Corporate Governance
Our scientific and transparent corporate governance with high integrity is a solid foundation for the company's sustainable development.
Ping An takes both domestic and international board management experiences in the establishment of a series of board and director regulations to increase transparency and credibility.
Diversity
The Group’s Nomination Committee has constructed “Instructions for Nomination Committee” to ensure a balanced set of qualifications, technical expertise, experiences, and diversity to provide wide range of perspectives, efficient and effective operations, and high standards of corporate governance. All nomination processes, election results, and disclosure requirements are strictly structured, following corresponding laws and regulations.
Independent Director Regulations
Independence refers to directors who have no other position inside Ping An other than being on the board of directors, and does not have any conflict of interest with the company or controlling shareholders of the company. Independent director election and selection process is strictly regulated with clear guidance through shareholder meetings. At least one third of the board members must be independent according to the regulation. Independent directors should conduct their duties with due diligence, independence, and in good faith to protect the interests of the company, insurers, and shareholders. Independent directors should not be affected by principle shareholders, controlling parties, management team, or other parties that may pose severe conflict of interests to Ping An. They should be able to form objective, fair, and independent opinions. The supervisory board will conduct regular ratings and reviews for to performance improvement and tenure management.
Ping An has embedded the notion of ESG into the Group's existing "251" risk management framework. The ESG risk control requirements are covered in the existing comprehensive financial risk management system. The original risk management system is supplemented and strengthened in accordance with the ESG concept on different levels: "2"- dual control of the Group and subsidiaries in terms of ESG governance, "5"- integration of ESG risks and the current five risk categories, "1"- establishment of a unified ESG management system and tools, to further improve the Group's risk governance capability and achieve long-term sustainable development.
As a responsible and diversified insurance company, Ping An is committed to integrate ESG concepts into our insurance businesses. This dedication is shown through und-erwriting risk management, namely setting proper risk pricing for insurance products and risk management of the insurer, and the sustainable insurance product system.
A set of comprehensive business code of conduct is the foundation of good corporate governance. Ping An keeps high standards of internal control and leads by example for the mutual benefits of all stakeholders.
As a leading comprehensive financial services group, Ping An abides by our Business Code of Conduct, in compliance with laws and regulations, industry standards, based on real business scenarios, and sustainability related internal regulations. Strong and practical codes of conduct and disclosure systems help us safeguard the interest of internal and external stakeholders. We believe the positive benefits of codified business ethics and good conduct for our environment, the community, and sustainable growth of our own business.
Company Level Business Ethics Statement
Ping An has constructed regulations such as " Anti-Money Laundry Regulations", "Integrated Procurement and Supplier Management", "Whistleblower Procedures" to establish systematic management and transparency. Ping An pledges to uphold strict tax policies, anti-trust and anti-monopoly, anti-money laundry, anti-terrorist financing, and sanctions compliance, fairness and individual rights protection, and whistleblower procedures.
Statement on Employee Business Conduct
Ping An pays close attention to employee business conduct. To ensure systematic training and transparent management, Ping An has established regulations such as "Information Security Management Regulations", "Conflict of Interests Management", and "Anti-Fraud Regulations" to regulate employee actions and establish behavior standards. Ping An established clear guidance regarding information management and social media management, insider trading and conflict of interests, bribery, corruption and fraud. Ping An is against all actions that hinder fair and normal business activities, and complies with all laws and regulations, industry standards, and internal control.
For further details, please refer to the “Ping An Business Code of Conduct”.
Ping An implements the highest standard in regards to information security with strict privacy protection and ethical governance for artificial intelligence applications.
Information Security
Ping An continuously enhances its information security management system to safeguard the confidentiality, integrity, and availability of information. The Group strictly adheres to regulatory guidelines on information security, conducts timely assessments of regulatory risk alerts, and actively monitors industry security dynamics and external threat intelligence. By integrating proactive and reactive defense measures, Ping An effectively identifies and mitigates information security risks in a timely manner.
For more details, please refer to the “Policy Statement on Information Security Management of Ping An Group.”
I. Product Requirements
We prioritize user privacy and data security as a critical evaluation factor during the screening and validation of product requirements. By mapping product usage scenarios, we veto any requirements that may compromise cybersecurity or user privacy. For scenarios involving personal data processing, we actively adopt application models based on technologies such as homomorphic encryption, anonymization, and privacy-preserving computation, explicitly enhancing privacy protection in key application scenarios.
II. Product Design
We regularly conduct security vulnerability scans on design prototypes and perform potential risk assessments concerning data leakage and other threats. We implement risk mitigation measures to minimize the likelihood of information security incidents post-deployment. On the security front, we strictly mandate encryption, data masking, and anonymization for sensitive data to safeguard user privacy. For sensitive data interaction and exchange scenarios, we focus on promoting privacy-preserving computing technologies to further reinforce privacy protection.
III. Product Development
We actively enhance product code security by conducting code security audits and initial code inspections to identify vulnerabilities and potential flaws. We perform prompt vulnerability root-cause tracing and remediation to proactively prevent data breaches. Encryption technologies are applied to both data at storage and data in transit. Furthermore, privacy compliance reviews are completed prior to product launch, ensuring that the information security systems effectively safeguard user privacy across both design and operational stages. We have built and deployed a technical platform supporting privacy-preserving computation, enabling efficient data flow under full regulatory compliance and realizing the principle of "available but invisible" data.
IV. Product Testing
During the testing phase, we implement a dual-verification mechanism combining automated system reviews with manual inspections to perform comprehensive security testing. This includes baseline security checks and penetration testing to ensure that products can promptly detect unauthorized access and malware attacks.
V. Product Maintenance
We deploy Endpoint Detection and Response (EDR) systems and regularly conduct security vulnerability scans on products and their operating environments to identify unauthorized access and other malicious attacks. This enables our IT operations team to respond rapidly and effectively mitigate cybersecurity risks, including data breaches. Leveraging privacy-preserving computing technologies, we strengthen routine operational monitoring to ensure stable, reliable data utilization while strictly maintaining high standards of privacy security.
Privacy Protection
Ping An places high priority on privacy protection. Focusing on governance architecture, management systems, operational initiatives, and specialized training, the Group continuously refines customer privacy protection mechanisms to comprehensively elevate management standards. Concurrently, Ping An monitors the proportion of user data used for secondary purposes. Ping An categorizes and manages customer consent based on business necessity; secondary-purpose authorizations primarily encompass scenarios such as marketing services and product recommendations. As of the end of 2025, the overall authorization rate for secondary purposes stood at 61%.
For more details, please refer to the “Policy Statement on Privacy Protection of Ping An Group.”
AI Governance
Ping An follows the five ethical principles of "human-centricity, human autonomy, safety and controllability, fairness and impartiality, and openness and transparency." in all AI applications such as finance, healthcare, governance, transportation, real estate, and law. Ping An has publicly released the Policy Statement on Responsible AI of Ping An Group, committing to exercise scientific governance over the development and deployment of AI, and striving to deliver technology‑enabled financial services that meet security requirements and ethical standards. We have also established responsible AI governance objectives across four dimensions: data usage, algorithm research, industry application, and low-carbon operation, and is continuously improving our AI governance framework.
Industry Application: Ping An actively promotes the application of AI tools in business operations. In 2026, Ping An P&C successfully launched China’s first insurance policy covering carbon emission reduction losses based on target forestry carbon tickets in Chizhou, Anhui Province. This innovative, distinctive insurance product leverages AI-powered remote sensing technology for carbon sink monitoring and measurement. Compensation is based on quantified losses of carbon emission reductions arising from damage to forest resources. Insurance proceeds are directed toward post-disaster relief and ecological restoration. The product covered approximately 250.7 hectares of forest as of June 30, 2026, with an estimated carbon emission reduction of approximately 32,200 tons.
Low-carbon Operation: Adhering to the philosophy of green‑and‑low‑carbon development, Ping An’s data centers integrate low‑ecological‑footprint management into the full‑lifecycle governance of infrastructure. During the construction phase, we prioritize high-efficiency and eco-friendly equipment, optimize data center layout and cooling system design, and improve overall power usage efficiency. We also adopt modular, prefabricated and intelligent construction technologies to reduce resource waste and carbon emissions. In the operational and maintenance stage, we strengthen our energy management system and implement energy-saving measures including load adjustment, equipment upgrading and intelligent operational tuning to lower energy consumption. Moreover, we further promote the consolidation of low-power cabinets and continuously enhance computational inference efficiency to advance low-carbon operations across our data centers.
In 2025, Ping An Life Insurance’s self‑developed comprehensive AI agent product “PAI” passed the assessment against the Requirements for Financial‑Oriented AI Agent Capabilities standard issued by the China Academy of Information and Communications Technology (CAICT). It was awarded the highest‑level 4+ certification, making Ping An Life Insurance the first insurance enterprise to obtain this authoritative certification.
For more details, please refer to the “Policy Statement on Responsible AI of Ping An Group”.