Ballard Power Systems Inc.

Cybersecurity

Ballard is committed to maintaining strong security controls, including encryption, to protect our information and the information our customers and partners entrust to us. We maintain administrative, technical, and organizational security measures to protect information from loss, misuse, and unauthorized access or disclosure. These measures are based on industry security practices and take into account the sensitivity of the information we collect, the current state of technology, the cost effectiveness of implementation, and the scope of the data processing we engage in. To our knowledge, Ballard has not experienced an information security breach in the last three years.

Ballard implements and maintains a cybersecurity framework to manage cyber risk, control, and compliance-based activities. We are certified under the ISO 27001:2022 standard (International Organization for Standardization) and Ballard also maintains robust cyber insurance coverage. Ballard employees receive cybersecurity training during onboarding and on an ongoing basis.

The Audit Committee is responsible for overseeing our cybersecurity risk program and monitoring cybersecurity policies and procedures within our organization. Management briefs the Audit Committee on cybersecurity matters quarterly.