EOG Resources (EOG) Risk Analysis

New or revised rules, regulations and policies may be issued, and new legislation may be enacted, that could impact the oil and gas exploration and production industry. Such rules, regulations, policies and legislation may affect, among other things, (i) permitting for oil and gas drilling on state, tribal and federal lands, (ii) the leasing of state, tribal and federal lands for oil and gas development, (iii) the regulation and disclosure of greenhouse gas (GHG) emissions and/or other climate change-related matters associated with oil and gas operations, (iv) the use of hydraulic fracturing on state, tribal and federal lands, (v) the calculation of royalty payments in respect of oil and gas production from state, tribal and federal lands (including, but not limited to, applicable royalty percentages), (vi) U.S. federal income tax laws applicable to oil and gas exploration and production companies and (vii) the use of financial derivative instruments to hedge the financial impact of fluctuations in crude oil, NGLs and natural gas prices. Further, such regulatory, legislative and policy changes may, among other things, result in additional permitting and disclosure requirements, additional operating restrictions and/or the imposition of various conditions and restrictions on drilling and completions operations or other aspects of our business, any of which could lead to operational delays, increased operating and compliance costs and/or other impacts on our business and operations and could materially and adversely affect our business, results of operations, financial condition and capital expenditures. For related discussion, see the below risk factors regarding legislative and regulatory matters impacting the oil and gas exploration and production industry and the discussion in ITEM 1, Business - Regulation.

From time to time, legislation has been proposed that, if enacted into law, would make significant changes to U.S. federal and state income tax laws, including laws specifically applicable to crude oil and natural gas exploration and production companies - such as eliminating the immediate deduction for intangible drilling and development costs. No accurate prediction can be made as to whether any such legislative changes or similar or other tax law changes will be proposed or enacted. Further, no accurate prediction can be made as to what the specific provisions or impact on EOG of any such enacted legislation would be. In addition, certain countries, including countries where EOG currently has operations or may in the future have operations, have implemented (via legislation), or may implement, a global minimum tax (GMT). While such GMT legislation has had, to date, no material impact on EOG, no accurate prediction can be made as to (i) which additional countries or jurisdictions will participate and enact GMT legislation and (ii) what the impact on EOG of any such enacted GMT legislation would be. Recent changes to the GMT rules would exempt U.S. multinationals (like EOG) from certain of its provisions after 2025, if ultimately legislated into law in the countries where EOG has current or may have future operations. The elimination or postponement of certain U.S. federal income tax deductions currently available to crude oil and natural gas exploration and production companies, as well as any other changes to, or the imposition of new, U.S. federal, state, local or non-U.S. (i.e., foreign) taxes (including the imposition of, or increases in, production, severance or similar taxes or the enactment of a GMT or similar tax), could materially and adversely affect our business, cash flows, results of operations and financial condition. In addition, legislation may be proposed with respect to the enactment of a tax levied on the carbon content of fuels based on the GHG emissions associated with such fuels. A carbon tax, whether imposed on producers or consumers, would generally increase the prices for crude oil, NGLs and natural gas. Such price increases may, in turn, reduce demand for crude oil, NGLs and natural gas and materially and adversely affect our cash flows, results of operations and financial condition. We are unable to predict the timing, scope and effect of any proposed or enacted tax law changes, but any such changes (if enacted) may materially and adversely affect our business. We will continue to monitor and assess any proposed or enacted tax law changes to determine the impact on our business, cash flows, results of operations and financial condition and take appropriate actions, where necessary.

We have undertaken (and continue to undertake) initiatives to increase our drilling, completions and operating efficiencies and improve the performance of our wells. Such initiatives include (among others): (i) our downhole drilling motor program; (ii) enhanced techniques for completing our wells; (iii) drilling extended laterals; and (iv) our self-sourced sand program. In addition, from time to time (when available and advantageous), we enter into agreements with service providers to secure the costs and availability of certain drilling and completions services we utilize as part of our operations. We plan to continue these initiatives and actions. However, such efforts may not be successful or may not be sufficient to offset the impacts of any future inflationary pressures (such as from tariffs, other trade barriers or other macroeconomic factors) on our operating costs and capital expenditures and, in turn, on our cash flows and results of operations. For additional discussion, see ITEM 7, Management's Discussion and Analysis of Financial Condition and Results of Operations – Overview – Recent Developments.

Our operations in jurisdictions outside the U.S. are subject to various risks inherent in foreign operations. These risks include, among other risks: - increases in taxes and governmental royalties;- additional and potentially unfamiliar laws and policies governing the operations of foreign-based companies and changes in such laws and policies;- loss of revenue, loss of or damage to equipment, property and other assets and interruption of operations as a result of expropriation, nationalization, acts of terrorism, war, civil unrest and other political risks;- unilateral or forced renegotiation, modification or nullification of existing contracts with governmental entities;- difficulties enforcing our rights against a governmental agency because of the doctrine of sovereign immunity and foreign sovereignty over international operations;- competition from companies that have established strategic long-term positions or have strong governmental relationships in the foreign jurisdictions in which we operate; and - currency restrictions and exchange rate fluctuations. Our international operations may also be adversely affected by U.S. laws and policies affecting foreign trade and taxation, including tariffs and trade or other economic sanctions; modifications to, or withdrawal from, international trade treaties; and U.S. laws with respect to participation in boycotts that are not supported by the U.S. government. The realization of any of these factors could materially and adversely affect our business, financial condition and results of operations.

We compete with major integrated oil and gas companies, government-affiliated oil and gas companies and other independent oil and gas companies for the acquisition of licenses, concessions and leases, properties and reserves and access to the facilities, equipment, materials, services and employees and other personnel (including geologists, geophysicists, engineers and other specialists) necessary to explore for, develop, produce, market and transport crude oil, NGLs and natural gas. Certain of our competitors have financial and other resources substantially greater than those we possess and have established strategic long-term positions or strong governmental relationships in countries or areas in which we may seek new or expanded entry. As a consequence, we may be at a competitive disadvantage in certain respects, such as in bidding for drilling rights or in accessing and retaining necessary services, facilities, equipment, materials and personnel. In addition, our larger competitors may have a competitive advantage when responding to factors that affect demand for crude oil, NGLs and natural gas, such as changing worldwide prices and levels of production and the cost and availability of alternative fuels. We also face competition from alternative energy sources, such as renewable energy sources.

As an oil and gas producer, we face various security threats, including (i) cyber threats to gain unauthorized access to, or control of, our sensitive information or to render our data or systems corrupted or unusable; (ii) threats to the security of our facilities and infrastructure or to the security of third-party facilities and infrastructure, such as gathering, transportation, processing, fractionation, refining, liquefaction and export facilities; and (iii) threats from terrorist acts. The potential for such security threats has subjected our operations to increased risks that could have a material and adverse effect on our business. We rely extensively on information technology systems, including internally developed software, data hosting platforms, real-time data acquisition systems, third-party software, cloud services and other internally or externally hosted hardware and software platforms, to (i) estimate our oil and gas reserves, (ii) process and record financial and operating data, (iii) process and analyze all stages of our business operations, including exploration, drilling, completions, production, gathering and processing, transportation, pipelines and other related activities and (iv) communicate with, and make payments to, our employees and vendors, suppliers and other third parties. Further, our reliance on technology has increased due to the increased use of personal devices and remote communications. Although we have implemented and invested in, and will continue to implement and invest in, controls, procedures and protections (including internal and external personnel) that are designed to protect our systems, identify and remediate on a regular basis vulnerabilities in our systems and related infrastructure and monitor and mitigate the risk of data loss and other cyber threats, such measures cannot entirely eliminate cyber threats and the controls, procedures and protections we have implemented and invested in may prove to be ineffective. Our systems and networks, and those of our business associates, may become the target of cyber attacks, including, without limitation, denial-of-service attacks; malicious software; data privacy breaches by employees, insiders or others with authorized access; phishing attacks; ransomware; attempts to gain unauthorized access to our data and systems; and other electronic security breaches. Security incidents can also occur as a result of non-technical issues, such as physical theft. More recently, advancements in artificial intelligence (AI) may pose serious risks for many of the traditional tools used to identify individuals, including voice recognition (whether by machine or the human ear), facial recognition or screening questions to confirm identities. In addition, generative AI systems may also be used by malicious actors to create more sophisticated cyber attacks (i.e., more realistic phishing or other attacks). The advancements in AI could also lead to an increase in the frequency of identity fraud or cyber attacks (whether successful or unsuccessful), which could cause us to incur increasing costs, including costs to deploy additional personnel, protection technologies and policies and procedures, train employees, and engage third-party experts and consultants. If any of these security breaches were to occur, we could suffer disruptions to our normal operations, including our drilling, completion, production and corporate functions, which could materially and adversely affect us in a variety of ways, including, but not limited to, the following: - unauthorized access to, and release of, our business data, reserves information, strategic information or other sensitive or proprietary information, which could have a material and adverse effect on our ability to compete for oil and gas resources, or reduce our competitive advantage over other companies;- data corruption, communication interruption, or other operational disruptions during our drilling activities, which could result in our failure to reach the intended target or a drilling incident;- data corruption or operational disruptions of our production-related infrastructure, which could result in loss of production or accidental discharges;- unauthorized access to, and release of, personal information of our royalty owners, employees and vendors, which could expose us to allegations that we did not sufficiently protect such information;- a cyber attack on a vendor or service provider, which could result in supply chain disruptions and could delay or halt our operations;- a cyber attack on third-party gathering, transportation, processing, fractionation, refining, liquefaction or export facilities, which could result in reduced demand for our production or delay or prevent us from transporting and marketing our production, in either case resulting in a loss of revenues;- a cyber attack involving commodities exchanges or financial institutions could slow or halt commodities trading, thus preventing us from marketing our production or engaging in hedging activities, resulting in a loss of revenues;- a deliberate corruption of our financial or operating data could result in events of non-compliance which could then lead to regulatory fines or penalties;- a cyber attack on a communications network or power grid, which could cause operational disruptions resulting in a loss of revenues; and - a cyber attack on our automated and surveillance systems, which could cause a loss of production and potential environmental hazards. Further, strategic targets, such as energy-related assets, may be at a greater risk of terrorist attacks or cyber attacks than other targets in the United States. Moreover, external digital technologies control nearly all of the crude oil and natural gas distribution systems in the U.S. and abroad, which are necessary to transport and market our production. A cyber attack directed at, for example, crude oil, NGLs and natural gas distribution systems could (i) damage critical distribution and storage assets or the environment; (ii) disrupt energy supplies and markets, by delaying or preventing delivery of production to markets; and (iii) make it difficult or impossible to accurately account for production and settle transactions. Any such terrorist attack or cyber attack that affects us, our customers, suppliers, or others with whom we do business and/or energy-related assets could have a material adverse effect on our business, including disruption of our operations, damage to our reputation, a loss of counterparty trust, reimbursement or other costs, increased compliance costs, significant litigation exposure and legal liability or regulatory fines, penalties or intervention. Although we have business continuity plans in place, our operations may be adversely affected by significant and widespread disruption to our systems and the infrastructure that supports our business. While we continue to evolve and modify our business continuity plans as well as our cyber threat detection and mitigation systems, there can be no assurance that they will be effective in avoiding disruption and business impacts. Further, our insurance may not be adequate to compensate us for all resulting losses, and the cost to obtain adequate coverage may increase for us in the future and some insurance coverage may become more difficult to obtain, if available at all. While we have experienced limited cyber incidents in the past, we have not had, to date, any business interruptions or material losses from breaches of our information technology systems and related infrastructure. However, there is no assurance that we will not suffer any such interruptions or losses in the future. Further, as technologies evolve and cyber threats become more sophisticated, we are continually expending additional resources to modify or enhance our security measures to protect against such threats and to identify and remediate on a regular basis any vulnerabilities in our information systems and related infrastructure that may be detected, and these expenditures in the future may be significant. Additionally, the continuing and evolving threat of cyber attacks has resulted in evolving legal and compliance matters, including increased regulatory focus on prevention and new disclosure requirements recently enacted by the SEC with respect to material cyber incidents and cyber risk management, strategy and governance, which could require us to expend significant additional resources to meet such requirements.