Enterprise Risk Management
In order to improve and implement the risk and opportunity management mechanism, the Company has established the “
Risk Management Policy and Procedures ” to carry out risk management aimed at uncertain factors that may threaten the Company’s operations, improve the efficiency in division of labor in risk management, and ensure the achievement of the Company’s operational goals.
Risk Management Framework
The Board of Directors is the highest governing body for EVA Air’s risk and opportunity management and is responsible for approving the Company’s risk management policies, procedures, and organizational framework. The Sustainability Committee, a committee under the Board of Directors, is responsible for reviewing risk management policies and overseeing the implementation of risk management-related decisions and operational mechanisms, and regularly reports implementation results to the Board of Directors on an annual basis.
The ESG Committee is responsible for planning, implementing, and monitoring risk management-related activities. Through its quarterly meetings, the Committee directs responsible departments in implementing risk management policies and tracking the execution of risk control measures and improvement actions, and reports implementation results to the Sustainability Committee annually.
Through annual internal control self-assessments and external audits conducted every two years by an independent third-party assurance provider, EVA Air verifies the compliance and effectiveness of its risk management processes and continuously monitors the effectiveness of its risk management framework. To ensure compliance and effectiveness of our risk management processes, EVA Air conducts annual internal control self-assessment audits, and conducts external audits every two years by a third-party verification body. Our most recent external audit for risk management process compliance and operating performance was completed by Bureau Veritas Certification (BVC) on June 17, 2026.
Enterprise Risk and Opportunity Management Process
The ESG Committee’s working groups identify potential risks and opportunities arising from operations, and define the time horizons for the short, medium, and long term.
The identified risks and opportunities are assessed for their impact and likelihood, while risks are additionally assessed for their velocity of occurrence, to determine materiality.
Responsible departments assess the Company's risk appetite (risk tolerance) and determine when the impacts of identified risks and opportunities are reasonably expected to occur. Based on the assessment results, we develop response actions, establish relevant risk and opportunity management targets and metrics, and regularly report progress to the ESG Committee for monitoring.
The ESG Committee reports the overall effectiveness of the Company's risk and opportunity management annually to the Sustainability Committee and the Board of Directors, and discloses relevant information in accordance with applicable regulations.
EVA Air references the ISO 31000 Risk Management Framework, the Committee of Sponsoring Organizations of the Treadway Commission (COSO) Risk Assessment in Practice methodology, and the IFRS Sustainability Disclosure Standards to identify, assess, manage, and disclose economic (including corporate governance), environmental, social, and material topic-related risks that may arise from its operations, based on the principle of materiality. This year, the assessment scope was further expanded to include consolidated subsidiaries, enabling a more comprehensive evaluation of enterprise-wide operational risks.
During the assessment process, identified risks and opportunities are evaluated using a five-point scale based on their impact and likelihood. For risks, the assessment also considers risk velocity to support a comprehensive evaluation. The assessment covers strategic, operational, financial, climate-related, and emerging risks.
Taking into account the Company's overall business strategy and operating environment, the ESG Committee evaluates the Company's risk appetite and the potential of identified opportunities based on the assessment results. The evaluation is submitted to the President for approval and serves as the basis for subsequent risk response and opportunity management, ensuring that risks remain within the Company's acceptable risk tolerance while enabling the Company to capitalize on potential opportunities.
Sensitivity analysis of non-financial risks
Strategic Risk
This includes risks to EVA’s operations presented by changes in the external environment, such as the international political/ economic situation, industry development trends, market competition, branding, intellectual capital, etc.
Operational Risk
This includes risks that may create negative impacts on EVA’s operations, such as market changes, flight safety, information security, privacy protections, labor relations, legal compliance, supply chain management, and other risks that might potentially create negative operational impacts.
Financial Risk
Foreign exchange risk, investment risk, capital risk, liquidity risk, credit risk, hedging operations, etc., that may cause possible losses.
Environmental Risk
This includes risks arising from actions in response to climate change, natural disasters, and other such issues. Specific issues include greenhouse gas emissions management, carbon credit management, energy management, biodiversity, natural resources, and other such issues, as well as risks arising from requirements to comply with international and local environmental laws or environmental assessments.
Mid- and Long-term Emerging Risk
Emerging risks that may result in a certain level of impact on EVA’s management, operations, strategy, etc. over the next three to five years.
Identification of Emerging Risk
As the global aviation industry faces increasingly stringent regulatory requirements, climate change, information security threats, geopolitical developments, and the rapid advancement of emerging technologies, companies are exposed to growing uncertainty. Emerging risks have therefore become one of the key issues requiring careful assessment by airlines. By proactively identifying, analyzing, and developing appropriate response measures, EVA Air seeks to address emerging risks at an early stage and minimize their potential impacts on operations.
With reference to the Global Risks Report published annually by the World Economic Forum (WEF), each action group under the ESG Committee identifies emerging risks within its area of responsibility and conducts risk factor assessments. Based on the assessment results, corresponding response measures are developed, and the outcomes are regularly reported to the Sustainability Committee and the Board of Directors.
Emerging Risk Identification Results
01 Emerging Technologies and Misinformation / Technology
The rapid advancement of generative AI and digital technologies has enabled highly convincing misinformation, such as manipulated images and fraudulent websites, to be created and disseminated at scale, making it increasingly difficult to distinguish authentic information from false content. When public awareness and digital literacy fail to keep pace with technological advances, misinformation can spread rapidly and be widely believed. This may erode stakeholder trust, resulting in operational disruption, financial losses, and reputational damage, thereby posing a significant threat to the Company's operational resilience and brand reputation. |
| Impact on Our Operations |
Emerging forms of misinformation, such as fake flight information and phishing websites, may mislead passengers and fraudulently obtain sensitive personal information, resulting in significant reputational damage. Internally, the use of AI applications involving sensitive information may increase the risk of data breaches in the event of cyberattacks. Overreliance on or misuse of AI may also lead to poor decision-making and increased operating costs. In addition, when the Company's brand is impersonated or misused, additional resources are required for public clarification and customer support. Collectively, these risks pose challenges to operational stability and resilience, underscoring the need to continuously strengthen cybersecurity protection and incident response capabilities.
|
| Mitigating Actions |
EVA Air continues to strengthen its cybersecurity and digital risk management framework through identity verification mechanisms, data protection measures, and website security management to mitigate the risks of personal data breaches, fraudulent transactions, and identity impersonation. We also continue to enhance the security and authenticity of our official digital platforms and strengthen brand recognition, while promoting cybersecurity awareness and online safety practices through multiple communication channels.
In addition, we have established cybersecurity incident reporting, cross-functional response, and external notification mechanisms to ensure the timely investigation, clarification, and implementation of appropriate response measures upon receiving notifications from competent authorities or relevant organizations. When necessary, accurate information is promptly communicated through official channels.
To address emerging risks associated with new technologies, including AI-enabled misinformation, EVA Air continuously monitors the external digital environment, conducts regular cybersecurity and social engineering awareness training, and establishes AI governance principles and guidelines for the responsible use of AI. These efforts enhance the Company's operational resilience while safeguarding its reputation and maintaining stakeholder trust.
|
02 Talent Availability and Evolving Skill Requirements / Social
Demographic shifts, including declining birth rates and population aging, have contributed to a sustained tightening of the labor market. At the same time, the rapid advancement of generative AI and technologies supporting the green transition is reshaping demand for highly skilled digital and emerging technology talent. These structural changes may affect the Company's ability to acquire critical capabilities, strengthen operational resilience, and execute its transformation strategy, potentially constraining innovation and adversely affecting its overall operations and competitiveness. |
| Impact on Our Operations |
EVA Air may face the dual challenges of a tightening labor market and accelerating technological transformation. Failure to attract and develop qualified talent through industry–academia partnerships and diversified recruitment channels could result in workforce shortages and gaps in critical capabilities. This may directly affect the implementation of the Company's internal and customer-facing AI initiatives and the efficiency of automated services, while also hindering the execution of Sustainable Aviation Fuel (SAF) procurement strategies and decarbonization initiatives. In addition, intense competition for digital talent, particularly from the technology sector, may further constrain the Company's ability to attract and retain key talent. A shortage of professionals with digital and green transition skills could limit innovation, weaken operational resilience, and reduce the Company's long-term competitiveness in the global aviation industry.
|
| Mitigating Actions |
To address evolving talent requirements, EVA Air regularly reviews its compensation and benefits programs while continuing to strengthen employees' capabilities in digital technologies, artificial intelligence (AI), and ESG-related competencies. At the same time, we are actively deploying AI-powered customer services and office process automation to enhance operational efficiency and reduce administrative workloads.
In addition, we partner with external professional institutions to offer a Certified Professional in Corporation Sustainability Management training program, cultivating digital and green talent while enhancing employees' sustainability expertise and capabilities. These initiatives support the Company's sustainability transformation and strengthen its long-term competitiveness.
|
Risk Management Culture
To embed risk awareness into employees' daily operations, EVA Air fosters a strong risk management culture through a range of initiatives, reinforcing enterprise risk management and internal control.
- Training and Awareness
EVA Air adopts both top-down and bottom-up approaches to risk management. Each year, we invite external experts to deliver 6 hours of continuing education for Directors, with course topics tailored to their professional backgrounds and development needs. In 2025, Directors attended training sessions on Risk Management – Natural Risk Analysis and Circular Economy and Trump 2.0-Global Economic and Industrial Outlook in October.
To strengthen risk awareness across the organization, EVA Air also provides annual risk management training for all employees and regularly communicates risk management requirements and best practices, reinforcing a safety-first mindset throughout the Company. In 2025, a total of 12,024 training participations were completed, achieving a 100% completion rate.
- Risk Management Incentive Mechanism
EVA Air incorporates risk management performance into its employee evaluation and incentive framework. Individual performance, project execution, and risk management capabilities are considered when determining performance-based incentives, encouraging employees to proactively integrate risk management into their daily responsibilities.
