Company: PLSAY
Filing Date: 2025-05-09
Form Type: 20-F
Source: 0001884082-25-000012
Chunk: 303

Company: Polestar Automotive Holding UK PLC
Filing Date: 2025-05-09
Form: 20-F
Item: Item 16K
Chunk 303
---
Item 16K. Cybersecurity

Cybersecurity Risk Management

Due to the increasing regulatory requirements and importance of cybersecurity to our business, we are continuously improving our risk management frameworks and process to align them with the Company's large enterprise risk management program to identify, assess, and mitigate risks throughout our business.

As a part of our overall enterprise risk management, Polestar management and the board of directors regularly engage in the cybersecurity risk management process which is scoped to include the company’s daily operations, along with Volvo Cars' IT systems and any third-party service providers with access to sensitive and/or proprietary information. We then take that information and prioritize cybersecurity risks for mitigation. Additionally, we consider cybersecurity risks when assessing third-party vendors. We include security requirements in many of our contractual arrangements with third-party vendors. We also conduct periodic reviews of security compliance reports of certain of our critical vendors.

Our Security Team retains cybersecurity professionals and industry experts to provide general risk management support. Additionally, our Security Team has contracted a managed security service provider (“ MSSP”) to provide security monitoring ("SOC") on a 24/7/365 basis. The security solutions cover both enterprise (business) as well as our vehicle fleet. The SOC follows agreed upon procedures to monitor, address, and escalate cybersecurity incidents that may arise. To safeguard personal data or confidential or proprietary data that the SOC can access, we created information security policies and procedures based on a strategic security-policy, topical information security directives and operational guidelines for employees and third-party providers.

During the last fiscal year, we have not experienced any material cybersecurity incidents. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We cannot assure that our cybersecurity risk management system and measures, including our policies, directives or operational guidelines, will be fully implemented, complied with, or effective in protecting our systems and information.

Given the current general high threat level of cyber security threats and challenges in the automotive marketplace and Polestar's reliance on its and Volvo Cars' IT systems and third-party vendors, Polestar faces risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, and financial condition. For a full discussion of cybersecurity risks, please see our Risk Factors in Item 3. D.

Cybersecurity Governance

Board Oversight

At the board level, cybersecurity risk management has been delegated to theAudit Committee(the “