Universal Registration Document 2020

• deploying within the entities a security reference framework based on the rules of the Agence nationale de la sécurité des systèmes d’information (French NationalAgency for Information Systems Security);
• including a cybersecurity clause in the general terms and conditions of purchase of service provider agreements;
• having the EDF CERT (Computer Emergency Response Team) carry out the incident response function in conjunction with all the Group’s entities and external CERTs, in particular through its integration into the network of the main French CERTs. managed by ANSSI;
• having the entities develop a reference framework identifying and classifying groups of information enabling EDF staff to know the level of sensitivity of the information they create and handle and to protect it accordingly, particularly in the context of the migration of collaborative tools to the Microsoft cloud;
• creating an Information Protection and Cybersecurity Awareness Raising SteeringCommittee tasked with strengthening action and synergies. All Group entities take part in this Committee along with the major French subsidiaries, Framatome, Enedis, EDF RE and Dalkia. The European subsidiaries are shareholders and will take part in 2021, in compliance with the rules of management independence that apply to regulated subsidiaries;
• the first joint action of this Committee is setting up mandatory training for Group managers in Cybersecurity and information protection (Cybersecurity Passport).

In addition, IS crisis drills are regularly carried out to test the various measures put in place.

4E – Operational continuity of supply chains and contractual relationships.

Criticality in view of the control actions undertaken: Intermediate.

The Group’s needs may arise in markets with a reduced area or in markets subject to growing pressure, due in particular to the structure and evolution of the industrial offer or to increased competition from new uses that make the Group’s industrial uses less attractive or more expensive. This pressure is attributable in particular to the growing needs of information systems and the needs of energy actors, especially those related to climate transition. These market pressures may increase the cost of supplying certain critical products or services and lead to a reduction in supply by some suppliers in response to a contraction in their margins. Fluctuations in the price and availability of certain raw materials or products that play a key role in setting the price of electricity and energy services may affect the Group’s supply capacity and results.

The Group uses technologies, mainly in the fields of nuclear, hydraulic or renewable energy generation, electrical storage or mobility, that require materials or elements that may be highly sensitive in terms of access⁽¹⁾. The scarcity or conditions of access to certain raw materials may be critical for the Group due to geological, geopolitical, industrial, regulatory or competitive limitations, particularly in a context of energy transition. Certain crisis situations, such as the Covid health crisis, may also accentuate or generate difficulties of access to certain products, materials or services required for the Group’s activities and may make performing certain services particularly complex or delay their completion. The development of uses, particularly related to storage, the growth of renewable energies and the penetration of low-carbon electricity, could pose problems of access to certain materials: Lithium for batteries, ferromagnetic rare earths for wind power, Indium or Selenium for solar energy. These difficulties could limit the Group’s ability to achieve its development objectives. In addition, control of the conditions under which raw or semi-finished materials are extracted, processed, packaged or made available for the Group’s needs may be subject to provisions calling for greater control of regulatory requirements and a duty of vigilance.

Moreover, the Group currently depends on a limited number of industrial players with specific skills and the required experience. This situation reduces competition in markets where EDF is a buyer and exposes the Group to the default risk of one or more of these specialised suppliers or service providers. Restructuring observed at the level of major groups (GE, ABB, ENGIE, Rolls-Royce, Bilfinger, etc.), some of which are under pressure from activist minority funds, may also have an impact on the quality and operational continuity of contracts in progress, or the cost of services rendered and products delivered. But apart from the large groups, it is the small and medium-sized French companies that represent the essential part of the industrial fabric of suppliers. These companies have so far weathered the Covid crisis relatively well. Indeed, those companies that were the most affected suffered from their exposure to the aeronautics, oil and automotive sectors rather than the nuclear sector, as the nuclear sector continued to ensure sustained activity thanks to the major maintenance projects underway in France in particular. However, the trend of financial fragility observed over the last ten years or so continues, although bankruptcies, which are limited in number, generally end in a takeover and provide an opportunity for revitalisation. Regular monitoring of the situation of these suppliers is carried out through specific reviews.

There may also be difficulties in terms of relationships with the partners involved withEDF in completing these projects. Trade tensions between the United States andChina could have an impact on the conduct of some of these projects given the technologies and partnerships implemented.

In this regard, in October 2018, the US Department of Energy (“US DoE”) issued a decision on civil nuclear cooperation with China which deals in particular with the transfer of US goods and technology, or goods and technology of US origin, to CGN(which is a partner of EDF, in particular in New Nuclear projects in the UK), its subsidiaries and related entities. This decision concerns technologies relating to equipment within or directly attached to the vessel of the nuclear reactor, core power control equipment and equipment that contains or is in direct contact with the primary fluid. On 14 August 2019, the United States Department of Commerce (“USDoC”) issued a ruling placing four CGN Group entities on the list of entities subject to restrictions (“Entity List”) concerning any transfer of goods and technology, in particular US dual-use goods and technology, or dual-use goods and technology ofUS origin (or including a certain percentage of US content) subject to the jurisdiction of the US DoC (export administration regulations: covering all goods and technology, in particular dual-use commercial goods and technology, other than those subject to the jurisdiction of the US DoE and the Nuclear Regulatory Agency). As a result of these decisions, the transfer of goods and technology to the entities in question for the technical scope covering them under the decisions, must be specifically authorised in advance by the competent US courts, with the presumption that such authorisation will be refused.

In addition, the US Department of Defense published in June 2020 a list of entities, including CGN, presumed to belong to or be affiliated with the Chinese army. As a result of these measures, the People’s Republic of China enacted its first integrated law on the control of exports of sensitive goods and technologies (December 2020),as well as a “blocking law” against decisions, particularly those of the United States, that are extraterritorial in scope (January 2021). In response, and in order to ensure its compliance with these laws and decisions, the EDF group (EDF SA, NNB, Framatome, etc.) has taken precautionary measures in connection with the organisation of its nuclear projects, particularly in the United Kingdom.

The Excell plan aims to meet these challenges: strengthening the sector’s skills (welding plan and actions in connection with professional and educational structures), improving supplier selection and qualification processes, taking into account the “Ethics and human rights” and “Territorial development” CSR issues (see sections 3.3.2 and 3.4.2), as well as increasing the number of more partnership-based contractual terms and conditions. GIFEN⁽²⁾ is also a key player as a relay for the Group’s industrial policy.

The Group’s performance is also based on the contracts signed with suppliers of equipment or services. Improved contractualisation and management of the contracts that have been entered into, in particular through the implementation of vigilance actions at each stage, is a major issue in terms of controlling operations, deadlines and associated costs.