5 unchanged sentences
Our risk management framework includes several security pillars, including data security, identity management, cloud security, infrastructure security, application security, incident response, and cybersecurity risk management.
+Added: 35 | MercadoLibre, Inc.
+Added: T able of Contents
We conduct annual International Organization for Standardization Information Security Management Systems (“ISMS”) Requirements (“ISO/IEC 27001”) reviews and Payment Card Industry Data Security Standard (“PCI-DSS”) reviews of our payment information security controls with the assistance of an external certified auditor.
18 unchanged sentences
and (iii) internal local, corporate and strategic crisis management teams that form part of our crisis management framework.
−Removed: Our risk management framework further includes processes to manage cybersecurity risks associated with third parties, including, a third-party risk management program that focuses on identifying security and data privacy risks arising out of our interactions with critical third-party suppliers and payment methods, and a program focused on assessing risks arising in mergers and acquisitions transactions.
+Added: Our risk management framework includes processes to manage cybersecurity risks associated with AI, such as enhanced governance of AI-related traffic, expanded automated scanning and blocking capabilities, and the building of comprehensive inventories that support continuous monitoring.
+Added: We also deploy cross-ecosystem protections—including prompt-injection defenses, confidentiality controls for conversations and sensitive data, a strong focus in agentic identity management to ensure secure authentication and authorization across AI-driven interactions, and dedicated initiatives to identify and mitigate shadow AI usage across the organization.
+Added: Our risk management framework also includes processes to manage cybersecurity risks associated with third parties, including, a third-party risk management program that focuses on identifying security and data privacy risks arising out of our interactions with critical third-party suppliers and payment methods, and a program focused on assessing risks arising in mergers and acquisitions transactions.
+Added: Additionally, we have procedures in place to block high-risk providers, minimize sensitive access paths, and automate key evaluations.
+Added: Together, these measures are intended to reduce the likelihood and impact of AI-related cybersecurity incidents while enabling the safe and responsible use of AI across the organization.
In connection with our cybersecurity risk management processes, while we do not regularly engage assessors, consultants, auditors, or other third parties to assess, identify, and manage material risks from cybersecurity threats, we do involve such parties if there has been a cybersecurity incident that we believe requires an assessment by a third party.
2 unchanged sentences
See “Risk Factors” in Item 1A of this Annual Report on Form 10-K for more information on our cybersecurity-related risks.
−Removed: 36 | MercadoLibre, Inc.
The cybersecurity risk management processes described above are managed by our Cybersecurity VP under the supervision of the risk committee.
−Removed: The Audit Committee of the board of directors provides additional oversight as needed.
Our risk committee is comprised of the Chief Financial Officer, Commerce President, Fintech President and the Heads of Corporate Affairs, Risk & Compliance, Data Privacy, Information Security, AML & Sanctions, Legal & Government Relations, Commerce Product Development, Fintech Product Development and IT Infrastructure.
1 unchanged sentence
Our Cybersecurity VP and certain other members of our risk committee are skilled in technology, security and/or risk and compliance.
−Removed: Our Cybersecurity VP is a certified information systems security professional and has considerable experience in the field of information security, fraud and prevention.
+Added: Our Cybersecurity VP is a certified information systems security professional (CISSP) with over 25 years of experience in cybersecurity, information security governance, technology and operational risk management, and fraud prevention.
+Added: He holds a degree in computer engineering and has led large, geographically distributed security and technology organizations across Latin America.
+Added: His background spans multiple industries, including e-commerce, fintech, logistics and digital services, where he has designed and implemented enterprise cybersecurity strategies, cloud security programs, incident response capabilities and risk-based control frameworks.
+Added: He also played a foundational role in establishing and scaling the Company’s cybersecurity function, contributing to the development of its governance model and the expansion of its regional security operations.
+Added: 36 | MercadoLibre, Inc.
+Added: T able of Contents
As part of our cybersecurity risk management processes, our Cybersecurity VP presents security risk matters to the risk committee on an as-necessary basis and to the Audit Committee annually and on an as-necessary basis.
4 unchanged sentences
Board of directors
−Removed: The Audit Committee is primarily responsible for the oversight of cybersecurity risks and threats.
−Removed: To fulfill this responsibility, the Audit Committee, assisted, as appropriate, by the risk committee, oversees the risk management framework, including risk assessment and risk management policies and procedures established by management to identify, evaluate, measure and manage existing and potential cybersecurity risks faced by the Company.
−Removed: Annually and on an as-necessary basis, individual members of management and/or of the risk committee provide presentations to the Audit Committee regarding cybersecurity matters, including any material risks.
−Removed: These presentations include information regarding cybersecurity risks, the evolution of those risks and initiatives to optimize and improve the processes of cybersecurity.
−Removed: Further, in the event of a specific cybersecurity incident, these presentations include information about the relevant security incident, such as incident status, informed stakeholders and remediation plans.
+Added: Our full board of directors provide ultimate oversight for the cybersecurity program, in addition to other significant risks of the Company.
+Added: The board of directors has delegated primary oversight of cybersecurity risks and threats to the Audit Committee.
+Added: The Audit Committee supervises the Company’s risk management framework, including the policies and procedures used to identify, assess, measure, and manage both current and potential cybersecurity risks.
+Added: On an annual basis—and whenever circumstances require—management and/or members of the Risk Committee brief the Audit Committee on cybersecurity matters, including any material risks.
+Added: These updates cover the nature and evolution of cybersecurity risks, as well as initiatives aimed at strengthening and optimizing cybersecurity processes.
+Added: In the event of a specific cybersecurity incident, these briefings also provide details on the incident’s status, the stakeholders informed, and the remediation actions underway.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.