T1 Energy Inc.

Risk Management and Strategy

We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our overall risk management systems. These risks include, among other things: operational risks, encryption, intellectual property theft, fraud, extortion, harm to employees or other stakeholders, and violation of data privacy or security laws.

Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes, which includes employee training on awareness and identifying cybersecurity threats. Cybersecurity risks related to our business, technical operations, privacy, and compliance activities are identified and addressed through our risk control process and through our monthly security meetings where we address the threat landscape, including risks related to our third-party service providers. We use an external cybersecurity firm and cybersecurity experts to provide various services to supplement our internal personnel and expertise.

We have implemented a program for incident response and breach management as part of our crisis management process, and we perform tabletop exercises for cyber incidents with the crisis management team. Security events and data incidents are evaluated, ranked by severity, and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational, business, and privacy impacts.

Governance

The Audit and Risk Committee (the “ARC”) has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks. The ARC reports any findings and recommendations, as appropriate, to the full Board of Directors for consideration. Management regularly discusses cyber risks and trends and, should they arise, any material incidents with the ARC. Members of management overseeing cybersecurity threats report to our Chief Executive Officer and have experience in areas including management of information technology, data security, and cybersecurity.

As of the date of this report, the Company has not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on the organization. Although the Company has not experienced cybersecurity incidents that are individually, or in the aggregate, material, we can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition. See also the cybersecurity-related risks in Item 1A “Risk Factors.”