AMERICAN INTERNATIONAL GROUP INC

Operational risk is defined as the risk of loss, or other adverse consequences, resulting from inadequate or failed internal processes, people, systems, or from external events. Operational risk includes legal, regulatory, technology, compliance, third-party and business continuity risks, but excludes business and strategy risks.

Operational risk is inherent in each of our business units and functions and can have many impacts, including but not limited to, unexpected economic losses or gains, reputational harm due to negative publicity, regulatory action from supervisory agencies and operational and business disruptions, and/or damage to customer relationships.

The Operational Risk Management (ORM) function within ERM oversees adherence to the operational risk policy and risk and control framework.

ORM, working together with other control and assurance functions and first line Risk Control Owners through the risk and control framework, provides an independent view of operational risks for each of the business areas.

Cybersecurity Risk

AIG, like other global companies, continues to witness the increased sophistication and activities of unauthorized parties attempting cyber and other computer-related penetrations such as “denial of service” attacks, phishing, untargeted but sophisticated and automated attacks, and other disruptive software in an effort to compromise systems, networks and obtain sensitive information.

ERM works closely with and supports the risk management practices of Information Technology, the Information Security Office and the business units and functions that form the lines of defense against the cybersecurity risks that we face.

For additional information regarding the privacy data protection and cybersecurity regulations to which we are subject, see Part I, Item 1. Business – Regulation – Privacy, Data Protection, Cybersecurity and Artificial Intelligence Requirements. For additional discussion of cybersecurity risks, see Part I, Item 1A. Risk Factors – Business and Operations. For additional information regarding our cybersecurity risk management as well as strategy and governance, please see Part 1, Item 1C. Cybersecurity.