Enbridge (ENB) Risk Analysis

We are subject to numerous legal proceedings related to our business and operations, which could include climate-related regulatory action and litigation against companies in the energy industry. There is no assurance that we will not be impacted by such regulatory action, litigation, or other legal proceedings. By its nature, litigation is subject to many uncertainties, and we cannot predict the outcome of individual matters with assurance. It is reasonably possible that the final resolution of some of the matters in which we are involved or new matters could require additional expenditures, in excess of established reserves, over an extended period of time and in a range of amounts that could adversely affect our financial results or adversely affect our reputation. Refer to Part II. Item 7. Management's Discussion and Analysis of Financial Condition and Results of Operations - Legal and Other Updates for a discussion of certain legal proceedings with recent developments.

We are subject to taxes in the US, Canada and numerous foreign jurisdictions. Economic and political conditions may cause tax rates in various jurisdictions to change significantly. Our effective tax rates may be affected by changes in the mix of earnings in countries with differing statutory tax rates, adjustments to the valuation of deferred tax assets and liabilities, or changes in tax laws or their interpretation. We are also subject to the examination of our tax returns and other tax matters by the US Internal Revenue Service, the Canada Revenue Agency, and other tax authorities and governmental bodies. We regularly evaluate the likelihood of adverse outcomes resulting from these examinations to determine the adequacy of our provision for taxes. There can be no assurance as to the outcome of these examinations. If our effective tax rates were to increase, particularly in the US or Canada, or if the ultimate determination of our taxes owed is for an amount in excess of amounts previously accrued, our financial condition and operating results could be materially adversely affected.

Our business is dependent upon information systems and other digital technologies to control our plants, pipelines and other assets, process transactions, and summarize and report results of operations. Cybersecurity risks have grown due to the proliferation of new technologies, increasingly sophisticated cyber attacks, and financially-motivated cybercrime, as well as international and domestic political factors, including geopolitical tensions, armed conflicts, civil unrest, sabotage, terrorism, and state-sponsored or other cyber espionage. Human error or malfeasance can also contribute to cyber incidents, which may occur internally or externally and at any point in our supply chain. Because of the critical nature of our infrastructure and our use of information systems and other digital technologies to control our assets, we face a heightened risk of cybersecurity incidents, such as ransomware, theft, misplaced or lost data, programming errors, phishing attacks, denial-of-service attacks, acts of vandalism, computer viruses, malware, hacking, malicious attacks, software vulnerabilities, employee errors and/or malfeasance, or other attacks, security or data breaches, or other cybersecurity incidents. Cyber threat actors have attacked, and continue to threaten to attack, energy infrastructure, including our assets. Government agencies have warned that attacks targeting critical infrastructure - including pipelines, utilities, and power generation facilities - are increasing in sophistication, magnitude, and frequency. These risks may escalate during periods of heightened geopolitical tensions. We have experienced an increase in unauthorized attempts to access our systems and company data, and expect this trend to continue. While we invest heavily in security measures to prevent unwanted intrusions and to protect our systems and data, whether such data is housed internally or by external third parties, we and our third-party vendors have experienced, and expect to continue to experience, cyber attacks of varying degrees, including denial-of-service attacks. To date, these attacks have not, to our knowledge, had a material adverse impact on our business, operations or financial results, but future incidents could. We expect that our technology systems, as well as those of our vendors or other service providers, will continue to be targeted, which could compromise our data and systems, and access thereto by us, our customers or others. Such events could disrupt our operations, impair our ability to correctly record, process and report transactions, or result in the loss of information. There is no certainty that our business continuity measures will completely eliminate the risk of disruption or adverse business effects. Furthermore, we and some of our third-party service providers (who may in turn also use third-party service providers) collect, process or store sensitive data in the ordinary course of our business, including personal information of employees, customers, landowners, and investors, as well as intellectual property or other proprietary business information. These risks are heightened following the Acquisitions, which increase the attack surface and the volume of personal customer information processed. Consequences of a significant cyber incident could include revenue loss, repair, remediation or restoration costs, regulatory action, fines and penalties, litigation, breach of contract or indemnity claims, cyber extortion or ransomware payments, implementation costs for additional security measures, loss of customers, customer dissatisfaction, reputational harm, or other adverse consequences, costs or financial loss. Regardless of the method or form of cyber attack or incident, any or all of the above could materially adversely affect our reputation, business, operations or financial results. New and changing cybersecurity legislation, regulations and orders have been implemented or are proposed, resulting in additional regulatory oversight and compliance requirements, which require internal and external resources and increase costs. The potential impacts of future cybersecurity-related legislation, regulations or orders on our business remain uncertain and cannot be reliably predicted. A cyber attack may occur and remain undetected for an extended period, representing an inherent risk that we must continually manage. Investigations of cyber attacks or other security incidents are often unpredictable and typically take time to complete before full and reliable information becomes available. In this period, we may lack visibility into the damage or the optimal corrective approach, allowing issues to persist or escalate and driving up both costs and risks. Remediation efforts may not be successful. Failure to implement, maintain and upgrade adequate safeguards could materially and adversely affect our results of operations, cash flows, and financial condition. Recent rulemakings may require disclosure of cybersecurity incidents before investigations or remediations are complete, adding complexity and risk. As cyber attacks continue to evolve, we may need to invest significant additional resources to strengthen protections and address vulnerabilities. Media reports about a cyber attack or other significant security incident, whether accurate or not, or our failure to make adequate or timely disclosures to the public, regulators, law enforcement, or affected individuals could negatively impact our operating results and result in other adverse consequences, including reputational harm, damage to our competitiveness, strained relationships with customers, partners, suppliers, investors, and other stakeholders. Such circumstances could also lead to operational disruption, increased remediation and protection costs, significant litigation or regulatory action, fines or penalties, all of which could materially adversely affect our business, operations, reputation or financial results.

Competition in all of our businesses, including competition for new project development opportunities, could have a negative impact on our business, financial condition or results of operations. Our Liquids Pipelines business faces competition from existing and proposed pipelines serving Canadian, US and international markets, including those that may advance through inter-provincial and federal agreements or collaboration. Key competitive factors include transportation costs, access to supply, service quality and reliability, contract carrier alternatives, and proximity to markets. Commodities transported in our pipelines increasingly compete with emerging alternatives for end-users, such as electricity and electric batteries. We also compete with alternative storage facilities. Our Gas Transmission business competes with similar facilities that serve the same supply and market areas. Natural gas also competes with other energy sources, including electricity, coal, propane, fuel oils, and renewables. Our Gas Distribution and Storage business competes with other forms of energy available to customers and end-users, including electricity, coal, propane and fuel oils. Our Renewable Power Generation business faces competition in securing long-term power purchase agreements and from other fuel sources in the markets in which we operate.

We are exposed to the credit risk of multiple parties in the ordinary course of our business. Generally, our customers are rated investment-grade, are otherwise considered creditworthy, or provide us with security to satisfy credit concerns. However, we cannot predict to what extent our business would be impacted by deteriorating economic conditions, including possible declines in the creditworthiness of our customers, vendors, or counterparties. Payment or performance defaults from these entities, if significant, could adversely affect our earnings and cash flows.

Energy companies, including Enbridge, continue to face negative perceptions about fossil fuels and pipelines, which can lead to stakeholder opposition to our operations and infrastructure projects, as well as investor, stakeholder or regulatory concerns about stranded assets. Such factors may impact our ability to secure capital or complete new projects. Enbridge's climate-related activities, goals, commitments, and plans are based on various assumptions, estimates, judgments, risks, and uncertainties. Rules, standards, and methodologies for setting climate-related goals and for measuring and reporting climate-related information are still developing. As such, our climate-related goals and disclosures are based on assumptions that are subject to change. Achieving our sustainability-related goals and commitments will require collective efforts and actions from a wide range of stakeholders, much of which is beyond our control, and there can be no assurance that these efforts will deliver the intended impact. Our climate-related goals and emissions-reduction pathways will continue to evolve and may need to be revised as data improves, standards, methodologies, metrics, and measurements mature, and legislation, regulations, and stakeholder expectations change. If we encounter challenges or perceived challenges in achieving our climate-related goals, fail to comply with climate-related regulatory or reporting requirements, or fall short of stakeholder expectations, it could negatively impact our reputation, reduce demand for our services or securities, and expose us to enforcement actions or litigation, which could impact our business, operations or financial results.