Baker Hughes Company (BKR) Risk Analysis

The technical complexities of our operations expose us to a wide range of significant health, safety and environmental risks and we are from time to time subject to litigation in the U.S. and in foreign countries, for example claims involving services or equipment such as personal injury or loss of life, product failure (including as a result of a cyber-attack) or damage to or destruction of property, employment and labor, customer privacy, or regulatory risks. While we have insurance coverage against operating hazards to the extent deemed prudent by our management and to the extent insurance is available, our insurance may not cover all expenses related to litigation claims arising from our business. Moreover, we may not be able to maintain insurance at levels of risk coverage or policy limits that we deem adequate. We may therefore incur significant expenses defending any such suit or government charge and may be required to pay amounts or otherwise change our operations in ways that could adversely affect our financial condition, results of operations and cash flows.

We are subject to changes in tax laws, rates, treaties, and regulations in the various jurisdictions where we operate, any of which, including in the interpretation thereof, could have a material adverse impact on our tax expense, results of operations and cash flows. Further, the examinations and subsequent tax assessments by various tax authorities could increase our tax liabilities. Any changes to tax laws or rates or unfavorable positions taken by tax authorities have and could preclude our ability to fully utilize tax loss carryforwards and tax credits which could increase the amount of valuation allowances required against deferred tax assets and could adversely affect our financial condition, results of operations and cash flows. On July 4, 2025, the One Big Beautiful Bill Act ("OBBBA") was enacted, introducing broad changes to the U.S. tax code, including modifications to federal income tax provisions. The legislation has multiple effective dates, with certain provisions effective in 2025 and others taking effect in later years. The aggregate impact of the OBBBA remains uncertain. We will continue to monitor future developments, including regulatory guidance and interpretations, which could have a material impact on our business, financial condition and results of operations. In addition, we are subject to changes to the U.S. and foreign country tariffs, international trade agreements and policies. This includes proposed and enacted tariffs by the U.S. and foreign governments. Expansion of trade restrictions, changes to government policies related to tariffs or trade agreements could adversely affect our financial condition, results of operations and cash flows.

We operate in a highly competitive environment for marketing our products and services and securing equipment across our portfolio. Our ability to continually provide competitive products and services can impact our ability to defend, maintain or increase prices for our products and services, maintain market share, and negotiate acceptable contract terms with our customers. In order to be competitive, we must provide new and differentiating technologies, reliable products and services that perform as expected and that create value for our customers. We continue to invest in new technologies, equipment, and facilities and to expand our capabilities and technology portfolio to meet the challenges of a net-zero future. These efforts include expanding into new energy areas such as geothermal and CCUS, strengthening our digital architecture and addressing key energy market themes. Our ability to defend, maintain or increase prices for our products and services is in part dependent on the industry's capacity relative to customer demand, on our ability to differentiate the value delivered by our products and services from our competitors' products and services and to provide innovative and competitive products and services to meet our client's evolving needs with respect to new energy areas. Managing development of competitive technology and new product introductions on a forecasted schedule and at a forecasted cost can impact our financial results. If we are unable to continue to develop and produce competitive and innovative technology or deliver it to our clients in a timely and cost-competitive manner in response to changes in the market, customer requirements, competitive pressures, or if competing technology accelerates the obsolescence of any of our products or services, any competitive advantage that we may hold, and in turn, our business, financial condition, results of operations and cash flows could be materially and adversely affected. We have, and may in the future enter into, agreements with third parties to jointly develop certain technologies which may include financial or other commitments. Under the terms of these agreements, we may agree to share in the associated development and marketing costs for the developed technologies. There can be no assurances that we will be able to successfully develop these technologies in collaboration with these third parties that will adequately meet our customers' needs. Also, there can be no assurances that these joint development agreements will be commercially viable, successful or profitable. As a result, these joint development agreements could have a material adverse effect on our financial condition, results of operations and cash flows.

In the course of conducting our business, we may hold or have access to sensitive, confidential, proprietary or personal data or information belonging to us, our employees or third parties, including customers, collaborators or suppliers. Increased cybersecurity vulnerabilities and threats, and more sophisticated and targeted cyber-attacks and other security incidents, pose risks to our and our customers', collaborators', suppliers' and third-party service providers' systems, data, and business, and the confidentiality, availability, and integrity of our data, as well as the data of our employees, customers, suppliers, and other third-party business partners. We utilize various procedures and controls to monitor and mitigate our exposure including maintaining a dedicated Cyber Fusion Center ("CFC") and engaging third-party experts. For more information see the "Risk Management & Strategy" section of Part 1 of Item 1C herein. While we attempt to mitigate these risks, we remain vulnerable to cyber-attacks and other security incidents, including ransomware incidents. Given our global footprint, the large number of customers, partners, suppliers and service providers with which we do business, and the increasing sophistication and complexity of cyber-attacks, including, without limitation, due to the application of generative AI, an incident could occur and persist for an extended period without detection. Any investigation of a cyber-attack or other security incident would be inherently unpredictable, and it would take time before the completion of any investigation and the availability of full and reliable information. During such time we would not necessarily know the extent of the harm or how best to remediate it, and certain errors or actions could be repeated or compounded before they are discovered and remediated, all or any of which would further increase the costs and consequences of such an incident. We may be required to expend significant resources to protect against, respond to, and recover from any cyber-attacks and other security incidents. As cyber-attacks continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities. In addition, our remediation efforts may not be successful, or the impacts may be irreversible. The inability to implement, maintain and upgrade adequate safeguards could materially and adversely affect our financial condition, results of operations and cash flows. In addition to our own systems, we use third-party service providers, who in turn may also use third-party providers, to process certain data or information on our behalf. Due to applicable laws and regulations or contractual obligations, we may be held responsible for cybersecurity incidents attributed to our service providers or other third parties to the extent affecting information we share with them. Although we contractually require these third parties to implement and maintain reasonable security measures, we cannot control third parties and cannot guarantee that a security breach will not occur in their systems. Our digital technologies and services, as well as third-party products, services and technologies on which we rely (including emerging technologies, such as AI programs), are subject to the risk of cyberattacks. Despite our and our service providers' efforts to protect our data and information, there can be no assurance that the systems we have designed to prevent or limit the effects of cyber incidents or attacks will be sufficient to prevent or detect material consequences arising from such incidents or attacks, or to avoid a material adverse impact on our systems after such incidents or attacks occur. In the normal conduct of our business, we, our customers, and our service providers have been and may in the future be vulnerable to security breaches, ransomware attacks, theft, misplaced or lost data, programming errors, phishing attacks, denial of service attacks, acts of vandalism, computer viruses, malware, employee errors and/or malfeasance or similar events, including those perpetrated by criminals or nation-state actors, that could potentially lead to the compromise, unauthorized access, use, disclosure, modification or destruction of data or information, improper use of our systems, defective products, loss of access to our data, production downtimes and operational disruptions; and, given the nature of such attacks, some incidents may remain undetected for a period of time despite efforts to detect and respond to them in a timely manner. In addition, a cyber-attack or any other significant compromise or breach of our data security, media reports about such an incident, whether accurate or not, or, under certain circumstances, our failure to make adequate or timely disclosures to the public, governmental entities, law enforcement agencies or affected individuals following any such event, whether due to delayed discovery or a failure to follow existing protocols, could adversely impact our operating results and result in other negative consequences, including damage to our reputation or competitiveness, harm to our relationships with customers, collaborators, suppliers and other third parties, distraction to our management, remediation or increased protection costs, significant litigation or regulatory action, fines and penalties. Cyberattacks are expected to accelerate on a global basis in both frequency and magnitude as threat actors become increasingly sophisticated in techniques and tools (including AI) that circumvent controls, evade detection and even remove forensic evidence of the infiltration. Given the increased prevalence of customer-imposed connectivity, cybersecurity controls and other related contractual obligations towards customers or other third parties, there are an increased number of attack vectors and a cyber-attack or other security incident also could result in breach of contract or indemnity claims against us by customers or other counterparties. While we currently maintain cybersecurity insurance, such insurance may not be sufficient in type or amount to cover us against claims related to cybersecurity breaches or attacks, failures or other data security-related incidents, and we cannot be certain that cyber insurance will continue to be available to us on economically reasonable terms, or at all, or that an insurer will not deny coverage as to any future claim. The successful assertion of one or more large claims against us that exceed available insurance coverage, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could materially and adversely affect our financial condition, results of operations and cash flows.

AI, machine learning, data science and similar technologies, including third-party AI tools, may be enabled by, or integrated into, some of our business processes and solutions. As with many developing technologies, AI presents risks and challenges that could affect its further development, adoption, and use, and therefore our business. AI algorithms may be flawed or biased. Datasets used to train or develop AI systems may be insufficient, of inferior quality, or contain biased, incorrect or incomplete information. The utilization of AI may increase our risk and liability exposure relating to confidentiality, intellectual property infringement, and client use restrictions. Our AI governance review process and safeguards may not be adequate to protect against these risks and challenges. Additionally, the laws and regulations concerning the use of AI continue to evolve. If the use or integration of AI systems, or the outputs generated by such systems, were determined to be non-compliant (e.g., in relation to AI statutory regimes, data privacy rights or in relation to the use of AI for certain activities or use cases), this may expose us to regulatory action or litigation. It is possible that emerging regulations or changes to intellectual property laws may limit or block the use of AI in our business or otherwise impose restrictions that may adversely affect the efficiency of our business processes or solutions that were utilizing AI technologies. Our competitors or other third parties may incorporate AI into their product and service offerings more quickly or more successfully than us, which could impair our ability to compete effectively and adversely affect our business, financial condition and results of operations.

Geopolitical and terrorism threats continue to grow in a number of key countries where we currently or may in the future do business. Geopolitical and terrorism threats, including armed conflict among countries, have led to, among other things, a loss of our investment in the country, adverse impact to our employees, and impairment of our or our customers' ability to conduct operations. Further, the broader consequences of geopolitical and terrorism threats, which may include further sanctions that prohibit our ability to do business in specific countries, embargoes, supply chain disruptions, the potential inability to service our remaining performance obligations and potential contractual breaches and litigation, regional instability and geopolitical shifts, and the extent of any such threats effect on our business and results of operations as well as the global economy, cannot be predicted. Certain geopolitical conflicts, such as between Russia and Ukraine, and instability, such as in the Middle East and the current political situation in Venezuela, have had and may continue to have the effect of heightening many other risks disclosed in our public filings, any of which could materially and adversely affect our business and results of operations. Such risks include, but are not limited to, adverse effects on regional and global macroeconomic conditions; increased volatility in the price and demand of oil and natural gas, increased exposure to cyber-attacks; limitations in our ability to implement and execute our business strategy; risks to employees and contractors that we have in the region; disruptions in global supply chains; exposure to foreign currency fluctuations; potential nationalizations and assets seizures; constraints or disruption in the capital markets and our sources of liquidity; our potential inability to service our remaining performance obligations and potential contractual breaches and litigation. Any such risks may require us to record asset impairments and experience adverse operating impacts which could have a material adverse effect on our financial condition, results of operations and cash flows.

Fluctuations or devaluations in foreign currencies relative to the U.S. dollar can impact our revenue and our costs of doing business and create volatility, as well as the costs of doing business of our customers.