Risk Management

• Impacts on the company's strategy impeding the continuity of operations and business development as a result of being unable to comply with enactment and revisions to laws and regulations, or changes in operations by government agencies in countries or regions where we operate businesses related to AI.
• Violation of laws and regulations to be complied with in relation to AI may lead to loss of social credibility and trust in the company, and economic and financial losses (penalties).
• If stricter or unforeseeable laws and regulations, etc. related to AI are enacted in the future, to the extent that they affect technological innovation, research and development, and new investments, etc., it will inhibit the creation or development of the company's new businesses, or impede the continuity of existing businesses.

With the advent of generative AI^*1 that can be used interactively, and its deployment into AI agents^*2 that autonomously examine and execute tasks on behalf of users, AI is expected to continue making a significant contribution to improved business productivity.

In addition to actively utilizing AI in various operations to realize improvements and streamlining, the SoftBank group proposes and sells related products and services to its client companies, etc. For example, the group began offering a beta version of the generative AI agent service “satto” in August 2024.

Also, to make our corporate philosophy of “Information Revolution — Happiness for everyone” a reality by achieving SoftBank's long-term vision of providing next-generation digital infrastructure that is essential for the development of a digital society that we announced in May 2023, we are also working on building distributed AI data centers and digital infrastructure that supports a society able to coexist with AI. Following the company's certification from the Ministry of Economy, Trade and Industry for the plan to secure the supply of “Cloud Programs,” a specified critical product under the Economic Security Promotion Act in May 2024, we are making capital investments of approximately 150 billion yen to expand our AI computing infrastructure and are building new AI computing infrastructure at multiple locations across Japan between FY2024 and FY2025.

Meanwhile, the World Economic Forum (WEF) Global Risks Report 2025, following the 2024 report, ranked “misinformation and disinformation” as the most serious global short-term risk (next two years), and “adverse outcomes of AI technology” as a long-term risk (next 10 years). The fact that it is now possible to use AI technology without needing advanced technology or specialized knowledge has made it even easier to spread misinformation and disinformation. This causes not only new confusion and anxiety in society, but also political and economic security concerns that have led some countries to consider regulation. In Japan, the AI Utilization Promotion Act^*3 was passed and enacted by the House of Councilors on May 28, 2025, requiring developers and businesses that use AI to strive to use AI technology appropriately, ensure transparency and fairness, and protect the rights and interests of users.

Amid these circumstances, SoftBank believes that the implementation of “responsible AI”^*4 is essential, and utilizes AI, proposes and sells AI-related products and services to client companies, and conducts development of generative AI and AI agents, etc. However, if stricter laws or regulations were to be enacted in the future and we were unable to properly respond thereto, the group's AI-related business plans may be significantly delayed.

Furthermore, if we were to violate relevant laws and regulations, for example, by leaking confidential or personal information in the use of our generative AI, or by infringing on copyrights of third parties in our use of generated work, we could lose our social credibility and trust, as well as incur economic and financial losses (penalties). Additionally, if our involvement in or response to the formulation of rules such as laws and regulations related to AI is delayed, it could affect our strategies, thus hindering the continuity of operations and business development.

[Notes]

1. *1
   Artificial intelligence capable of generating various content, including text, images, and programming code.
2. *2
   AI technology that autonomously selects the optimal means to achieve a goal and carries out the task on behalf of the user.
3. *3
   Act on the Promotion of Research, Development, and Utilization of Artificial Intelligence-Related Technologies.
4. *4
   This refers to companies and organizations taking responsibility for addressing issues and potential risks related to AI, such as ethics, privacy, and security, and developing and providing AI services that are reliable and fair.

Under our “Beyond Carrier” strategy, we are working to provide innovative services and promote digital transformation by utilizing cutting-edge technologies such as AI and IoT. In particular, as the use of AI is expanding, ethical considerations are becoming more important, and so we formulated the SoftBank AI Ethics Policy in 2022 to ensure appropriate use of AI and the provision of safe and secure services. Specifically, it sets forth guidelines across six categories: human-centered principles, respect for fairness, pursuit of transparency and accountability, safety assurance, privacy protection and security assurance, and education for AI talent and literacy. We have declared that we will operate our business and develop services in accordance with these guidelines. We have established various internal rules such as regulations, standards, guidelines, and checklists based on the AI Ethics Policy, and in formulating these rules, we took into consideration compliance with the Social Principles of Human-Centric AI created by the Cabinet Office, which form the basis of the AI Guidelines for Business (Version 1.0), the AI Development Guidelines and AI Utilization Guidelines created by the Ministry of Internal Affairs and Communications, and the Governance Guidelines for Implementation of AI Principles created by the Ministry of Economy, Trade and Industry. Furthermore, there is a system in place to be able to apply this policy to group companies, and as of March 1, 2025, 74 companies have adopted it. In addition, we are working to mitigate risk by conducting risk assessments for group companies based on the risk perspectives in the AI governance that we have established.

As the strategic division for our AI business, the AI Strategy Office is tasked with the mission of promoting AI governance at SoftBank. Within that, we have established the AI Governance Promotion Office as an independent, specialized division to promote governance in the divisions of the company that use AI, and this office is managed and supervised by a steering committee consisting of the CIO(Chief Information Officer), CDO(Chief Data Officer), CISO(Chief Information Security Officer), and CCO(Chief Compliance Officer). In April 2024, we established the AI Ethics Committee, an advisory board for AI governance composed of external expert members and internal members. The external expert members come from a wide range of specialized fields, including AI ethics and AI technology in general, data governance, finance, law, consumers, and ESG (environment, social, and governance). They discuss and offer recommendations on various issues related to AI ethics, as well as share their knowledge on the latest trends both in Japan and overseas. As AI technology rapidly evolves and the associated challenges become more complex on a global scale, by incorporating the diverse perspectives and knowledge of external experts, we are able to achieve objective and highly effective AI governance that takes into account the perspectives of our customers.

In addition, in our AI governance promotion strategy, we place importance on promoting AI ethics and governance education. Specifically, we provide education to all employees, including executives, through initiatives such as e-learning (once a year), study sessions (twice a year), and a monthly email newsletter. The agenda for educational content includes case studies of AI incidents occurring both in Japan and overseas, precautions to take when using AI, including generative AI (bias, information leaks, copyright infringement, hallucinations, etc.), and social trends regarding AI ethics as we work to improve literacy for all employees.

• If our core systems were to stop functioning and communications services were to be interrupted, our ability to provide services to customers would be hindered, leading to a loss of customers.
• The suspension of services we provide and data encryption (ransomware) could disrupt our business operations, making business continuity difficult.
• Theft or leakage of data that includes personal information could result in administrative sanctions or fines from supervisory authorities.

In recent years, with the international situation growing more unstable due to Russia's invasion of Ukraine, the Middle East conflict that began in Gaza, and the deterioration of relations between the US and China and between South Korea and North Korea, cyberattacks that appear to be state-sponsored are on the rise. Furthermore, as AI technological innovation progresses and the range of users expands, even attackers with little technical expertise can carry out cybercrime with the help of AI, which has dramatically increased the speed and scale of attacks. For example, generative AI can automatically generate natural, persuasive sentences and code, making the creation of malware and other programs much easier and more sophisticated. The World Economic Forum's Global Cybersecurity Outlook 2025 highlights the fact that nearly 60% of organizations stated that geopolitical tensions have affected their cybersecurity strategy, and 47% cite adversarial advances powered by generative AI as their primary concern.

In the telecommunications industry, the spread of 5G and IoT has made communications infrastructure highly complex, thereby increasing new points to attack. Furthermore, new vulnerabilities have emerged, making for targets that are easier to attack. For us as a telecommunications company, the negative aspects of these technological innovations could pose medium- to long-term risks that threaten the stable provision of telecommunications networks.

As a telecommunications company, we transmit and store large volumes of confidential data (with a cumulative total of 31.77 million smartphone contracts in the fiscal year ending March 31, 2025), so if unauthorized access through a cyberattack or a ransomware attack were to occur and data that includes personal information were to be stolen or leaked, this could damage customer trust and lead to a loss of customers.

In addition, we do business with several thousand companies, and if an attacker were to use malware to encrypt our internal systems or servers and halt operations, and we are not able to respond appropriately, it may become difficult for us to continue our business. This is not limited to our company, as the disruption of our supply chains in Japan and overseas, including those of our business partners, by a cyberattack due to geopolitical factors may delay the supply of important telecommunications equipment, etc., which could disrupt our ability to provide services.

Furthermore, communications infrastructure is the foundation of society, and its destruction could have a major impact on society, which could act as a motive for attacks. According to a survey by Check Point Software Technologies (Q1 2025), as cyberattacks continue to surge around the world, the telecommunications industry reported the highest percentage increase by any industry, with a massive 94% year-on-year increase. SoftBank was designated as a specified essential infrastructure service provider (essential infrastructure business) in the telecommunications business sector under the Economic Security Promotion Act^*1 on November 16, 2023. If a cyberattack were to disrupt the maintenance and management of critical telecommunications equipment and affect the provision of telecommunications services, not only could we be subject to penalties from the supervisory authorities, but social credibility and trust in the company could also be damaged.

[Note]

1. *1
   Act on the Promotion of Ensuring National Security through Integrated Implementation of Economic Measures

At SoftBank, approximately 40,000 people, including employees and contractors, use approximately 100,000 devices and over 1,000 IT systems to carry out their work. In an IT environment on such a large scale, many security events occur on a daily basis, including external reconnaissance, attacks targeting vulnerabilities, viruses, and phishing.

Our countermeasures include compliance with laws, regulations, and other norms related to information security and establishment of an information security management system aimed at protecting information assets and defending against cyberattacks. Specifically, we have established an Information Security Policy that employees must comply with, appointed a Chief Information Security Officer (CISO), and furthermore, organized the Information Security Committee chaired by the CISO and the SoftBank Computer Security Incident Response Team (SoftBank CSIRT) to review measures in response to environmental changes and technological innovations and share information that is useful in information security and cybersecurity measures.

The SoftBank CSIRT is made up of members from the Security Department and members appointed by the heads of each department under the CISO to prevent security incidents and minimize damage through rapid incident response, and in addition, the CSIRT Office has been established to respond to incidents together with the Information Security Committee Office and related organizations both inside and outside the company. In addition, to prevent incidents from occurring, we deal with vulnerabilities (collecting and analyzing information, requesting responses, and monitoring the status of responses), establish security rules, provide security education, and issue warnings, and to prepare for incidents, we develop procedures for responding when incidents occur and conduct incident response training. Similarly, risk management systems have been established for our affiliate companies (subsidiaries and affiliates). We have established the SBKK Group Security Committee, chaired by the CISO and comprised of information security managers from affiliate companies, to share information, provide education and training, and cooperate in responding to incidents when they occur. Additionally, we are working to reduce and prevent risks related to information security and cyber security by formulating the SoftBank Affiliate Company Security Guidelines, which stipulate the systems and compliance rules required for appropriate security management at affiliate companies.

Furthermore, the number of actual cyberattacks against our company in FY2023 reached 16 billion security events per day, with 12 million reconnaissance and vulnerability-targeting attacks and 80 thousand viruses and phishing emails. To combat these cyberattacks, we are implementing multiple security solutions as countermeasures and working daily to strengthen our cybersecurity.