NEC Corporation

The NEC Group provides a diverse range of products, systems, and services both domestically and internationally, and ensuring quality and safety along with the appropriate operation of project management form the foundation of business continuity. If quality issues, including those involving the supply chain, or deficiencies in project management occur, this could have a serious impact on customers' business continuity and social infrastructure, and could necessitate product recalls, customer compensation, and regulatory responses, thereby posing a serious risk to corporate value. As a countermeasure, the CBXO holds management responsibility and implements project risk management using proprietary methods such as multi-stage review meetings from before order acceptance and quality accounting.

Against the backdrop of expanding use of AI technology and cloud services, cyberattacks such as ransomware are becoming more sophisticated and elaborate, increasing the risk of information leaks, business disruption, and impediments to service provision. Significant incidents affecting the products, systems, and services provided by the NEC Group could impact customers' business continuity and social infrastructure, and inadequate responses from an economic security perspective could directly lead to regulatory action and loss of credibility. As a countermeasure, the Group is promoting the construction of a "Zero Trust Security Platform," strengthening intelligence and resilience based on the NIST Cybersecurity Framework 2.0 and others, and implementing security-by-design.

Risks related to human capital are detailed in the sustainability section of the Annual Securities Report (Risk Management of Human Capital Management) and are positioned as a material risk directly linked to the NEC Group's business competitiveness and growth potential. It is rated at an impact level of 5 (the highest level), and insufficient recruitment, development, and retention of talent could have a significant impact on the ability to execute business and on corporate value. Detailed countermeasures are entrusted to sustainability disclosures, and the Group is addressing the promotion of human capital management as a company-wide management issue.

The NEC Group has identified "new technologies such as AI and human rights," "human rights risks in light of geopolitical conditions and conflict impacts," "labor in the supply chain," and "employee safety and health" as salient human rights issues across the entire value chain. If responses are deemed inadequate, there is a risk of a significant impact on corporate value through suspension of transactions or reputational decline. As countermeasures, under the "NEC Group Human Rights Policy" revised in 2022, the Group conducts supply chain audits based on the OECD Due Diligence Guidance and has formulated and operates a "Policy on AI and Human Rights" for the AI business.

Compliance violations such as bribery, competition law violations, and personal information leaks not only result in direct losses through administrative sanctions, litigation, and fines, but for the NEC Group, which is heavily engaged in businesses with high public relevance, even a single incident could develop into a significant decline in social credibility or suspension of transactions. The CRCO oversees the company-wide compliance system through the Risk and Compliance Committee, implementing specific measures such as disseminating the "NEC Group Code of Conduct," operating the basic regulations on bribery prevention, and maintaining the Privacy Mark (obtained in 2005).

In the large-scale system development projects undertaken by the NEC Group, there is a risk of project delays, cost overruns, and quality issues arising from complex factors such as technical risk, development scale, timeframe, and organizational structure. Deficiencies in project management could lead to customer compensation and loss of trust, posing a risk to management. As a countermeasure, the Group holds multi-stage review meetings from before order acceptance and continuously improves root cause analysis and recurrence prevention processes for problem projects.

The NEC Group's supply chain is deployed globally, and if quality issues, labor issues, human rights violations, or geopolitical risks materialize among suppliers, this could disrupt the provision of the NEC Group's products and services and affect its social reputation. Regarding labor risks in the supply chain, the Group conducts assessments, on-site audits, and corrective actions based on the OECD Due Diligence Guidance, and on the security front, is strengthening measures including the supply chain based on the concept of security-by-design.

Changes in geopolitical conditions and tightening of economic security regulations pose a risk of stricter export controls, transaction restrictions, and information management requirements for the NEC Group's products and services. In particular, inadequate responses in areas requiring strict information management from an economic security perspective could directly lead to regulatory action and loss of credibility, and human rights violation risks may also arise depending on how products and services are used in conflict-affected regions. As a countermeasure, the Group identifies high-risk regions based on the OECD's "States of Fragility 2025" list, conducts pre-transaction confirmations, and checks various sanctions lists.

With the expansion of the AI business, there is a risk that negative impacts on fundamental human rights, such as privacy infringement, and ethical issues arising from inappropriate use of AI technology, may become apparent. Inadequate responses could have a significant impact on the NEC Group's social value and corporate value through social criticism, suspension of transactions, and reputational decline. As a countermeasure, the Group has formulated the "NEC Group Policy on AI and Human Rights" and established regulations concerning the structure, planning, implementation, review, and revision of responses to AI and human rights risks, promoting the dissemination of its operation.

The NEC Group conducts businesses that handle large volumes of personal information, and if violations of the Personal Information Protection Act or information leaks occur, this could lead to direct losses such as administrative sanctions, litigation, and fines, as well as a significant decline in social credibility. As a countermeasure, the Group has designated the CLO as the officer responsible for personal information protection, established a personal information protection manager, promotion secretariat, and audit officer, and maintains the Privacy Mark (obtained in 2005), operating a personal information management system compliant with JIS Q 15001.