Alcoa (AA) Risk Analysis

We are subject to income taxes in both the United States and various non-U.S. jurisdictions. Changes in foreign and domestic tax laws, regulations, or policies, or their interpretation and application by regulatory bodies, or exposure to additional tax liabilities could affect our future profitability. For example, in October 2021, a new framework for international tax was agreed to by 137 member countries and jurisdictions of the Organisation for Economic Co-operation and Development (OECD), including the two-pillar solution for a global minimum level of taxation. While the future of Pillar One remains uncertain, the global minimum tax under Pillar Two is fully effective or is expected to be fully effective in 2025 in most of the countries in which we operate. The implementation of the Pillar Two Framework in these countries did not have a material impact during 2024, but they could in the future should the Company's tax profile change. We continue to monitor any additional guidance released by the OECD, along with the pending and adopted legislation in the countries in which we operate. Our domestic and international tax liabilities are dependent upon the distribution of profits among the different jurisdictions in which we operate. Our tax expense includes estimates of additional tax that may be incurred for tax exposures and reflects various estimates and assumptions. The assumptions include assessments of future earnings of the Company that could impact the valuation of our deferred tax assets. Our future results of operations could be adversely affected by changes in the effective tax rate as a result of a change in the mix of earnings in countries with differing statutory tax rates, changes in the overall profitability of the Company, changes in tax legislation and rates, changes in generally accepted accounting principles, and changes in the valuation of deferred tax assets and liabilities. Significant changes to tax laws or regulations and the positions of taxing authorities could have a substantial impact, positive or negative, on our effective tax rate, cash tax expenditures and cash flows, and deferred tax assets and liabilities. For example, in December 2023, the U.S. Treasury Department clarified that commercial grade aluminum can qualify for Section 45X of the Advanced Manufacturing Tax Credit, enacted as part of the Inflation Reduction Act (IRA). Section 45X provides a tax credit for certain costs incurred in the production of critical minerals, including aluminum. In the fourth quarter of 2023, the Company recorded a full year benefit of $36 related to its Massena West (New York) smelter and its Warrick smelter. On October 24, 2024, the U.S. Treasury finalized the Proposed Regulations under Section 45X with important modifications including the ability to include the cost of certain direct and indirect materials in the cost base of the credit. The Proposed Regulation on the definition of aluminum was not finalized; the U.S. Treasury has indicated it will finalize the definition at a later date. In 2024, the Company recorded benefits of $71 related to its Massena West smelter and its Warrick smelter, including $30 for the full year 2023 and 2024 benefit resulting from the October update. We are subject to tax audits by various tax authorities in many jurisdictions, such as Australia, Brazil, Canada, and Norway. For example, in July 2020, AofA received Notices of Assessment from the Australian Taxation Office (ATO) related to the pricing of certain historic third-party alumina sales, and the ultimate resolution of this matter is uncertain at this time. We regularly assess the potential outcomes of examinations by tax authorities in determining the adequacy of our provision for income taxes. The results of tax audits and examinations of previously filed tax returns or related litigation and continuing assessments of our tax exposures could materially affect our financial results. See Part II Item 8 of this Form 10-K in Notes Q and S to the Consolidated Financial Statements under captions Unrecognized tax benefits and Contingencies, respectively.

Several governments or regulatory bodies in areas where we operate, such as in the United States, Australia, Brazil, Canada, and the EU, have introduced or are contemplating legislative and regulatory change in response to the potential impacts of climate change, which could result in changes to the margins of GHG intensive assets and energy-intensive assets. These regulatory mechanisms relating to carbon may be either voluntary or legislated and the inconsistency of associated regulations may impact our operations directly or indirectly through customers or our supply chain. Assessments of the potential impact of future climate change legislation, regulation, and international treaties and accords are uncertain, given the wide scope of potential regulatory change in countries in which we operate and the diversity in the scope and development of such regulations. For example, in 2021, the European Commission proposed a Carbon Border Adjustment Mechanism (CBAM) as a levy on carbon-intensive imports, which was provisionally approved in December 2022. In October 2023, the CBAM entered into application of its transitional phase, which applies to aluminum, with the first reporting period for importers ending January 31, 2024, and full implementation of CBAM will begin on January 1, 2026. We may realize increased capital expenditures, costs, or taxes resulting from required compliance with revised or new legislation or regulations, including costs to purchase or profits from sales of allowances or credits under a carbon credit/pricing or "cap and trade" system, increased insurance premiums and deductibles as new actuarial tables are developed to reshape coverage, a change in competitive position relative to industry peers, and changes to profit or loss arising from increased or decreased demand for goods produced by the Company and, indirectly, from changes in costs of goods sold. Though we are investing in technology to reduce the production of GHG in the manufacture of our products, such as our ELYSIS partnership aluminum smelting technology and other technologies that are designed to limit the production of carbon in alumina refining, in certain aspects of our operations, our ability to reduce our GHG emissions is also dependent on the actions of third parties, especially energy providers, and our ability to make significant changes in our GHG emissions. As a result, we could face additional costs associated with any new regulation of GHG emissions, and our ability to modify our operations to avoid these costs may be limited in the near term. We also have operations in jurisdictions that have implemented or are developing regulations covering a variety of environmental and social topics, including GHG emissions, such as the European Union's Corporate Sustainability Reporting Directive, and similar regulations under consideration in U.S. states and other countries in which we operate, which contain new and extensive disclosure requirements that may require additional resources and costs associated with compliance. If we fail to comply with the various reporting frameworks, we could face scrutiny from stakeholders and regulators, incur monetary penalties and reputational harm, and could become subject to litigation or result in other material impacts to our business. In addition, regulations to combat climate change could impact the competitiveness of the Company, including the attractiveness of the locations of some of the Company's assets. The global focus on climate is raising awareness in all countries, such as the agreement at the 26th United Nations Climate Change Conference of the Parties (COP26) by many governments of countries where the Company operates to combat deforestation, which could adversely affect our ability to mine and operate in sensitive areas like the Jarrah Forest and the Amazon. The potential physical impacts of climate change or extreme weather conditions on the Company's operations are highly uncertain, could be significant, and will be particular to the geographic circumstances. These may include changes in rainfall patterns, wildfires, heat waves, shortages of water or other natural resources, changing sea levels, changing storm patterns, flooding, increased frequency and intensities of storms, and changing temperature levels. Any of these may disrupt our operations, hinder transportation of products to us or of our products to customers, interrupt energy supplies, prevent access to our facilities, negatively impact our suppliers' or customers' operations and their ability to fulfill contractual obligations to us, and/or cause damage to our facilities, all of which may increase our costs, reduce production, and adversely affect our business, financial condition, or results of operations. Measures to mitigate or adapt our assets, including current operations, closed or curtailed locations, and impoundment structures, to the potential physical climate-related risks may increase costs. In addition, we rely on our customers and suppliers to assess their own potential physical impacts of climate change and implement appropriate mitigation or adaptation actions. Thus, we may not be able to influence the resiliency of our suppliers or customers to potential physical impacts of climate change.

Some of our operations generate waste and other byproducts, which we contain in tailing facilities, residue storage areas, and other structural impoundments that are subject to extensive regulation and increasingly strict industry standards. Failure of storage areas caused by extreme weather events, erosion, or unanticipated structural failure of impoundments could result in severe, and in some cases catastrophic, damage to the environment, natural resources, or property, or personal injury and loss of life. The impact that our operations may have on the environment, as well as exposures to hazardous substances or wastes associated with our operations, could result in significant costs, civil or criminal damages, fines or penalties, and enforcement actions issued by regulatory or judicial authorities enjoining, curtailing, or closing operations or requiring corrective measures, any of which could have a material adverse effect on Alcoa.

A significant portion of our employees are represented by labor unions or worker groups in a number of countries under various collective bargaining agreements or similar arrangements with varying durations and expiration dates. We may not be able to satisfactorily renegotiate our agreements when they expire. In addition, existing arrangements may not prevent strikes, work stoppages, work slowdowns, union organizing campaigns, or lockouts at our facilities in the future. We may also be subject to general country strikes or work stoppages unrelated to our business or collective bargaining agreements. A labor dispute or work stoppage of employees could have a material adverse effect on production at and shipping from one or more of our facilities, and depending on the length of work stoppage, on our business, financial condition, or results of operations. Additionally, in the current competitive labor market, if we lose critical or a significant number of workers to attrition, it may be difficult or costly to find and recruit replacement employees, which could have a material adverse effect on our business, financial condition, and results of operations.

Our business, financial condition, and results of operations have been and could continue to be negatively affected by unfavorable changes in the cost, quality, or availability of energy, raw materials, including carbon products, caustic soda, and other key inputs, such as bauxite, as well as freight costs associated with transportation of raw materials and key inputs to refining and smelting locations. We may not be able to fully offset the effects of higher raw material or energy costs through price increases, productivity improvements, cost reduction programs, or reductions or curtailments to production at our operations. A decrease in the quality of raw materials or key inputs has in the past and could continue to cause increased production costs, which also has in the past and could continue to result in lower production volumes. For example, the Company is currently mining and processing lower grade bauxite in Western Australia, which has caused increased production costs. Changes in the costs of bauxite, alumina, energy, and other inputs during a particular period may not be adequate to offset concurrent sharper decreases in the price of alumina or aluminum and could have a material adverse effect on our operating results. In addition, due to global supply chain disruptions, we may not be able to obtain sufficient supply of our raw materials, energy, or other key inputs in a timely manner, including due to shortages, inflationary cost pressures, trade policies, or transportation delays, which could cause disruption in our operations or production curtailments. Though we have been able to source our raw materials and other key inputs in adequate amounts from other suppliers or our own stockpiles to date, there can be no guarantee that our operations or profitability will not be adversely affected in the future. Our suppliers, vendors, and customers could experience similar constraints that could impact our operations and profitability.

We depend on information and communications technology, networks, software, and related systems to operate our business, including production controls and operating systems at our facilities and systems for recording and processing transactions, interfacing with customers, financial reporting, and protecting the personal data of our employees and other confidential information. Our global operations require increased reliance on technology, which expose us to risks of theft of proprietary information, including trade secrets and other intellectual property that could have a material adverse effect on our business, financial condition, and results of operations. The protection of such information, as well as sensitive customer information, personal data of our employees, and other confidential information, is critical to us. We face global cybersecurity threats, which may range from uncoordinated individual attempts to sophisticated and targeted measures, known as advanced persistent threats, directed at the Company. In addition, a number of our employees work remotely, which has generally increased cybersecurity vulnerabilities and risk to our information technologies systems. Cyber attacks and other cyber incidents are becoming more frequent and sophisticated, are constantly evolving, including through the use of artificial intelligence, and are being made by groups and individuals with significant resources that employ a wide range of expertise and motives. Such attacks are also increasing in complexity, which may make cyber attacks more difficult to detect, contain, and mitigate. Cyber attacks and security breaches may include, but are not limited to, unauthorized attempts to access information or digital infrastructure, efforts to direct payments to fictitious parties, viruses, ransomware, malicious codes, hacking, social engineering (such as phishing and SMSishing), denial of service, human error, and other electronic security breaches, any of which could have a material adverse effect on our business, financial condition, and results of operations. Certain techniques used in cyber attacks may not be immediately detectable, we may be unable to anticipate or detect these techniques, such as use of a zero-day exploit or unknown malware, immediately identify the scope and impact of an incident, contain the incident within our systems, or implement preventative or remediation measures, which may have a material adverse effect on our business, financial condition, and results of operations. In addition, we utilize third-party vendors for certain software applications, storage systems, and cloud computing services. Cyber attacks, security breaches, or other incidents on the information technology systems of our service providers or business partners could materially impact us. We have in the past experienced attempts and incidents by external parties to penetrate our and our service providers or business partners networks and systems. Such attempts and incidents to date have not had a material adverse effect on our business, financial condition, or results of operations. We continue to assess potential cyber threats and invest in our technology infrastructure to address these threats, including by monitoring networks and systems, training employees on cyber threats, and enhancing security policies of the Company and its third-party providers. While the Company continually works to strengthen our systems and security measures, safeguard information, and mitigate potential risks, there is no assurance that such actions will be sufficient to prevent or timely detect cyber attacks or security breaches. Some intrusions could manipulate or improperly use our systems or networks, disclose, or compromise confidential or protected information, destroy, or corrupt data, or otherwise disrupt our operations, and because of any of these things could have a material adverse effect on our business, financial condition, and results of operations. In addition, some cybersecurity incidents could negatively impact our reputation and competitive position, and could result in litigation with third parties, regulatory action, loss of business, theft of assets, and significant remediation costs, and because of any of these things, have a material adverse effect on our financial condition and results of operations. Such security breaches could also result in a violation of applicable U.S. and international privacy and other laws, and subject us to litigation and governmental investigations and proceedings, any of which could result in our exposure to material civil or criminal liability. For example, the European Union's General Data Privacy Regulation (GDPR) subjects companies to a range of compliance obligations regarding the handling of personal data. In the event our operations are found to be in violation of the GDPR's requirements, we may be subject to significant civil penalties, business disruption, and reputational harm, any of which could have a material adverse effect on our business, financial condition, or results of operations. Some cyber attacks or breaches could require significant management attention and resources and result in the diminution of the value of our investment in research and development, which could have a material adverse effect on our business, financial condition, or results of operations. Though we have disaster recovery and business continuity plans in place, if our information technology systems, or those of our third-party providers, are damaged, breached, interrupted, or cease to function properly for any reason, and, if the disaster recovery and business continuity plans do not effectively resolve the incident on a timely basis, we may suffer interruptions in our ability to manage or conduct business and we may be exposed to reputational, competitive, and business harm as well as litigation and regulatory action, which may materially and adversely impact our business, financial condition, or results of operations.