artificial Intelligence Act) and Amending Certain Union 

Legislative Acts (21 April 2021), https://eur-lex.europa.eu/legalcontent/EN/TXT/?uri=celex%3A52021PC0206.
2 

The AI Act also foresees the establishment of dedicated AI sandboxes where stakeholders 

would be able to test innovative AI solutions in a controlled environment. 

In 2022, EIOPA was monitoring the legislative process of the AI Act. More particularly, 

EIOPA shared its views on the AI Act with the European co-legislators,2 where it welcomed 

the objectives of the legislative proposal but considered that the use of AI in insurance would 

be better regulated at the sectorial level due to sectorial specificities. 

Moreover, in the context of the recently created Digital Finance Academy,3 EIOPA has also 

developed trainings for supervisors on digitalisation matters including AI and discussed with 

stakeholders AI governance and risk management measures.4

Further, the Report from EIOPA’s Consultative Expert Group on Digital Ethics in Insurance5

had developed six AI governance principles to promote ethical and trustworthy use of AI in

the European insurance sector. The governance principles are largely in line with the

governance and risk management requirements of the AI Act, as well as with the ones 

developed by other organisations such as the OECD and the NAIC.

6

 The report also includes

non-binding guidance on how to apply the governance principles on concrete AI use cases in 

insurance. 

In early 2023, EIOPA launched a digitalisation market monitoring survey,

7 which, among other 

things, will gather further evidence on the use of AI in the European insurance sector. EIOPA 

will use the evidence gathered from this survey to develop further supervisory and regulatory 

tools. 

From a national perspective, some EU Member States also have national initiatives relative to 

AI/ML. For example, in July 2021, BaFin and the Deutsche Bundesbank published a 

consultation paper entitled “Machine learning in risk models – Characteristics and 

supervisory priorities.”8

In the US, the NAIC discussed its ongoing work on assessing the industry’s use of big data 

and AI/ML, what governance and risk management controls are in place to manage those 

2 EIOPA, Letters to co-legislators on the Artificial Intelligence Act (5 July 2022), 

https://www.eiopa.europa.eu/publications/letter-co-legislators-artificial-intelligence-act_en. 

3 European Commission, EU Supervisory Digital Finance Academy, https://reform-support.ec.europa.eu/whatwe-do/financial-sector-and-access-finance/eu-supervisory-digital-finance-academy_en. 

4 EIOPA, Artificial intelligence governance (15 December 2022), 

https://www.eiopa.europa.eu/media/events/artificial-intelligence-governance-2022-12-15_en. 

5 EIOPA, “EIOPA publishes report on artificial intelligence governance principles,” (17 June 2021), 

https://www.eiopa.europa.eu/eiopa-publishes-report-artificial-intelligence-governance-principles-2021-06-

17_en. 

6 In 2020 NAIC issued Principles on Artificial Intelligence, NAIC, Principles on Artificial Intelligence (2020), 

https://content.naic.org/sites/default/files/inlinefiles/AI%20principles%20as%20Adopted%20by%20the%20TF_0807.pdf 

7 EIOPA, “EIOPA launches new survey to map financial innovation in insurance” (6 March 2023), 

https://www.eiopa.europa.eu/eiopa-launches-new-survey-map-financial-innovation-insurance-2023-03-06_en. 

8 BaFin, Machine learning in risk models – Characteristics and supervisory priorities: Responses to the 

consultation paper (18 February 2022), 

https://www.bafin.de/SharedDocs/Downloads/EN/Aufsichtsrecht/dl_Ergebnisse_machinelles_Lernen_Risikomo

delle_en.html.
3 

activities and evaluating existing regulatory frameworks for overseeing and monitoring the 

use of big data and AI. The NAIC is focused on four key areas: (1) NAIC current survey 

work, (2) tools, and resources to monitor industry use of big data and AI, (3) third party data 

and model vendors and (4) regulatory framework and governance. 

The NAIC’s Big Data and AI (H) Working Group released a report on its Private Passenger 

Auto AI/ML Survey results9 in December 2022 reporting that approximately 88% of the 

companies that responded to the survey use or plan to use AI/ML. The survey identifies what 

types of data are being used by companies in their AI/ML models, industry’s use of thirdparty AI/ML models and data, explores levels of governance, and evaluates transparency, 

consumer disclosures, and the extent to which insurance companies provide consumers an 

opportunity to challenge or correct data. State regulators have also now received responses 

for the Homeowners AI/ML Survey and are in the process of requesting information for the 

related Life AI/ML Survey. 

Using the results of the survey work, the NAIC is developing a library of third-party vendors 

operating in the private passenger automobile market, home insurance market, and life 

insurance market which is expected to be completed by the end of 2023. 

While the NAIC Principles on AI adopted in 2020 continue to be the starting point for our 

discussions, in 2023, the discussion has now shifted towards the creation of a model bulletin 

providing regulatory guidance for the use of AI by the insurance industry focusing on 

governance requirements for the use of AI and establishing protocols that rely on external and 

objective standards. 

The NAIC Big Data/AI Working Group also drafted a set of Model and Data Regulatory 

Questions for state insurance supervisors to use for the regulatory evaluation of insurers’ use 

of models and big data, including the use of third-party data and model vendors. The first 

section has questions designed to obtain a high-level understanding of a model/data being used. 

The second section expands on the first section and provides regulators with additional 

questions designed to obtain a more in-depth understanding of a model/data. The third section 

contains definitions of key terms for regulatory reference. State insurance regulators expect the 

questions to be principles based with a focus on high-risk AI models prioritizing model 

governance. The NAIC Big Data/AI Working Group has received comments and is aiming to 

update the draft resource for adoption in 2023.

2. Use of Big Data in AI and traditional models used in insurance, and identifying 

how practices are impacting people of color and historically underrepresented 

groups. 

While the use of data and mathematical models are regulated and supervised differently in 

Europe and in the US, supervisors in both the US and EU are committed to ensuring that 

policyholders’ information is protected from unauthorized use and disclosure and periodically 

make changes to relevant laws and regulations to keep pace with evolving technology based 

on ethical principles for fair treatment of consumers and policyholders. 

9 NAIC, Private Passenger Auto Artificial Intelligence/Machine Learning Survey Results (December 8, 2022),

https://content.naic.org/sites/default/files/inlinefiles/PP%20Auto%20Survey%20Team%20Report%20120822.pdf.
4 

In the EU, the General Data Protection Regulation (GDPR)10 establishes cross-sectorial data 

protection requirements, which are typically complemented with regulations at the national 

level (e.g., allowing the use of certain datasets such as age or disabilities for underwriting 

purposes). The supervision of mathematical models, with the exception of those used to 

calculate capital requirements, is typically done on an ad-hoc and ex-post basis in the EU. 

In the US, insurers must abide by multiple federal and state laws applicable to consumer data 

protections. All states have the minimum consumer protections set forth in the NAIC’s 

Privacy of Consumer Financial and Health Information Regulation, which was drafted in 

response to Gramm-Leach-Bliley Act (GLBA) requirements. This regulation mandates 

insurers inform consumers about their privacy policies, outlines the circumstances in which a 

licensee can disclose private health and financial data to affiliates and third parties, and offers 

individuals ways to prevent a licensee from sharing that information. In addition, the NAIC’s 

Insurance Information and Privacy Protection Model Act establishes standards for the 

collection, use, and disclosure of information gathered in connection with insurance 

transactions. 

The NAIC’s Privacy Protections Working Group is currently reviewing its models on privacy 

for potential updates in response to the insurance industry’s use of new data sources and data 

models impacting consumers. This review includes discussions about data transparency, 

consumer control and access, and data accuracy. Several states are also implementing 

stronger protections for consumer data. Specific to insurance regulation, many states have a 

pre-approval process of rates derived from rating classification models and the use of big 

data; states apply a standard that rates cannot be unfairly discriminatory, and all states 

monitor the market conduct of insurance companies, which may lead to an examination of a 

company’s data use and models for compliance with insurance laws and regulations. 

In the US with regard to big data in property and casualty rating, NAIC membership adopted 

a white paper, Regulatory Review of Predictive Models,

11 to assist states with reviews of rate 

filings that contain generalized linear models (GLMs) in support of the insurer’s rates. The 

white paper guidance has since been expanded for tree-based models such as random forests 

and gradient boosting trees models (GBMs). The NAIC also hired a team of actuaries and data 

scientists to assist state regulators with their reviews of rate models. Regulators and the NAIC 

are focusing on unfair discrimination, data quality, consumer dispute processes for data used, 

rating variables rational relationship with risk, and data adjustments such as feature 

engineering. A current issue being analyzed for a solution is that third party vendor's data and 

models are sometimes difficult to obtain for review. 

The NAIC also presented that in 2020 it formed five workstreams focusing on race and 

insurance relating to the industry, regulatory community, property and casualty, life insurance 

and annuities and health insurance sectors. The focus of the Property/Casualty (P/C) 

Workstream is to examine and determine which practices or barriers exist in the insurance 

10 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection 

of natural persons with regard to the processing of personal data and on the free movement of such data, and 

repealing Directive 95/46/EC (General Data Protection Regulation), https://eurlex.europa.eu/eli/reg/2016/679/oj. 

11 NAIC, Regulatory Review of Predictive Models White Paper (2020), 

https://content.naic.org/sites/default/files/inline-files/9-15%20CASTF%20-

%20Predictive%20Model%20White%20Paper%209-09-2020_1.pdf.
5 

sector that potentially disadvantage people of color and/or historically underrepresented groups 

in the property and casualty line of business and recommendations on action steps. The 

objective is to continue research and analysis of insurance, legal, and regulatory approaches to 

addressing unfair discrimination, disparate treatment, proxy discrimination, and disparate 

impact. The P/C Workstream has been actively involved with the NAIC’s Innovation, 

Cybersecurity and Technology Committee and its Collaborative Forum focused on algorithmic 

bias and developing a common vocabulary for insurance regulators. The P/C Workstream has 

also begun to dialogue with insurers to learn more about their best practices related to ensuring 

unfair discrimination does not occur in all phases of the product life cycle. The P/C Workstream 

is first engaging with insurers with respect to advertising and marketing in understanding what 

kinds of governance principles or best practices insurers have implemented to avoid potential 

bias in advertising and marketing. 

In 2021, FIO issued a Request for Information (RFI) to solicit input regarding the availability 

and affordability of personal automobile insurance.12 Among other things, the RFI requested 

comment on: (1) affordability of coverage and disparities in premium pricing, with particular 

attention to traditionally-underserved communities and the impact of non-driving factors; and 

(2) market evolution and structural shifts in the conduct of the business, including the effects 

of technology and the use of big data, as well as changes related to the COVID-19 pandemic. 

Additionally, the RFI sought feedback on updating FIO’s prior work on auto insurance. In 

2022, FIO continued its work on these issues and also engaged on these issues with its Federal 

Advisory Committee on Insurance, which is a federal advisory committee tasked with making 

non-binding recommendations to FIO in performing its duties and authorities. 

EIOPA provided an overview of the key findings of its 2019 thematic review on Big Data 

Analytics in motor and health insurance, which showed how new datasets (e.g., telematics data, 

website data, credit scores etc.) were increasingly used to complement (not replace) traditional 

data sources in insurance. These datasets are used both in AI and traditional models used in 

insurance. EIOPA also provided an overview of anti-discrimination legislation in place in the 

EU and the additional non-binding guidance provided in its AI governance principles report to 

mitigate the risks arising from the increasing use of new (and old) datasets processed by 

increasingly powerful AI models. 

EIOPA’s Digital Transformation Strategy13 considers the topic of financial inclusion of 

strategic importance in view of the trend towards increasingly data-driven business models 

across the insurance value chain. In addition to the work being carried out in the area of 

sustainable finance, where focus is given on the financial inclusion of populations living in 

areas exposed to climate change (including assessing how new technologies can help address 

these issues), EIOPA is also currently supporting a European Commission project where the 

development of a study about data bias, financial inclusion and fairness metrics in collaboration 

is underway.

14

12 FIO, Monitoring Availability and Affordability of Auto Insurance; Assessing Potential Evolution of the Auto 

Insurance Market, 86 FR 28681 (May 27, 2021), https://www.federalregister.gov/documents/2021/05/27/2021-

11167/monitoring-availability-and-affordability-of-auto-insurance-assessing-potential-evolution-of-the.

13 EIOPA, "EIOPA sets out a forward- looking digital transformation strategy” (10 December 2021), 

https://www.eiopa.europa.eu/eiopa-sets-out-forward-looking-digital-transformation-strategy-2021-12-10_en. 

14 The project is in the remit of DG Reform in cooperation with the Central Bank of Hungary.
6 

B. Suptech as a Regulatory Tool 

Suptech is the use of innovative technologies by financial authorities to support their work such 

as big data, AI/ML, and other new technologies for prudential and conduct supervision. 

US and EU supervisors consider that Suptech represents many opportunities for their day-today supervisory activities. To this extent they shared their experiences with the increased use 

of Suptech in their respective markets, including some in proof-of-concept stages. The tools 

presented were being used both for prudential and for market conduct supervisory purposes, 

with some of them being developed in-house, while others are being developed in cooperation 

with third-party service providers. 

1. Suptech in prudential supervision

The NAIC discussed its use of AI/ML to improve solvency monitoring tools used in financial 

regulation. The NAIC partnered with an external consulting firm in 2021 to utilize AI/ML tools 

to build models estimating the potential degree of solvency risk associated with individual 

insurers. The models were developed based on 10+ years of historical financial data from US

based life insurers, including failure/insolvency data and criteria. One model was built using a 

decision tree approach, whereas another was developed as a generalized linear model. The 

effectiveness of the models was compared to actual failure results and the models were 

calibrated for maximum effectiveness. In addition, the models evaluated additional data 

points/variables to improve their performance. 

After selecting the most important variables and maximizing the effectiveness of the models 

based on historical data, the models were compared against the NAIC’s existing Life Insurance 

Scoring System tool to identify opportunities to improve the tool based on lessons learned from 

the models. Ultimately, by interpreting the model results, including true positive rates, false 

positive ratios and feature importance, a number of enhancements to the NAIC’s Life Insurance 

Scoring System tool were identified. These enhancements included the elimination of existing 

features/variables that were not found to be predictive of failure, the addition of newly 

identified features/variables found to be predictive of failure, and the adjustment of existing 

features/variables to maximize their importance. After adjusting the existing Life Insurance 

Scoring System tool based on the enhancements identified, the tool has demonstrated a notable 

improvement in performance. The NAIC is currently following a similar approach to improve 

the performance of its Property/Casualty Scoring System tool in 2023 and plans to work on its 

Health Scoring System tool in 2024. 

The NAIC also discussed the use of a business intelligence tool (Tableau) to enhance existing

solvency monitoring tools and reports by developing enhanced dashboards and visualizations. 

The business intelligence tool allows users to access and analyze data from relational databases 

to produce powerful visualizations such as graphs and maps to increase the speed of insight in 

identifying variances, risks and concerns. In addition, the tool connects existing regulatory data 

sources to flexible dashboards that allow for mining and manipulation by end users. Since 

beginning this project in 2019, the NAIC has completed seven different comprehensive 

dashboards to analyze solvency risks in various areas of an insurer’s operations (e.g., bond 

holdings, equity holdings, premium writings, reinsurance, reserving) that are available for 

insurers filing under each annual statement type (Property/Casualty, Life and Health). Going 
7 

forward, the NAIC plans to continue developing additional dashboards for use in solvency 

monitoring as well as provide standardized datasets and templates for end users to access in 

building their own customized dashboards and visualizations. 

Federal Reserve Board (Board) representatives discussed the Board’s use of machine learning 

in the supervisory process. Suptech is a high-priority initiative across the Federal Reserve 

system. To date, most of the Board’s efforts have been focused on bank supervision. For 

example, a tool that utilizes natural language processing (NLP) to summarize and extract 

information from unstructured data reported by supervised bank holding companies is routinely 

used by Federal Reserve examiners. Within insurance, the Board is initially focusing on the 

potential to use ML to estimate loss reserves. The Board has worked to implement a published 

model (DeepTriangle) that uses deep neural networks to estimate loss reserves from publicly 

available information.

From a prudential perspective, EIOPA presented internally developed programs, using 

machine learning or advanced analytics methods, with a focus on applications where the 

centralized European database at EIOPA brings an added value. An important and growing 

area for EIOPA’s data work are methods to detect outliers in reporting datasets, unexpected 

changes in time series (novelties) and to identify exceptions from automatically detected 

patterns. Those applications have been developed with Python programming language and are 

already in production by EIOPA and have proven valuable in identifying both data quality 

issues and in triggering supervisory attention. 

In addition, EIOPA mentioned the use of its database for (cross-border) network analysis. 

Moreover, EIOPA is in close contact with national supervisors and has established in 

cooperation with them an internal code sharing platform to further improve the collaboration 

and use of Suptech methods amongst EU supervisory authorities. The programs implemented 

by EIOPA, including machine learning algorithms in Python for outlier and novelty detection, 

are also shared on this internal platform among European national supervisors. 

2. Suptech in market conduct supervision

On the market conduct side, the NAIC reviewed how US state insurance regulators are 

implementing the use of natural language processing to review policy form submissions for 

property and casualty insurance. This technology is being used to accelerate the review of new 

form filings by identifying phrases or words that may be prohibited and prioritizing filings for 

further review. This technology will also help identify emerging insurance concepts or trends 

in the industry, such as a change in deductibles and limitations or exclusions of coverage. While 

the use of this technology is in the early phases of implementation, the NAIC is rebuilding its 

System for Electronic Rate and Form Filing System (SERFF), which is a cost-effective and 

efficient way for insurers to submit rate and form filings to US insurance regulators. Moving 

forward, SERFF will include new technologies, such as better document management and text 

recognition. The focus is on creating a processing system that will reduce the number of 

touchpoints by regulators, which will ultimately lower the time to approve filings. 

The NAIC also touched on the use of new technology for the licensing of intermediaries 

through its affiliate, the National Insurance Producer Registry (NIPR), which is a not‐for‐profit 

technology company that provides cost‐effective, streamlined, and uniform licensing data and 

compliance services for insurance professionals. NIPR has developed a mobile application that 

allows an intermediary to access their licensing information. NIPR has also implemented the 
8 

use of a chat tool to respond to frequently requested information from insurance intermediaries 

and applicants. Finally, the NAIC touched on NIPR’s Attachment Warehouse, which is a tool 

used by US state insurance regulators to electronically receive, store, and share licensing 

related documents. The Attachment Warehouse eliminates the need for applicants to email or 

fax documents to insurance regulators. 

While a long-term project, the NAIC referenced the development of recommendations for the 

incorporation of AI in the NAIC Market Information Systems. These recommendations focus 

on reviewing the collection of existing data, employing more rigorous statistical techniques to 

assess predictive accuracy of current analytical tools, assessing the ways AI could improve 

analysis, and exploring the potential collection of additional data suitable for AI techniques. 

In the area of market conduct, EIOPA explained that in the past it had experimented with an 

NLP tool to monitor the sentiment of comments about insurance made by consumers in social 

media. While the tool provided some interesting results and was used to support its supervisory 

work,15 EIOPA eventually decided to stop using it given that it had some accuracy issues, for 

instance regarding the accuracy of the translations of different languages spoken in the EU, or 

to detect the irony of certain comments made in social media platforms.

Currently, EIOPA is developing a tool to supervise the unit-linked life insurance market by 

analyzing the key information documents (KID) of unit-linked life insurance products sold in 

the EU. In collaboration with a third-party provider, EIOPA will use a web scraping tool to 

create a database / repository of KIDs which insurance undertakings are required to publish on 

their websites. Subsequently, the information from these two-pager, standardized information 

documents will be processed and analyzed with the help of NLP tools. 

It is worth noting that, once established, the upcoming European Single Access Point (ESAP)16

is expected to facilitate access to the KIDs, since it will provide a centralized access to publicly 

available information of relevance to financial services, capital markets and sustainability. 

C. Cybersecurity

 

While not outlined as a specific area for focused in-depth discussion for the Workstream, brief 

high-level updates relating to cybersecurity were also exchanged by workstream members. The 

NAIC highlighted the creation of the Cybersecurity Working Group which will, among other 

things, focus on creating a Cybersecurity Incident Response Plan to assist US regulators in 

addressing cybersecurity incidents affecting licensed insurance entities. FIO noted its 

publication in September 2022 of a request for comments on a potential federal insurance 

response to catastrophic cyber incidents.17 FIO also noted the White House’s release in March 

15 EIOPA, Report on Consumer Protection Issues arising from the sale of Mobile Phone Insurance (12 

November 2015), https://www.eiopa.europa.eu/publications/report-consumer-protection-issues-arising-salemobile-phone-insurance_en. 

16 European Commission, Proposal for a Regulation of the European Parliament and of the Council establishing 

a European single access point providing centralised access to publicly available information of relevance to 

financial services, capital markets and sustainability (25 November 2021), https://eur-lex.europa.eu/legalcontent/EN/TXT/?uri=CELEX:52021PC0723. 

17 Departmental Offices, U.S. Department of the Treasury, Potential Federal Insurance Response to Catastrophic 

Cyber Incidents, 87 FR 59161 (September 29, 2022),

https://www.federalregister.gov/documents/2022/09/29/2022-21133/potential-federalinsurance-response-to-catastrophic-cyber-incidents.
9 

2023 of the National Cybersecurity Strategy, one of the strategic objectives of which is to 

explore a potential federal insurance response to catastrophic cyber incidents to US critical 

infrastructure.18

EIOPA highlighted the 2020 Guidelines on ICT security and governance,19 applicable as of 

July 2021. EIOPA indicated its cooperation with Member States, the European Commission, 

and other stakeholders on the preparation for the adoption of the Digital Operational Resilience 

Act (DORA)20 introducing new ICT security and governance requirements in the EU financial 

services sector. 

III. Conclusion and Next Steps

A common theme emerging in both the US and the EU is the implementation of a risk-based 

supervisory approach over insurers’ use of AI/ML, which will allow for the growth of insurers’ 

use of AI/ML while providing the appropriate level of consumer protection. Further, US and 

EU supervisors agreed on the importance of further discussing other relevant innovative 

developments taking place in the insurance sector. Workstream members therefore agreed to 

the following during 2023/2024: 

• Discussing ongoing regulatory developments affecting insurers’ use of big data AI/ML 

and the importance of developing adequate governance, risk management, and controls 

by insurers; 

• Discussing regulatory and supervisory initiatives to enhance the digital operational and 

cyber resilience of insurers;

• Discussing developments in the area of open insurance, both private led and public led 

initiatives; and

• To the extent time permits and new developments emerge, continuing to exchange on

other initiatives developed by supervisory authorities in the EU and the US in the area 

of innovation and digital finance, as applicable. 

18 White House, Fact Sheet: Biden-

Harris Administration Announces National Cybersecurity Strategy, news 

release (March 2, 2023), https://www.whitehouse.gov/briefing-room/statements-releases/2023/03/02/fact-sheetbiden-harris-administration-announces-national-cybersecurity-strategy/. 

19 EIOPA, Guidelines on information and communication technology security and governance (12 October 

2020), https://www.eiopa.europa.eu/publications/guidelines-information-and-communication-technologysecurity-and-governance_en. 

20 European Commission, Proposal for a Regulation of the European Parliament and of the Council on digital 

operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 

648/2012, (EU) No 600/2014 and (EU) No 909/2014 (24 September 2020), https://eur-lex.europa.eu/legalcontent/EN/TXT/?uri=CELEX%3A52020PC0595.