Nokia (NOK) Risk Analysis

Our 5G-related R&D efforts as well as product rollouts require us to devote financial and operational resources, and we expect to continue to make substantial investments in 5G and 5G-related technology. However, the 5G rollout and commercialization has not and may not develop in the manner or in the time periods we anticipate. Further, competitive intensity remains high in the market as competitors seek to take share in the 5G rollouts, which is creating a risk of persistent high price erosion in the industry. If domestic and global economic conditions worsen, overall spending on 5G infrastructure may be reduced or delayed, and spending in our other networks products and services might be even more rapidly reduced to preserve the customer investment in 5G, which would adversely impact demand for our products and services in these markets. Even if the 5G infrastructure market develops in the manner or in the time periods we anticipate, if we do not have timely, competitively priced, market-accepted products available to meet our customers’ planned rollout of 5G networks, or if we have products below expected performance in the commercial networks, we may miss significant opportunities or, in the worst case, lose already awarded business. We have faced and may face challenges with respect to the R&D roadmaps, System-on-a-Chip development and cost competitiveness of our 5G products and our actions and investments to accelerate those roadmaps and improve our cost competitiveness to address those challenges may prove to be insufficient. Further, any reduction in our market share in 5G compared with our installed base in 4G due to decisions to protect our profitability, inability to meet the customers’ requirements or other reasons, may have a material negative effect on our scale and profitability.

Our products and services include increasingly complex technologies that we have developed or that have been licensed to us by certain third parties. The amount of such proprietary technologies and the number of parties claiming to own relevant IPR continue to increase. The holders of patents and other IPR potentially relevant to these complex technologies may be unknown to us, may have different business models, may refuse to grant licenses to their proprietary rights or may otherwise make it difficult for us to acquire a license on commercially acceptable terms. If licensing agreements are not available on commercially acceptable terms, we could be precluded from making and selling the affected products, or could face increased licensing costs. As new features are added to our products, we may need to acquire further licenses, including from new and sometimes unidentified owners of intellectual property. The lack of availability of licenses for copyrighted content, delayed negotiations or restrictive IPR license terms may have a material adverse effect on the cost or timing of content-related services and products offered by us, mobile network operators or third-party service providers. The cumulative costs of obtaining any necessary licenses are difficult to predict and may be significant. Additionally, although we endeavor to ensure that we and the companies collaborating with us possess appropriate IPR or licenses, we cannot fully avoid the risks of IPR infringement by suppliers of components, processes and other various layers in our products, or by companies with which we collaborate. Similarly, we and our customers may face claims of infringement in connection with the use of our products. Any restrictions on our ability to sell our products due to expected or alleged infringements of third-party IPR and any IPR claims, regardless of merit, could result in a material loss of profits, costly litigation, the obligation to pay damages and other compensation, the diversion of the attention of our key employees, product shipment delays or the need for us to develop non-infringing technology or to enter into a licensing agreement on unfavorable commercial terms. In line with standard practice in our industry, we generally indemnify our customers for certain intellectual property-related infringement claims initiated by third parties relating to products or services purchased from us. These may include claims from non-practicing entities having no product or service business. If such claims are made directly against our customers, we may have limited opportunities to participate in the processes including in negotiations and in defenses, or to evaluate the outcomes and resolutions in advance. All IPR indemnifications can result in significant payment obligations for us that are difficult to estimate in advance. Moreover, our indemnification responsibilities typically arise whether or not the IPR assertions against our customers have merit. Since all technology standards that we use and rely on, including mobile communication technologies such as UMTS, LTE and 5G, or fixed line communication technologies, include certain IPR, we cannot avoid risks of facing claims for infringement of such rights due to our reliance on such standards. We believe the number of third parties declaring their patents to be potentially relevant to these standards is increasing, which may increase the likelihood that we will be subject to such claims in the future. As the number of market entrants and the complexity of technologies increase, it remains likely that we will need to obtain licenses with respect to existing and new standards from other licensors. While we believe most of such IPR declared or actually found to be essential to a particular standard carries an obligation to be licensed on fair, reasonable and non-discriminatory terms, not all intellectual property owners agree to apply such terms, nor do all owners agree on what is fair, reasonable and non-discriminatory. As a result, we have experienced costly and time-consuming litigation proceedings against us and our customers or suppliers over such issues and we may continue to experience such litigations in the future. From time to time, certain existing patent licenses may expire or otherwise become subject to renegotiation. The inability to renew or finalize such arrangements or renew licenses with acceptable commercial terms may result in litigation, which may be expensive and time-consuming and divert the efforts of our management and technical experts from our business and, if decided against us, could result in unfavorable judgments, restrictions on our ability to sell certain of our products, require us to pay increased licensing fees, costly settlements, fines or other penalties and expenses. Our patent license agreements may not cover all the future businesses that we may enter, our existing business may not necessarily be covered by our patent license agreements if there are changes in our corporate structure or our subsidiaries, or our newly acquired businesses may already have patent license agreements with terms that differ from similar terms in our patent license agreements. This may result in increased costs, restrictions in the use of certain technologies or time-consuming and costly disputes whenever there are changes in our corporate structure or our subsidiaries, or whenever we enter into new business areas or acquire new businesses. We make accruals and provisions to cover our estimated total direct IPR costs for our allegedly infringing products. Our estimated total direct IPR costs take into account items such as payments to licensors, accrued expenses under existing agreements and provisions for potential liabilities. We believe our accruals and provisions are at an appropriate level. The ultimate outcome, however, may differ from the provided level, which could have an adverse impact on us.

Our business and operations rely on confidentiality of proprietary and other sensitive information, for instance related to our employees, consumers and our customers, including our government customers. Our business models rely on certain centralized data processing solutions and cloud or remote delivery-based services for distribution of services and software or data storage, accessible by our partners or subcontractors according to the roles and responsibilities defined. We, our subsidiaries and joint ventures, products and online services, marketing and developer sites and third parties that we contract have been and may in the future be subject to cybersecurity breaches, including hacking, ransomware, viruses, worms and other malicious software, unauthorized modifications, or illegal activities that may cause potential security risks and other harm to us, our customers or consumers and other end-users of our products and services. IT is rapidly evolving, the techniques used to obtain unauthorized access or sabotage systems change frequently and the parties behind cyber-attacks and other industrial espionage are believed to be sophisticated and have extensive resources, and it is not commercially or technically feasible to mitigate all known vulnerabilities in a timely manner or to eliminate all risk of cyber-attacks and data breaches. Additionally, we contract with multiple third parties in various jurisdictions who collect and use certain data on our behalf. Although we have processes in place designed to ensure appropriate collection, handling and use of such data, third parties may use the data inappropriately or breach laws and agreements in collecting, handling or using or leaking such data. Our business is also vulnerable to theft, fraud or other forms of deception, sabotage and intentional acts of vandalism by third parties and employees. Further, compared to our fully integrated group companies, our ability to mitigate and oversee risk of cyber-attacks and data breaches may be more limited in our joint venture companies and other group companies having their own governance and system infrastructure, such as our local service companies focusing on networks field services. The cybersecurity breaches may lead to lengthy and costly incident response, remediation of the attack or breach, legal proceedings and fines imposed on us, as well as adverse effects to our reputation and brand value. Additionally, cyber-attacks can be difficult to prevent, detect or contain. We cannot rule out the possibility that there may have been cyber-attacks that have been successful and/or evaded our detection. We continue to invest in risk mitigating actions; however, there can be no assurance that such investments and actions will prevent or detect future cyber-attacks. Additionally, the cost and operational consequences of implementing further information system protection measures, especially if prescribed by national authorities, could be significant. We may not be successful in implementing such measures in due time, which could cause business disruptions and be more expensive, time-consuming and resource intensive. In connection with providing products and services to our customers and consumers, certain personal and consumer data are collected, stored and processed through us, either by us or by our business partners or subcontractors in various jurisdictions. We have outsourced a significant portion of our IT operations, as well as the network and information systems that we sell to third parties or for whose security and reliability we may otherwise be accountable. Loss, improper disclosure or processing or leakage of any personal or consumer data collected by us or which is made available to us or our partners or subcontractors or stored in or through our products and services, could have a material adverse effect on us and harm our reputation and brand. Additionally, governmental authorities may use our networks products to access the personal data of individuals without our involvement; for example, through the so-called lawful intercept capabilities of network infrastructure, impairing our reputation.

We develop our products based on existing regulations and technical standards, our predictions for, and interpretation of, unfinished technical standards and upcoming or draft regulations or, in certain cases, in the absence of applicable regulations and standards. Fragmentation of rules and unpredictability of regulatory changes present a particular challenge. Changes in various existing regulations or in their application, applicable to current or new technologies, products or telecommunication and technology sectors in general, may adversely affect our business and results of operations. An increase in regulation of the digital economy and telecommunications following the European Commission’s ambitious Green Deal and Path to Digital Decade could fail to find the right balance between political ambitions and practical considerations, which might negatively affect Nokia. From a spectrum policy perspective, unrealistic spectrum pricing for 5G development, failure to enable access to additional spectrum in various bands and/or failure to achieve frequency band harmonization could also adversely impact Nokia’s customers and Nokia itself. Changes in applicable privacy-related regulatory frameworks, such as EU General Data Protection Regulation, the upcoming EU eEvidence and e-Privacy Regulations and similar regulations in other countries or their application may adversely affect our business, including possible changes that increase costs, limit or restrict possibilities to offer products or services, or reduce or could be seen to reduce the privacy aspects of our offerings. For instance, countries could require governmental interception capabilities or issue regulations aimed at allowing direct governmental access to data for the products and services we offer. Such requirements or regulations could adversely affect us, if, among other things, we decide to reduce our sales to such markets or if such requirements or regulations would be limiting our ability to use components, products or software that we have developed or sourced from other companies. Our current business models and operations rely on certain centralized data processing solutions and cloud or remote delivery-based services for distribution of services and software or data storage, which have certain inherent risks, including those stemming from applicable regulatory regimes, including data protection or data localization, that may cause limitations in implementing such business models or conducting business. An increase in the protectionist stances of governments around the world, which impact the free flow of data across borders, has affected and may further affect our global service delivery model. Furthermore, we observe that enforcement actions and investigations by regulatory authorities related to data security incidents and privacy violations continue to increase. Unauthorized disclosure, transfer or loss of sensitive or confidential data, whether through systems failure, employee negligence, fraud or misappropriation, by the Company, our vendors or other parties with whom we do business (if they fail to meet the standards we impose) could subject us to significant litigation, monetary damages, regulatory enforcement actions, fines and criminal prosecution in one or more jurisdictions. We are seeing an increase in climate and other sustainability-related regulations and customer requirements globally. In the longer term, such regulations or requirements could impact, for instance, our energy, component and logistic costs or competitiveness of our product offering. Emerging regulation coming from the European Union related to Sustainable Finance, such as the EU Taxonomy Regulation and the new EU Corporate Sustainability Reporting Directive, will lead to more detailed reporting obligations and could also affect how our products and sustainability footprint are perceived by the markets. For example, the EU Taxonomy Regulation aims to define rules for which economic activities contribute to sustainability objectives and mandates companies to report the share of their turnover and capital and operating expenses aligned with specified technical criteria. The EU has first focused on the most polluting industries and therefore not all economic activities have yet been considered in the taxonomy work. Our view is that the role of the technology we provide as an enabler of decarbonization in other sectors, such as R&D investments to improve the energy efficiency of connectivity solutions, is currently not recognized by the Taxonomy. If this potential is left out from the Taxonomy also in the future, or if our offering is not recognized by other similar standards developed, it could potentially have some impact on our financing costs, share price or brand value in the longer term, depending on how such standards are interpreted and used by the markets, financial and investors institutions in the future.

Taxation or other fees collected by governments or governmental agencies may result in unexpected payment obligations, and in response to prevailing difficult economic conditions in the public sector, coupled with already enacted and proposed fundamental changes in international tax regulations, there may be an increased aggressiveness in collecting such fees or taxes. We may be obliged to pay additional taxes for past periods as a result of changes in law, or changes of tax authority practice or interpretation (possibly with retroactive effect in certain cases), or inaccurate interpretations of tax laws by us resulting potentially in a material adverse effect on our cash flow and financial position. In particular, potential changes in re-allocation of taxing rights and other fundamental international tax principles, the OECD Pillar project and digital business-related initiatives, changes in tax laws or global laws regarding transfer pricing could adversely impact our business, operating results and overall tax burden. There may also be unforeseen tax expenses that turn out to have an unfavorable impact on us, adverse tax consequences related to past acquisitions and divestments, and potential tax liabilities that we are currently not aware of. As a result, and given the inherently unpredictable nature of taxation, our tax rate may change from its current level and our cash flows regarding taxes may not be stable. As a company with global operations, we are subject to tax investigations in various jurisdictions, and such proceedings can be lengthy, involve actions that can hinder local operations and affect unrelated parts of our business, and the outcome of such proceedings is difficult to predict. While we have made provisions for certain tax issues, the provisions we have made may not be adequate to cover such increases. In the context of our sale of Devices & Services business to Microsoft, we are required to indemnify Microsoft for certain tax liabilities, including (i) tax liabilities of the Nokia entities acquired by Microsoft in connection with the closing of the sale of Devices & Services business, (ii) tax liabilities associated with the assets acquired by Microsoft and attributable to tax periods ending on or prior to the closing date of the sale of Devices & Services business, and (iii) tax liabilities relating to the pre-closing portion of any taxable period that includes the closing date of the sale of Devices & Services business.

Our success in executing our strategy, to address opportunities in new technologies and business models and customer segments in particular, requires and is dependent on our ability to retain, motivate, develop, reskill and recruit appropriately skilled employees. At the same time, the market for skilled employees is increasingly competitive, particularly given the similar technology trends affecting various industries simultaneously and increased remote working expanding the job market for individual employees. We have encountered, and may in the future encounter, shortages of appropriately skilled employees or lose key employees or senior management. There can be no assurances that we will be able to implement measures successfully to retain or hire the employees we need. This may require significant time, attention and resources from our senior management and other key employees within our organization and may result in increased costs or otherwise have a material adverse effect on us. In March 2021, we announced the plans to reset the cost base of our business groups to invest in future capabilities. We may fail in our efforts to rebalance our workforce as planned, for instance due to legal restrictions or collective bargaining agreements, which may result in a non-optimal workforce, larger than expected costs and not meeting our financial targets for such plans. Our inability to negotiate successfully with employee representatives or failures in our relationships with such representatives could result in strikes and other industrial actions by the employees which may in turn result in significant disruption in our day-to-day operations and higher ongoing labor costs. We continue to have exposure to the health risks of the COVID-19 pandemic and to the control and mitigation measures deployed by governments to reduce the spread of the virus. We believe that this pandemic will permanently increase share of remote working, and we may be exposed to a larger extent than before to impacts related to remote work and arranging the home office, such as increased attrition, decreased creativity or productivity of employees, supervising working hours, challenges in identifying, assessing and supporting employees in stress or poor mental health, inability to help employees to work safely in their home office environment or developing and supervising the execution of related internal policies leading to potential health issues and litigation.

We have an extensive supply network. We, or third parties that we outsource manufacturing/services to, may experience difficulties in adapting supply to meet the changing demand for our products and services, ramping up and down production, adjusting network implementation capabilities as needed on a timely basis, maintaining an optimal inventory level, adopting new manufacturing processes, finding the most timely way to develop the best technical solutions for new products, managing the increasingly complex manufacturing process, service creation and delivery process or achieving required efficiencies and flexibility. In addition, these operations are exposed to various risks and potential liabilities, including those related to geopolitics, compliance with laws and regulations, exposure to environmental liabilities or other claims. Our manufacturing operations depend on obtaining sufficient quantities of fully functional products, components, sub-assemblies, software, services, energy and other resources on a timely basis. For example, the global semiconductor components shortage has constrained our deliveries and the continuing uncertainty around components, raw material availability and potential energy shortages in the market limit our visibility and may continue to have an impact on our ability to supply to our customers and increase our costs. We are working closely not only with our suppliers to ensure component availability but also with our customers to ensure we can meet their needs and mitigate the unprecedented component cost increase our industry faces. In certain cases, a particular component or service may be available only from a limited number of suppliers or from a single supplier in the supply chain. Suppliers may from time to time extend lead times, limit supplies, change their partner preferences, increase prices, provide poor quality supplies or be unable to adapt to changes in demand due to capacity constraints or other factors, which could adversely affect our ability to deliver our products and services on a timely basis or increase our costs. If we fail to properly anticipate customer demand, an over-supply or under-supply of components and production or services delivery capacity could occur. Many of our competitors and also companies from other industries utilize the same contract manufacturers, component suppliers and service vendors. If they have purchased capacity or components ahead of us, or if there is significant consolidation in the relevant supplier base, this could prevent us from acquiring the required components or services, which could limit our ability to supply our customers and increase our costs. Our products are highly complex and defects in their design, manufacture and associated hardware, software, content and installation have occurred in the past and may continue to occur in the future. Quality issues may cause, for instance, delays in deliveries, loss of intellectual property, liabilities for network outages, court fees and fines due to breaches of significantly increasing regulatory privacy requirements and related negative publicity, and additional repair, product replacement or warranty costs to us, and harm our reputation and our ability to sustain or obtain business with our current and potential customers. With respect to our services, quality issues may relate to the challenges of having the services fully operational at the time they are made available to our customers and maintaining them on an ongoing basis. We may also be subject to damages due to product liability claims arising from defective products and components. We make provisions to cover our estimated warranty costs for our products and pending liability claims. We believe our provisions are appropriate, although the ultimate outcome may materially differ from the provisions that are provided for, which could have a material adverse effect on us. A large proportion of Nokia manufacturing, service creation and delivery is carried out by third-party suppliers. These vary in size and often engage a number of tiers of suppliers, which limits Nokia’s direct control. Our suppliers or a supplier may fail to meet our supplier requirements, such as our and our customers’ product quality, safety, security and other standards. Certain suppliers may not comply with local laws, including, among others, local labor law, health and safety or environmental requirements. The activities we manage or that are managed by third parties for us may also be subject to negative publicity and purchasing boycotts, strikes or other forms of social, political, economic or environmental activism. These all can lead to exposure in the form of litigation, product recalls or brand damage through association. Many of our production sites or the production sites of our suppliers/partners are geographically concentrated, with a majority of such suppliers/partners based in Asia. We rely on efficient logistic chain elements, such as regional distribution hubs or transport chain elements (main ports, streets, and airways). In the event that any of these geographic areas are affected by any adverse conditions, such as severe impacts of environmental events, man-made or natural disasters (for instance, flooding, heavy rain or extreme heat that the climate change is expected to further intensify), civil unrest or health crises (such as the COVID-19 pandemic) that disrupt production or deliveries from our suppliers/partners, our ability to deliver our products on a timely basis could be adversely affected. In a similar manner, these adverse conditions may also cause disruption to our service creation and delivery, which, in either case, may lead to a material adverse effect on our business and results of operations.