In the ordinary course of our business, we collect and store sensitive data, personal data of individuals, and intellectual property and proprietary business information owned or controlled by us, our customers and other third parties. This data encompasses a wide variety of business-critical information, including research and development information, commercial information, and business and financial information. We face four primary risks relative to protecting this critical information: loss of access; inappropriate disclosure; inappropriate modification; and inadequate monitoring of our controls over the first three risks.
The secure processing, storage, maintenance, and transmission of this critical information is vital to our operations and business strategy, and we devote significant resources to protecting such information. We have implemented multiple layers of security measures to protect the confidentiality, integrity and availability of data and the systems and devices that store and transmit data. We utilize current security technologies, including encryption and data depersonalization, and our defenses are monitored and routinely tested. Although we take measures to protect sensitive information from unauthorized access or disclosure, our information technology and infrastructure may be vulnerable to attacks by hackers or viruses, breaches, interruptions due to employee error, malfeasance, lapses in compliance with privacy and security mandates, or other disruptions. Any such breach or interruption could compromise our networks and the information stored there could be accessed by unauthorized parties, publicly disclosed, lost, or stolen. Because the techniques used to obtain unauthorized access, disable or degrade service, or sabotage systems change frequently, and may not immediately produce signs of intrusion, we may be unable to anticipate these incidents or techniques, timely discover them, or implement adequate preventative measures.
Geopolitical tensions or conflicts, and the increased adoption of AI technologies, may further heighten the risk of cyber-attacks. Additionally, leveraging AI capabilities to potentially improve internal functions and operations presents further risks and challenges, including the possibility of creating new attack methods for adversaries. The use of AI to support business operations carries inherent risks related to data privacy, intellectual property, and security, such as intended, unintended, or inadvertent transmission of proprietary, confidential, or sensitive information, as well as challenges related to implementing and maintaining AI tools, such as developing and maintaining appropriate datasets for such support. If we fail to implement adequate safeguards, the use of AI may introduce additional operational vulnerabilities by producing inaccurate outcomes based on flaws in the underlying data or methodologies, or unintended results.
Any such security breach or interruption, as well as any action by us or our employees or contractors that might be inconsistent with the rapidly evolving data privacy and security laws and regulations applicable within the United States and elsewhere where we conduct business, could result in the loss, misappropriation, corruption or unauthorized access of data, enforcement actions by U.S. states, the U.S. federal government or foreign governments, liability or sanctions under data privacy laws that protect personal data, regulatory penalties, litigation, including potential class action litigation, the incurrence of significant remediation costs, increases to insurance premiums, disruptions to our development programs, business operations and collaborations, diversion of management efforts and damage to us and our brands' reputation, any of which could harm or have an adverse effect on our financial position and results of our business and operations. Because of the rapidly moving nature of technology and the increasing sophistication of cybersecurity threats, our measures to prevent, respond to and minimize such risks may be unsuccessful.
As a HIPAA business associate, we comply with HIPAA security standards. Whenever possible, we work with de-identified information and employ additional measures such as encryption tools to protect the privacy of individuals, including our customers, and patient data and employee data. However, hackers may attempt to penetrate our computer systems, and, if successful, misappropriate personal or confidential business information. In addition, contractors or other third parties with whom we do business may attempt to circumvent our security measures or inadvertently cause a breach involving such information. While we continue to implement additional protective measures to reduce the risk of and detect cyber incidents, cyber-attacks are becoming more sophisticated and frequent, and the techniques used in such attacks change rapidly.
In addition, the GDPR, which took effect in May 2018, governs the collection and use of personal data of EEA residents. The GDPR, and its equivalents in the United Kingdom and Switzerland, are wide-ranging in scope, impose requirements relating to the consent of the individuals to whom the personal data relates, the information provided to the individuals regarding the processing of their personal data, the security and confidentiality of the personal data, data breach notification and the use of third-party processors in connection with the processing of the personal data. The GDPR also imposes strict rules on the transfer of personal data out of the EEA to third countries like the United States, enhances enforcement authority and imposes large penalties for noncompliance, including the potential for fines of up to 20 million euros or 4% of the annual global revenues of the infringer, whichever is greater. While we strive to comply with the GDPR and its UK and Swiss equivalents, as applicable, there can be no assurance that as our operations evolve, our efforts to comply or to remain in compliance will be fully successful.
Further, unauthorized access, loss or dissemination of sensitive personal data, such as health information, could also disrupt our operations, including our ability to conduct research and development activities, process and prepare company financial information, manage various general and administrative aspects of our business and damage our reputation, any of which could adversely affect our business and reputation. In addition, there can be no assurance that we will promptly detect any such disruption or security breach, if at all. To the extent that any disruption or security breach were to result in a loss of or damage to our data, information systems, or applications, or inappropriate disclosure of confidential or proprietary information, we could incur liability and the further development of our products could be delayed.
There can be no assurance that we will not be impacted cybersecurity incidents that bypass our security measures, impact the integrity, availability or privacy of health information or other data subject to privacy laws, or disrupt our information systems, devices or business, including our ability to deliver services to our customers. As a result, cybersecurity, physical security and the continued development and enhancement of our controls, processes and practices designed to protect our enterprise, information systems and data from attack, damage or unauthorized access remain a priority for us. As cyber threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any cybersecurity vulnerabilities. In addition to risks affecting our own systems, we could also be negatively impacted by a security breach impacting a third party's network and affecting us, such as our third-party vendors and service providers. In the event that these third parties do not adequately safeguard our data, cybersecurity incidents could result and negatively impact our business, operations, and financial results.