Company: TSLTF
Filing Date: 2025-12-12
Form Type: SUPPL
Source: 0001193125-25-317786
Chunk: 318

Company: TRANSALTA CORP
Filing Date: 2025-12-12
Form: SUPPL
Chunk 318
---
 data, as well as potential risks and vulnerabilities. |

| • |     | Protect: TransAlta implements security controls, policies and procedures to safeguard the                                                                                                                                                           
 organization’s assets, systems and data from unauthorized access, use, disclosure, disruption, modification or destruction. This includes implementing access controls, encryption, firewalls and intrusion detection/prevention systems to protect 
 the organization’s networks and systems.                                                                                                                                                                                                            |

| • |     | Detect: TransAlta implements incident detection and response capabilities to detect and respond to 
 cyber incidents. This includes monitoring systems, networks and data for suspicious activity.      |

| • |     | Respond: TransAlta has developed incident response plans, procedures and teams, and has provided      
 training and conducted exercises to ensure that these plans and procedures are operating effectively. |

| • |     | Recover: TransAlta has developed disaster recovery and business continuity plans, and it conducts                                                                                                                                                     
 test exercises of these plans to ensure their effectiveness. This includes identifying critical systems, data and processes to ensure the continuity of business operations, as well as implementing backup and recovery solutions to ensure that the 
 organization’s data can be restored in the event of a disaster.                                                                                                                                                                                       |

Although complete cyber risk elimination is not achievable given the evolving cyber threat landscape, we believe that the security controls implemented to detect, prevent and respond to a cyber incident significantly reduce TransAlta’s cyber risk and potential incident impact to acceptable levels. In addition, cyber insurance is utilized to further manage and transfer residual cyber risk to TransAlta’s business. We continue to improve our overall security maturity and defense capabilities against cyber threats and align cybersecurity practices to industry standards, business objectives and regulatory compliance requirements. Our technology and systems for communication and monitoring may be vulnerable to security breaches or interruptions, which could result in increased operating expenses and other liabilities. We rely on technology, mainly on computer, telephone, satellite, cellular and related networks and infrastructure, to conduct our business and monitor the production of our generation facilities. These systems and infrastructure could be vulnerable to unforeseen problems including, but not limited to, cyberattacks, breaches, vandalism and theft. Our operations are dependent upon our ability to protect our information and operating technology against damage from

| TransAlta Corporation |     | 2024 Integrated Report |     | M145 |

Management’s Discussion and Analysis fire, power loss, telecommunications failure or a similar catastrophic event. While we have dedicated resources for maintaining appropriate levels of cybersecurity and we use third-party technology to help protect us against security breaches and cyber incidents,