Enbridge (ENB) Risk Analysis

Our operations and management require the retention and recruitment of a skilled and diverse workforce, including engineers, technical personnel, other professionals and executive officers and senior management. Enbridge and our affiliates compete with other companies in the energy industry, and for some jobs the broader labor market, for this skilled workforce. If we are unable to retain current employees and/or recruit new employees of comparable knowledge and experience, our business could be negatively impacted. In addition, we could experience increased costs to retain and recruit these professionals.

Our Liquids Pipelines business faces competition from competing carriers available to ship liquid hydrocarbons to markets in Canada, the US and internationally and from proposed pipelines that seek to access basins and markets currently served by our Liquids Pipelines. Competition among existing pipelines is based primarily on the cost of transportation, access to supply, the quality and reliability of service, contract carrier alternatives and proximity to markets. The commodities transported in our pipelines currently, or are increasingly expected to, compete with other emerging alternatives for end-users, including, but not limited to, electricity, electric batteries, biofuels, and hydrogen. Additionally, we face competition from alternative storage facilities. Our natural gas transmission and storage business competes with similar facilities that serve our supply and market areas in the transmission and storage of natural gas. The natural gas transported and distributed in our business also competes with other forms of energy available to our customers and end-users, including electricity, coal, propane, fuel oils, and renewable energy. Our Renewable Power Generation business faces competition in the procurement of long-term power purchase agreements and from other fuel sources in the markets in which we operate. Competition in all of our businesses, including competition for new project development opportunities, could have a negative impact on our business, financial condition or results of operations.

We are exposed to the credit risk of multiple parties in the ordinary course of our business. Generally, our customers are rated investment-grade, are otherwise considered creditworthy, or provide us with security to satisfy credit concerns. However, we cannot predict to what extent our business would be impacted by deteriorating conditions in the economy, including possible declines in the creditworthiness of our customers, vendors, or counterparties. It is possible that payment or performance defaults from these entities, if significant, could adversely affect our earnings and cash flows.

Companies across all sectors and industries are facing changing expectations and increased scrutiny from stakeholders related to their approach to climate change and GHG emissions. Companies in the energy industry are experiencing stakeholder opposition to their operations and infrastructure projects. Enbridge's ESG goals, sustainability-related activities, commitments, and plans, including climate-related information and data, are based on various assumptions, estimates, judgments, risks, and uncertainties. Achieving these ESG goals and commitments will require collective efforts and actions from a wide range of stakeholders, much of which is beyond our control, and there can be no assurance that the impact of these efforts and actions will be realized. Our ESG goals and pathways for reducing operational emissions will continue to evolve and may need to be restated, modified, or recalibrated as data improves, standards, methodologies, metrics, and measurements mature, and as legislation, regulations, policies, and stakeholder sentiment evolve. If we experience challenges, or perceived challenges in achieving our climate-related goals, are not able to meet future climate-related, emissions, or other regulatory or reporting requirements, or are not able to meet or manage stakeholder expectations regarding climate change or disclosure of climate-change information (including potential allegations of greenwashing), it could negatively impact our reputation or investor sentiment and could expose us to government enforcement actions or litigation, which may, in turn, impact our business, operations or financial results.

Our business is dependent upon information systems and other digital technologies for controlling our plants, pipelines and other assets, processing transactions and summarizing and reporting results of operations. With the evolution of AI, our business has incorporated AI into our operations in order to gain efficiencies and productivity in our day-to-day operations, which has the potential to increase technology and cybersecurity risks. The secure processing, maintenance and transmission of information is critical to our operations. Cybersecurity risks have increased in recent years as a result of the proliferation of new technologies and the increased sophistication of cyber attacks and financially-motivated cybercrime, as well as international and domestic political factors, including geopolitical tensions, armed hostilities, war, civil unrest, sabotage, terrorism and state-sponsored or other cyber espionage. Human error or malfeasance can also contribute to a cyber incident, and cyber attacks can be internal as well as external and occur at any point in our supply chain. Because of the critical nature of our infrastructure and our use of information systems and other digital technologies to control our assets, we face a heightened risk of cybersecurity incidents, such as ransomware, theft, misplaced or lost data, programming errors, phishing attacks, denial of service attacks, acts of vandalism, computer viruses, malware, hacking, malicious attacks, software vulnerabilities, employee errors and/or malfeasance, or other attacks, security or data breaches or other cybersecurity incidents. Cyber threat actors have attacked and continue to threaten to attack energy infrastructure, including our assets, and various government agencies have increasingly stressed that these attacks are targeting critical infrastructure, including pipelines, public utilities, and power generation facilities, and are increasing in sophistication, magnitude, and frequency. Additionally, these risks may escalate during periods of heightened geopolitical tensions. In addition, new cybersecurity legislation, regulations and orders have been recently implemented or proposed, resulting in additional actual and anticipated regulatory oversight and compliance requirements, which will require significant internal and external resources. We cannot predict the potential impact to our business of potential future legislation, regulations or orders relating to cybersecurity. We have experienced an increase in the number of attempts by external parties to access our systems or our company data without authorization, and we expect this trend to continue. Although we devote significant resources and security measures to prevent unwanted intrusions and to protect our systems and data, whether such data is housed internally or by external third parties, we and our third-party vendors have experienced, and expect to continue to experience, cyber attacks of varying degrees in the conduct of our business, including denial of service attacks. To date, these prior cyber attacks have not, to our knowledge, had a material adverse effect on our business, operations or financial results. However, we have experienced an increasing number of cybersecurity threats in recent years and there is a risk that any such incidents could have a material adverse effect on us in the future. Our technology systems or those of our vendors or other service providers are expected to become the target of further cyber attacks or security breaches which could compromise our data and systems or our access thereto by us, our customers or others, affect our ability to correctly record, process and report transactions, result in the loss of information, or cause operational disruption or incidents. There can be no assurance that our business continuity plans will be completely effective in avoiding disruption and business impacts. Furthermore, we and some of our third-party service providers (who may in turn also use third-party service providers) collect, process or store sensitive data in the ordinary course of our business, including personal information of our employees, residential gas distribution customers, land owners and investors, as well as intellectual property or other proprietary business information of ours or our customers or suppliers. In light of the Acquisitions, due to their large residential customer bases, we and some of our third-party services providers will process increasing amounts of personal information. As a result of the foregoing, we could experience loss of revenues, repair, remediation or restoration costs, regulatory action, fines and penalties, litigation, breach of contract or indemnity claims, cyber extortion, ransomware, implementation costs for additional security measures, loss of customers, customer dissatisfaction, reputational harm, liability under laws that protect the privacy of personal information, other adverse consequences, or other costs or financial loss. In light of the Acquisitions, these risks may be heightened, and the consequences magnified. Regardless of the method or form of cyber attack or incident, any or all of the above could materially adversely affect our reputation, business, operations or financial results. In addition, a cyber attack could occur and persist for an extended period without detection. Any investigation of a cyber attack or other security incident may be inherently unpredictable, and it would take time before the completion of any investigation and availability of full and reliable information. During such time, we may not know the extent of the harm or how best to remediate it, and certain errors or actions could be repeated or compounded before they are discovered and remediated, all or any of which could further increase the costs and consequences of a cyber attack or other security incident, and our remediation efforts may not be successful. The inability to implement, maintain and upgrade adequate safeguards could materially and adversely affect our results of operations, cash flows, and financial condition. Moreover, recent rulemakings may require us to disclose information about a cybersecurity incident before it has been completely investigated or remediated in full or even in part. As cyber attacks continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities. Furthermore, media reports about a cyber attack or other significant security incident affecting Enbridge, whether accurate or not, or, under certain circumstances, our failure to make adequate or timely disclosures to the public, law enforcement, other regulatory agencies or affected individuals following any such event, whether due to delayed discovery or otherwise, could negatively impact our operating results and result in other adverse consequences, including damage to our reputation or competitiveness, harm to our relationships with customers, partners, suppliers, investors, and other third parties, interruption to our management, remediation or increased protection costs, significant litigation or regulatory action, fines or penalties, all of which could materially adversely affect our business, operations, reputation or financial results.

Executing our strategic priorities, including participating in the energy transition over time and attaining our GHG emissions reduction goals, depends, in part, on technological improvements and innovation. This includes the development and use of emerging technologies, such as renewable power and other lower-carbon energy infrastructure. Such technological developments could require significant capital expenditures and resources and may, impact our competitiveness. GHG emissions reduction technology may not materialize as expected, which could make it more difficult to reduce emissions and meet our ESG goals.