T1 Energy Inc.

Risk Management and Strategy

We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our overall risk management systems.

Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy, and compliance activities are identified and addressed through our risk control process and through security meetings where we address the threat landscape, including risks related to our third-party service providers. The underlying practices and controls of the cyber risk management program are based on the National Institute of Science and Technology (NIST) Cybersecurity framework (CSF). Our cybersecurity processes include automated tools and technical safeguards managed and monitored by our cybersecurity team. As part of our efforts to safeguard our systems and data, we have sought to implement industry-standard security controls, including endpoint detection and response, encryption, and multi-factor authentication. We engage external cybersecurity service providers to supplement our internal capabilities.

In the event of an incident, we intend to follow our incident response plan, which outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying functional areas, as well as senior leadership and the Audit and Risk Committee, as appropriate. Incidents are evaluated to determine materiality as well as operational, business, and privacy impacts.

Governance

The Audit and Risk Committee (the “ARC”) has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks. The ARC reports any findings and recommendations, as appropriate, to the full Board of Directors for consideration. Management regularly discusses cyber risks and trends and, should they arise, any material incidents with the ARC. Our Cybersecurity team comprises in-house personnel, supported by external managed security services providers and consultants. Our Cybersecurity team leads our technology risk management processes in coordination with senior and management-level representatives from key departments, including Finance, Legal, IT, and Operations. The cybersecurity team overseeing threats reports directly to our Chief of Staff and Senior Vice President, Engineering and Advanced Manufacturing, who in turn reports to our Chief Executive Officer. Members of our Cybersecurity team have experience in areas including management of information technology, data security, and cybersecurity. Management is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through participation in the cybersecurity risk management and strategy processes described above.

As of the date of this report, the Company has not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on the organization. Although the Company has not experienced cybersecurity incidents that are individually, or in the aggregate, material, we can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition. See also the cybersecurity-related risks in Item 1A “Risk Factors.”