What changed in this filing

/stocks — the workspaceLOADING

Item 1B. Unresolved Staff Comments

2026-03-31 compared with 2025-03-31 · 47 added, 87 removed, 15 unchanged (90% of the section changed)

2 unchanged sentences

Cybersecurity

The Company recognizes the increasing complexity and significance of cybersecurity risks in safeguarding its technology, operations, and customer data.

As an advanced electric vehicle manufacturer, the Company’s operations rely on interconnected digital infrastructure, cloud-based systems, and proprietary software platforms, making cybersecurity an essential component of its risk management framework.

The Company has implemented a comprehensive cybersecurity program designed to identify, assess, mitigate, and respond to cybersecurity risks.

This approach is informed by industry best practices, including the NIST Cybersecurity Framework (“CSF”) and Risk Management Framework (“RMF”).

The program is designed to prevent disruptions to operations, protect critical assets, and ensure compliance with applicable regulations such as the California Consumer Privacy Act (“CCPA”), the General Data Protection Regulation (“GDPR”), and the Securities and Exchange Commission (“SEC”) cybersecurity disclosure requirements.

The following disclosure outlines the Company’s cybersecurity risk management strategy, governance structure, incident response procedures, regulatory compliance efforts, and ongoing investments in cybersecurity.

Cybersecurity Risk Management

The Company employs a structured cybersecurity risk management program that aligns with NIST CSF's five core functions:

Identify, Protect, Detect, Respond, and Recover.

The approach includes:

• Risk Assessments:

Regular evaluations of cyber risks across IT infrastructure, production systems, and cloud-based platforms.

• Threat Detection and Monitoring:

Deployment of Security Information and Event Management (SIEM) tools, intrusion detection systems, and endpoint security solutions to monitor cyber threats in real-time.

• Third-Party Risk Management:

Continuous evaluation of vendors and partners who have access to the Company’s sensitive data and operational networks.

• Access Controls and Encryption:

Implementation of multi-factor authentication (MFA), data encryption protocols, and network segmentation to reduce attack vectors.

The Company integrates cybersecurity into its enterprise risk management (ERM) framework to ensure cyber threats are regularly evaluated as part of its business strategy and operational resilience efforts.

Governance and Oversight

Cybersecurity oversight is a shared responsibility between the Company’s Board of Directors, senior management, and IT security leadership.

The Board receives regular updates on cybersecurity risk exposure, incident response capabilities, and compliance efforts from management.

The Company’s Senior Cybersecurity Engineer leads the execution of cybersecurity programs, including:

• Developing and maintaining security policies.

• Conducting periodic risk assessments and audits.

• Managing incident response and recovery plans.

• Providing reports to senior executives on security trends, vulnerabilities, and ongoing mitigation efforts.

The Company recognizes the increasing complexity and significance of cybersecurity risks in safeguarding its technology, operations, proprietary systems, and data.

The Company’s operations rely on interconnected digital infrastructure, cloud-based systems, and proprietary software platforms, making cybersecurity an essential component of its risk management framework.

The Company has implemented a cybersecurity program designed to identify, assess, mitigate, and respond to cybersecurity risks.

This program is informed by recognized industry practices, including the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework (“CSF”).

The following disclosure outlines the Company’s cybersecurity risk management strategy and governance, including the Board’s oversight and management’s role.

Cybersecurity Risk Management (Risk Management and Strategy)

The Company employs a structured cybersecurity risk management program to assess, identify, and manage cybersecurity risks across its information technology environment, including corporate systems and cloud-based platforms.

Key elements of the program includes:

• Risk assessments and periodic evaluation of cybersecurity risks across systems and environments.

• Threat detection and monitoring, including alert triage and investigation, to identify suspicious activity and potential incidents.

• Vulnerability management, including scanning, prioritization, and remediation activities.

• Access controls and security protections, including multi-factor authentication, encryption protocols, and endpoint security measures where appropriate.

• Third-party risk management, including evaluation of vendors and service providers that may access Company data or systems

Cybersecurity risks are evaluated in coordination with management and are considered within the Company’s broader operational and enterprise risk considerations.

Governance and Oversight (Board Oversight and Management’s Role)

Cybersecurity oversight is a shared responsibility between the Company’s Board of Directors and management.

The Vice President, Intelligent Platform App provides cybersecurity updates to the full Board on a biannual basis, including information regarding the Company’s cybersecurity posture, risk environment, incident trends, and mitigation efforts.

In addition to scheduled updates, management’s incident response procedures require that potential material cybersecurity incidents are escalated to senior leadership and the Board promptly, as appropriate

The Company enforces a top-down approach to cybersecurity governance, ensuring accountability and continuous risk monitoring at all levels of the organization.

Management’s Role in Cybersecurity

Management plays an active role in implementing cybersecurity policies, conducting risk evaluations, and ensuring compliance with regulatory requirements.

The IT security team collaborates with third-party cybersecurity vendors, including Rapid7, Cisco, and Carbon Black, to enhance the Company’s security posture.

Management is also responsible for employee training and awareness programs, ensuring that cybersecurity is embedded in the corporate culture.

All employees complete mandatory cybersecurity training to recognize and mitigate phishing attempts, malware threats, and social engineering risks.

Management is responsible for the day-to-day execution of the Company’s cybersecurity program.

The Vice President, Intelligent Platform App oversees cybersecurity initiatives and supervises cybersecurity personnel and processes.

The Network and Information Security Engineer monitors threats, investigates alerts, and reports identified incidents to the IT Vice President through established escalation procedures.

The Company’s cybersecurity incident response governance is supported by an Incident Response Policy that defines roles and responsibilities, incident classification, documentation expectations, evidence preservation requirements, and communication protocols.

Cybersecurity Strategy and Resilience

The Company has established robust cybersecurity resilience measures to ensure that cyber incidents do not materially impact operations.

These include:

• Backup and Redundancy:

Critical business systems are backed up and replicated to prevent data loss and operational disruptions.

• Incident Containment and Recovery:

Automated security responses, real-time malware detection, and forensic analysis capabilities enable the Company to respond swiftly to threats.

• Proactive Threat Intelligence:

Continuous monitoring of emerging cyber threats and industry trends, allowing for adjustments to the security strategy.

The goal is to maintain business continuity, protect proprietary technology, and safeguard customer and employee data in the event of a cyber incident.

The Company maintains cybersecurity resilience measures designed to support business continuity and protect critical assets.

These measures include monitoring and response capabilities, as well as processes for containment, remediation, and recovery when incidents occur.

Material Cybersecurity Incidents

During the reporting period, the Company experienced a cybersecurity incident related to employee interactions with suspicious websites.

The incident was promptly contained, and a forensic investigation confirmed that no material impact occurred to operations, financial position, or customer data.

During fiscal year 2025, the Company did not experience any material cybersecurity incidents.

No cybersecurity incidents required disclosure under Form 8-K Item 1.05 during 2025.

Impact of Cyber Incidents

Cybersecurity incidents, if material, could affect the Company’s financial condition, operational stability, and reputation.

Risks include:

• Direct financial losses from remediation costs, potential ransomware payments, or legal expenses.

• Operational disruptions affecting vehicle production and supply chain logistics.

• Regulatory fines and penalties for non-compliance with data protection laws.

Reputational damage impacting customer trust and investor confidence.

The Company regularly assesses its financial exposure to cybersecurity risks and has contingency plans in place to mitigate these impacts.

Cybersecurity incidents, if material, could adversely affect the Company’s financial condition, results of operations, operational stability, and reputation.

Potential impacts may include remediation costs, operational disruptions, litigation or regulatory exposure, and reputational harm.

The Company evaluates cybersecurity risks as part of its ongoing risk assessment processes.

Board Expertise in Cybersecurity

N o Board members currently hold formal cybersecurity certifications or direct experience in cybersecurity risk management.

The Company continues to enhance Board education on cybersecurity trends and governance practices.

Use of Third-Party Services

The Company partners with third-party cybersecurity firms to support penetration testing, threat monitoring, and risk assessments.

Vendors are required to adhere to stringent security controls to minimize risks associated with third-party data access.

The Company has implemented a Third-Party Risk Management (“TPRM”) framework that evaluates cybersecurity controls in vendor contracts, ensuring compliance with security policies.

The Board’s cybersecurity oversight is informed through management briefings and periodic updates.

The Company may enhance Board education on cybersecurity trends and governance practices as appropriate.

Use of Third-Party Services (Third-Party Risk)

The Company uses third-party service providers to support certain technology and security functions.

The Company evaluates third-party cybersecurity risks through vendor due diligence processes, including review of security documentation and reports where applicable, and monitors third-party risks on an ongoing basis.

Regulatory and Legal Compliance Risks

The Company is subject to global cybersecurity regulations, including:

• SEC cybersecurity disclosure requirements for material incidents and risk management.

• Data privacy laws such as CCPA (California Consumer Privacy Act) and GDPR (General Data Protection Regulation).

• Automotive cybersecurity standards for protecting connected vehicle systems.

Failure to comply with cybersecurity regulations could result in financial penalties, legal liabilities, and reputational harm.

The Company conducts regular compliance reviews to ensure alignment with evolving regulatory requirements.

The Company is subject to cybersecurity and data privacy requirements, including applicable data privacy laws and SEC disclosure requirements.

Failure to comply with applicable requirements could result in financial penalties, legal liabilities, and reputational harm.

The Company performs compliance-focused activities as part of its cybersecurity program.

Incident Response Plan

The Company maintains a formalized incident response plan, which includes:

• 24/7 monitoring for cybersecurity threats.

• Real-time threat detection and forensic investigation tools.

• Collaboration with third-party security firms for penetration testing.

This plan ensures that cyber threats are identified, contained, and mitigated efficiently.

Cyber Insurance and Risk Transfer

The Company maintains cyber insurance coverage to mitigate financial risks associated with cybersecurity incidents.

This insurance covers:

• Incident response and recovery costs.

• Legal fees and regulatory penalties.

• Business interruption expenses.

The risk management team regularly evaluates the adequacy of coverage based on evolving cyber threats.

The Company maintains an incident response policy framework intended to support timely identification, containment, investigation, remediation, and recovery.

Incident response procedures include incident severity classification, escalation, documentation, evidence preservation, and communications protocols.

Cyber Insurance

The Company does not maintain standalone cybersecurity insurance coverage.

The Company evaluates risk mitigation and risk transfer options as part of its broader risk management considerations.

Historical Cyber Incidents

No material cybersecurity incidents were recorded in prior reporting periods.

The Company did not record any material cybersecurity incidents during fiscal year 2025.

Technology and Infrastructure Risks

The Company has implemented:

• Real-time AI-driven security analytics.

• Multi-layered encryption and cloud security protections.

• Strict endpoint security measures across all corporate devices.

The Company’s cybersecurity program includes measures intended to protect systems and data, including monitoring, endpoint protections, access controls, and vulnerability management.

As cybersecurity threats continue to evolve, the Company may adjust its cybersecurity tools, processes, and controls over time.

Data Security and Privacy Policies

The Company enforces strict data security policies, including:

• Encryption protocols for sensitive data.

• Access controls and multi-factor authentication.

• Regular security audits to verify compliance.

The Company maintains policies and controls intended to protect sensitive data, including access controls and other security measures designed to safeguard data confidentiality and integrity.

Ongoing Cybersecurity Efforts

The Company continues to invest in:

• Security infrastructure upgrades.

• Cyber awareness training for employees.

• Continuous improvement of risk assessment frameworks.

This structured cybersecurity program ensures compliance with SEC disclosure requirements and supports the Company’s commitment to protecting its assets, customers, and employees from evolving cyber threats.

The Company continues to invest in cybersecurity capabilities, including monitoring, vulnerability management, employee awareness training, and improvements to policies and procedures, to address evolving cybersecurity threats.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1B. Unresolved Staff Comments