Cybersecurity Risk Management and Strategy Disclosure
Dec. 31, 2025
Our embedded approach to ERM is formalized in a specific policy and is aligned with ISO 31000 (Risk Management). This enables us to:
•set and enable our Company strategy, manage our performance, and capitalize on opportunities; and
•systematically identify, evaluate and treat specific risk scenarios.
Our ERM roadmap includes, in particular, deploying our ERM framework which is based on the following principles:
•addressing uncertainty explicitly;
•pragmatic and tailored to us;
•integral part of our processes and decision-making; and
•proactive, structured, dynamic, iterative and responsive to change.
Our risk governance and process, including our governance and process related to cybersecurity risks, is described in the following chart:
The embedded ERM process takes a holistic view, combining both company-wide top-down and bottom-up perspectives, so that specific risk scenarios are addressed at the right level.
Corporate risk owners (members of our Senior Management) are appointed for each priority risk area to develop risk response plans, adapted to changing external conditions and enhance
monitoring capabilities. The risk response plans are regularly reviewed by our Executive Committee and periodically discussed with our Supervisory Board and Audit Committee.
As part of the overall risk framework, we have also designed and implemented a dedicated resilience framework which provides a consistent approach to address risks of potential disruptions of our resources, including potential cybersecurity-attacks. In 2025, we continued to enhance a company-specific methodology underpinning a global dashboard: a range of relevant indicators based on internal or external standards, covering dimensions such as exposure to natural hazards, loss prevention characteristics, facilities robustness, equipment modernization and redundancy, IT infrastructure quality and cyber protection. For every significant site, those indicators are compiled in our “site resilience index”, which is updated on a quarterly basis. Annually, site management teams prepare and update a site improvement plan accordingly.
Cybersecurity risk management is an integral part of the overarching risk framework and seeks to identify and address fast-evolving cybersecurity threats. The management of cybersecurity risks are governed by the Executive Committee and receives regular oversight from the Audit Committee as a standing item. Please see “Item 6. Directors, Senior Management and Employees” for a description of the biographies of our Executive Committee and Audit Committee members.Furthermore, we have been ISO 22301 (Security and Resilience) certified since 2016. Throughout 2024, our continuous improvements have been subjected to both internal audits and external surveillance audits from the certification body. We have also been certified ISO SAE 21434 (Road Vehicles – Cybersecurity Engineering) since 2022, confirming that we established a certified management system and governance which meets and complies with the requirements of the automotive industry in the field of cyber security process management within product development phases.
Our embedded approach to ERM is formalized in a specific policy and is aligned with ISO 31000 (Risk Management). This enables us to:
•set and enable our Company strategy, manage our performance, and capitalize on opportunities; and
•systematically identify, evaluate and treat specific risk scenarios.
Our ERM roadmap includes, in particular, deploying our ERM framework which is based on the following principles:
•addressing uncertainty explicitly;
•pragmatic and tailored to us;
•integral part of our processes and decision-making; and
•proactive, structured, dynamic, iterative and responsive to change.
Our risk governance and process, including our governance and process related to cybersecurity risks, is described in the following chart:
The embedded ERM process takes a holistic view, combining both company-wide top-down and bottom-up perspectives, so that specific risk scenarios are addressed at the right level.
Corporate risk owners (members of our Senior Management) are appointed for each priority risk area to develop risk response plans, adapted to changing external conditions and enhance
monitoring capabilities. The risk response plans are regularly reviewed by our Executive Committee and periodically discussed with our Supervisory Board and Audit Committee.
As part of the overall risk framework, we have also designed and implemented a dedicated resilience framework which provides a consistent approach to address risks of potential disruptions of our resources, including potential cybersecurity-attacks. In 2025, we continued to enhance a company-specific methodology underpinning a global dashboard: a range of relevant indicators based on internal or external standards, covering dimensions such as exposure to natural hazards, loss prevention characteristics, facilities robustness, equipment modernization and redundancy, IT infrastructure quality and cyber protection. For every significant site, those indicators are compiled in our “site resilience index”, which is updated on a quarterly basis. Annually, site management teams prepare and update a site improvement plan accordingly.
Cybersecurity risk management is an integral part of the overarching risk framework and seeks to identify and address fast-evolving cybersecurity threats. The management of cybersecurity risks are governed by the Executive Committee and receives regular oversight from the Audit Committee as a standing item. Please see “Item 6. Directors, Senior Management and Employees” for a description of the biographies of our Executive Committee and Audit Committee members.
Corporate risk owners (members of our Senior Management) are appointed for each priority risk area to develop risk response plans, adapted to changing external conditions and enhance
monitoring capabilities. The risk response plans are regularly reviewed by our Executive Committee and periodically discussed with our Supervisory Board and Audit Committee.
Cybersecurity risk management is an integral part of the overarching risk framework and seeks to identify and address fast-evolving cybersecurity threats. The management of cybersecurity risks are governed by the Executive Committee and receives regular oversight from the Audit Committee as a standing item. Please see “Item 6. Directors, Senior Management and Employees” for a description of the biographies of our Executive Committee and Audit Committee members.
We have a specialized Information Security team within the wider Digital Transformation and Information Technology team of the Company, which covers the following:
•program definition and steering;
•framework, which include third-party security;
•security awareness;
•architecture and engineering;
•protection of business solutions (R&D, manufacturing and industrial solutions, business applications);
•protection of IT infrastructures;
•cybersecurity operations (such as risk-based vulnerability management); and
•detection and reactions to information security incidents, as part of the wider crisis management process.
In particular, within our Information Security team, the Cyber Security Incident Response Team monitors on a continuous basis the evolving cyber threats, and detect and analyze incidents. Based on their initial assessments, any significant risk is escalated and would, if required, trigger the activation of a Corporate Crisis Team ("CCT"). This CCT would lead the Company response (e.g. containment, forensic investigation, system restoration, and any associated business impact). The CCT would periodically inform the Executive Committee of any developments, and the Executive Committee would in-turn keep the Audit Committee and Supervisory Board informed.
In addition, we have created a third-party management function within our procurement department, with the aim to embed cybersecurity risks in the overall management of third parties.
The maturity of our overall risk framework design and implementation, which includes cybersecurity risks, is periodically audited by a leading independent organization.
Our overall risk approach is managed by our Chief Audit & Risk Executive (our "Chief Audit and Risk Executive") under the direct responsibility of our Managing Board and the oversight of our Supervisory Board. The scope of this oversight role is detailed in our Supervisory Board charter.
Corporate risk owners (members of our Senior Management) are appointed for each priority risk area to develop risk response plans, adapted to changing external conditions and enhance
monitoring capabilities. The risk response plans are regularly reviewed by our Executive Committee and periodically discussed with our Supervisory Board and Audit Committee
Corporate risk owners (members of our Senior Management) are appointed for each priority risk area to develop risk response plans, adapted to changing external conditions and enhance
monitoring capabilities. The risk response plans are regularly reviewed by our Executive Committee and periodically discussed with our Supervisory Board and Audit Committee.
Cybersecurity risk management is an integral part of the overarching risk framework and seeks to identify and address fast-evolving cybersecurity threats. The management of cybersecurity risks are governed by the Executive Committee and receives regular oversight from the Audit Committee as a standing item. Please see “Item 6. Directors, Senior Management and Employees” for a description of the biographies of our Executive Committee and Audit Committee members.
We have a specialized Information Security team within the wider Digital Transformation and Information Technology team of the Company, which covers the following:
•program definition and steering;
•framework, which include third-party security;
•security awareness;
•architecture and engineering;
•protection of business solutions (R&D, manufacturing and industrial solutions, business applications);
•protection of IT infrastructures;
•cybersecurity operations (such as risk-based vulnerability management); and
•detection and reactions to information security incidents, as part of the wider crisis management process.
In particular, within our Information Security team, the Cyber Security Incident Response Team monitors on a continuous basis the evolving cyber threats, and detect and analyze incidents. Based on their initial assessments, any significant risk is escalated and would, if required, trigger the activation of a Corporate Crisis Team ("CCT"). This CCT would lead the Company response (e.g. containment, forensic investigation, system restoration, and any associated business impact). The CCT would periodically inform the Executive Committee of any developments, and the Executive Committee would in-turn keep the Audit Committee and Supervisory Board informed.
In addition, we have created a third-party management function within our procurement department, with the aim to embed cybersecurity risks in the overall management of third parties.
The maturity of our overall risk framework design and implementation, which includes cybersecurity risks, is periodically audited by a leading independent organization.
Furthermore, we have been ISO 22301 (Security and Resilience) certified since 2016. Throughout 2024, our continuous improvements have been subjected to both internal audits and external surveillance audits from the certification body. We have also been certified ISO SAE 21434 (Road Vehicles – Cybersecurity Engineering) since 2022, confirming that we established a certified management system and governance which meets and complies with the requirements of the automotive industry in the field of cyber security process management within product development phases.
We have a specialized Information Security team within the wider Digital Transformation and Information Technology team of the Company, which covers the following:
•program definition and steering;
•framework, which include third-party security;
•security awareness;
•architecture and engineering;
•protection of business solutions (R&D, manufacturing and industrial solutions, business applications);
•protection of IT infrastructures;
•cybersecurity operations (such as risk-based vulnerability management); and
•detection and reactions to information security incidents, as part of the wider crisis management process.