Solvency II R25-Art.44: Art. 44(2), (2b) to (2e) as amended (from 30 January 2027) Manage sustainability risks with plans, quantifiable targets and disclosure; cover cybersecurity

Operational risk management must include cybersecurity as defined in the EU Cybersecurity Act; volatility adjustment users must reflect it in liquidity plans; sustainability risks must be assessed over short, medium and long horizons with strategies, policies, processes and systems to identify, measure, manage and monitor them. Undertakings must develop and monitor specific plans with quantifiable targets and processes addressing financial risks from sustainability factors, including transition risks under EU climate law objectives, consistent with any corporate sustainability transition plan and proportionate to their business model, and disclose the quantifiable targets annually. Subsidiaries covered by a group plan are exempt at individual level. EIOPA regulatory technical standards specify the plan content.