Risk management structure

Yaskawa monitors risks related to the status of management operations, including economic conditions and market trends, through executive meetings such as the Executive Committee and the Board of Directors. Furthermore, in order to respond swiftly and appropriately to risks that may directly or indirectly affect the management or business operations of the Group, we have established the Risk Management Committee under the Board of Directors. The committee, chaired by the executive officer in charge of risk management and crisis management, is responsible for establishing, promoting, and overseeing the Company-wide risk management framework and mechanisms. In addition, several specialized committees—including the Environmental Promotion Committee, the Information Security Committee, and the Compliance Committee—are organized under the Risk Management Committee to enhance daily risk-related activities.
To comprehensively and integratively manage risks within the Company and its affiliated companies, the Company has developed and operates an Enterprise Risk Management (ERM) system under the supervision of the Risk Management Committee. The status of risk management based on the ERM framework is regularly reported to executive bodies such as the Management Council, the Board of Directors, and the Sustainability Committee, where monitoring is conducted regarding the effectiveness of the risk management structure and mechanisms.
Moreover, in the event that a risk materializes and escalates into a crisis, we have established a structure to ensure rapid response, centered on the executive officer responsible for crisis management and the Crisis Management Office. Specific procedures—such as the establishment of a crisis response headquarters according to the severity of the crisis—are defined in the Basic Crisis Management Regulations and are appropriately implemented.

Risk management structure

Risk management initiatives

In the ERM process, Yaskawa identifies and visualizes risks across the Group, evaluates the inherent risk of each item and the corresponding controls using common assessment criteria, and determines the level of residual risk.
Risks are categorized into four levels—“Extremely serious,” “Serious,” “Moderate,” and “Minor.” Based on this prioritization, Yaskawa formulates and implements response policies and action plans to reduce residual risks.
The results of these assessments are reported to the Risk Management Committee on a semiannual basis for monitoring. Furthermore, by continuously operating the PDCA cycle within risk management, the Company works to improve and reinforce its risk management activities.

Management cycle under ERM

Yaskawa Group information security [basic policy]
Protection and maintenance of management and customer information assets by zero trust security

The Yaskawa Group has established a robust and stable information security framework based on the principles of “zero trust security”, thereby reducing vulnerability to external threats.
Specifically, as part of our YDX (YASKAWA Digital Transformation) initiatives centered on i³-Mechatronics, we implement secure storage of management and customer information assets through the “Yaskawa Data Lake,” strengthen security measures across internal systems, and carry out prompt emergency responses. We have also enhanced global threat intelligence monitoring and risk mitigation across the entire Yaskawa Group.
Recognizing information as a vital management asset, we undertake continuous efforts to safeguard it against threats such as accidents, natural disasters, and cybercrime, and to ensure ongoing security in accordance with the following policies.

Management responsibility

Yaskawa strives to systematically and continuously improve information security under the leadership of management.

Development of internal systems

Yaskawa establishes roles and responsibilities related to information security, establishes an organization for maintenance and improvement, and establishes a system to manage and operate it systematically.

Response to risk assessment

Yaskawa appropriately manages information security risks by first defining “risk levels” that indicate the magnitude of each risk and implementing countermeasures tailored to those levels. As part of this initiative, we analyze risks from multiple perspectives and assess potential threats and vulnerabilities, enabling us to identify emerging issues at an early stage.
Based on the results of these assessments, we continuously review and enhance our information security measures to ensure that they remain up to date.
Furthermore, by strengthening our collaboration with the Risk Management Committee, we reinforce Company-wide risk management through the monitoring of critical risks and the planning and execution of improvement measures.

Employee initiatives

Yaskawa ensures that all employees fully understand that protecting management and customer information assets is fundamental to Yaskawa’s business continuity activities and an important corporate social responsibility, and provides appropriate education and training to all employees.

Compliance with legal requirements

Yaskawa complies with and respects the obligations of laws, regulations and guidelines related to information security.

Response to information security incidents and accidents

When an incident involving information security occurs, Yaskawa promptly investigates the cause and implements countermeasures to minimize the impact. We also take appropriate measures, including preventive measures and recurrence prevention of information security incidents.

Information security system

Yaskawa has established the Information Security Committee under the Chief Information Security Officer (CISO) to oversee company-wide security initiatives and strengthen information security.
In addition, promotion officers are assigned at domestic and overseas sites, business divisions, and subsidiaries to ensure a consistent and unified approach across the entire organization.
We also adopt a three‑line defense security framework to protect against risks from multiple dimensions. To maintain and further enhance this framework, we make use of an external Security Operation Center (SOC). By incorporating monitoring and expert advice from external specialists, we ensure a higher level of security and resilience.

Status of response to data breaches and incidents

With the ongoing activities of the internal Security Incident Response Team (SIRT), there have not been any serious data breaches or incidents that could affect company management. (As of February 2026)
In addition, daily security measures are in place against ransomware and targeted attack e-mails preventing infection or business impact.

Training employees on risks and responses related to data security and privacy

Yaskawa has established the “Company Information Management Rules” to ensure the secure handling of important information assets, including personal information. These regulations set forth the information security rules that officers and employees (including contractors) are required to follow, and based on these rules, we have created and disseminated the “Company Information Management Manual.”
This manual defines confidentiality levels for data entrusted to us by business partners as well as confidential information handled internally. It also prescribes appropriate procedures throughout the entire operational process—from creation, acquisition, and use, to disclosure and disposal—to ensure proper and secure management of such information.
In addition, under the leadership of the Chief Information Security Officer (CISO), we have established both the Information Systems Management Division and the Security Incident Response Team (SIRT), thereby strengthening security across the entire organization.

Our principal security measures include the following initiatives:

• Enhancing the security of file exchanges with external parties (supervisor approval and automatic file encryption)
• Reducing the risk of virus intrusion by separating internet connectivity
• Implementing multi-layered protection for internal systems using security appliances
• 24-hour monitoring through a Security Operation Center (SOC)
• Conducting annual information security e-learning for all employees

Furthermore, we regularly issue security reminders to raise awareness among individual employees. In addition, we share monthly updates on preventive measures against risks, as well as information on any incidents and corresponding responses, thereby contributing to the enhancement of the overall security level across the organization.