CSX Corporation: 10-K Risk Factor Changes

A train accident involving the transport of hazardous materials could result in significant costs and claims arising from personal injury, property or natural resource damage, environmental penalties and remediation obligations. Such claims, if insured, could exceed existing insurance coverage or insurance may not continue to be available at commercially reasonable rates, which could have a material adverse effect on the Company's results of operations, financial condition, and liquidity. Under federal regulations, CSXT is required to transport certain hazardous materials under the legal duty referred to as the common carrier mandate regardless of risk or potential exposure to loss. CSX 2025 Form 10-K p.9 CSX 2025 Form 10-K p.9 CSX 2025 Form 10-K p.9 CSX 2025 Form 10-K p.9 CSX 2025 Form 10-K p.9 CSX 2025 Form 10-K p.9

A train accident involving the transport of hazardous materials could result in significant costs and claims arising from personal injury, property or natural resource damage, environmental penalties and remediation obligations. Such claims, if insured, could exceed existing insurance coverage or insurance may not continue to be available at commercially reasonable rates, which could have a material adverse effect on the Company's results of operations, financial condition, and liquidity. Under federal regulations, CSXT is required to transport certain hazardous materials under the legal duty referred to as the common carrier mandate regardless of risk or potential exposure to loss. CSX 2024 Form 10-K p.9 CSX 2024 Form 10-K p.9 CSX 2024 Form 10-K p.9 CSX 2024 Form 10-K p.9 CSX 2024 Form 10-K p.9 CSX 2024 Form 10-K p.9

The Company's operations may be affected by external factors such as severe weather and other natural occurrences, including floods, hurricanes, fires and earthquakes. As a result, the Company's rail network may be damaged, its workforce may be unavailable, fuel costs may rise and significant business interruptions could occur. In addition, the performance of locomotives and railcars could be adversely affected by extreme weather conditions. Hurricanes as well as storm and flooding events have impacted the Company's network in the past, leading to interrupted service and damage to track structure and equipment. Changes in weather patterns are expected to increase the frequency, severity or duration of certain adverse weather conditions. Insurance maintained by the Company to protect against loss of business and other related consequences resulting from these natural occurrences is subject to coverage limitations, depending on the nature of the risk insured. This insurance may not be sufficient to cover all of the Company's damages or damages to others, and this insurance may not continue to be available at commercially reasonable rates. Even with insurance, if any natural occurrence leads to a catastrophic interruption of service, the Company may not be able to restore service without a significant interruption to operations. CSX 2025 Form 10-K p.10 CSX 2025 Form 10-K p.10 CSX 2025 Form 10-K p.10 CSX 2025 Form 10-K p.10 CSX 2025 Form 10-K p.10 CSX 2025 Form 10-K p.10

The Company's operations may be affected by external factors such as severe weather and other natural occurrences, including floods, hurricanes, fires and earthquakes. As a result, the Company's rail network may be damaged, its workforce may be unavailable, fuel costs may rise and significant business interruptions could occur. In addition, the performance of locomotives and railcars could be adversely affected by extreme weather conditions. Hurricanes as well as storm and flooding events have impacted the Company's network in the past, leading to interrupted service and damage to track structure and equipment. Changes in weather patterns are expected to increase the frequency, severity or duration of certain adverse weather conditions. Insurance maintained by the Company to protect against loss of business and other related consequences resulting from these natural occurrences is subject to coverage limitations, depending on the nature of the risk insured. This insurance may not be sufficient to cover all of the Company's damages or damages to others, and this insurance may not continue to be available at commercially reasonable rates. Even with insurance, if any natural occurrence leads to a catastrophic interruption of service, the Company may not be able to restore service without a significant interruption to operations.

The Company regularly relies on capital markets for the issuance of long-term debt instruments, commercial paper and bank financing from time to time. Instability or disruptions of the capital markets, including credit markets, significant increases in interest rates, or the deterioration of the Company’s financial condition due to internal or external factors, could restrict or prohibit access and could increase financing costs. A significant deterioration of the Company’s financial condition could also reduce credit ratings and could limit or affect its access to external sources of capital and increase the costs of short and long-term debt financing. CSX 2025 Form 10-K p.11 CSX 2025 Form 10-K p.11 CSX 2025 Form 10-K p.11 CSX 2025 Form 10-K p.11 CSX 2025 Form 10-K p.11 CSX 2025 Form 10-K p.11

The Company regularly relies on capital markets for the issuance of long-term debt instruments, commercial paper and bank financing from time to time. Instability or disruptions of the capital markets, including credit markets, significant increases in interest rates, or the deterioration of the Company’s financial condition due to internal or external factors, could restrict or prohibit access and could increase financing costs. A significant deterioration of the Company’s financial condition could also reduce credit ratings and could limit or affect its access to external sources of capital and increase the costs of short and long-term debt financing.

Marketplace conditions for resources like locomotives and the availability of qualified personnel, including engineers and conductors as well as other skilled professional or technical employees, could each have a negative impact on the Company’s ability to meet demand for rail service. Although the Company strives to maintain adequate resources and personnel for the current business environment, unpredictable increases in demand for rail services or extreme weather conditions may exacerbate such risks, which could have a negative impact on the Company’s operational efficiency and otherwise have a material adverse effect on the Company’s financial condition, results of operations, or liquidity in a particular period.

Marketplace conditions for resources like locomotives and the availability of qualified personnel, including engineers and conductors as well as other skilled professional or technical employees, could each have a negative impact on the Company’s ability to meet demand for rail service. Although the Company strives to maintain adequate resources and personnel for the current business environment, unpredictable increases in demand for rail services or extreme weather conditions may exacerbate such risks, which could have a negative impact on the Company’s operational efficiency and otherwise have a material adverse effect on the Company’s financial condition, results of operations, or liquidity in a particular period. CSX 2024 Form 10-K p.11 CSX 2024 Form 10-K p.11 CSX 2024 Form 10-K p.11 CSX 2024 Form 10-K p.11 CSX 2024 Form 10-K p.11 CSX 2024 Form 10-K p.11

The Company experiences competition in pricing, service, reliability and other factors from various transportation providers including railroads and motor carriers that operate similar routes across its service area and, to a less significant extent, barges, ships and pipelines. Other transportation providers generally use public rights-of-way that are built and maintained by governmental entities, while CSXT and other railroads must build and maintain rail networks largely using internal resources. Any future improvements or expenditures materially increasing the quality or reducing the cost of alternative modes of transportation such as through the use of automation, autonomy or electrification, or legislation providing for less stringent size or weight restrictions on trucks, could negatively impact the Company's competitive position. Additionally, any currently proposed or other future consolidation in the rail industry could materially affect the regulatory and competitive environment in which the Company operates.

The Company experiences competition in pricing, service, reliability and other factors from various transportation providers including railroads and motor carriers that operate similar routes across its service area and, to a less significant extent, barges, ships and pipelines. Other transportation providers generally use public rights-of-way that are built and maintained by governmental entities, while CSXT and other railroads must build and maintain rail networks largely using internal resources. Any future improvements or expenditures materially increasing the quality or reducing the cost of alternative modes of transportation such as through the use of automation, autonomy or electrification, or legislation providing for less stringent size or weight restrictions on trucks, could negatively impact the Company's competitive position. Additionally, any future consolidation in the rail industry could materially affect the regulatory and competitive environment in which the Company operates. CSX 2024 Form 10-K p.10 CSX 2024 Form 10-K p.10 CSX 2024 Form 10-K p.10 CSX 2024 Form 10-K p.10 CSX 2024 Form 10-K p.10 CSX 2024 Form 10-K p.10

PART I Climate and emissions-related laws and regulations have been proposed and, in some cases adopted, on the federal, state, provincial and local levels. These final and proposed laws and regulations take the form of restrictions, caps, taxes or other controls on emissions as well as requirements to disclose climate-related information. In particular, the EPA has issued various regulations and may issue additional regulations targeting emission reductions, including rules and standards governing emissions from certain stationary and mobile sources. Any of these pending or proposed laws or regulations, could adversely affect the Company's operations and financial results by, among other things: (i) reducing coal-fired electricity generation due to mandated emission standards; (ii) reducing the consumption of coal as a viable energy resource in the United States and Canada; (iii) increasing the Company's fuel, capital and other operating costs and negatively affecting operating and fuel efficiencies; and (iv) making it difficult for the Company's customers in the U.S. and Canada to produce products in a cost competitive manner. Any of these factors could reduce the amount of shipments the Company handles and have a material adverse effect on the Company's financial condition, results of operations or liquidity. In addition, CSX may become subject to legal requirements to disclose climate-related information and may become subject to demands or expectations by its supply chain partners, customers or other stakeholders to disclose information relating to climate risk or set related targets or goals. The Company's current practices with respect to climate risk disclosure may fail to meet these developing legal requirements or stakeholder demands or expectations. In addition, legislative or regulatory uncertainties and change regarding climate-related risks, including inconsistent perspectives or requirements, are likely to result in higher regulatory, compliance, credit, reputational and other risks and costs.

There is potential for operational impacts from climate-related risks, including changing weather patterns, in the Company's operational territory, which could impact the Company's network or other assets. Climate and emissions-related laws and regulations have been proposed and, in some cases adopted, on the federal, state, provincial and local levels. These final and proposed laws and regulations take the form of restrictions, caps, taxes or other controls on emissions as well as requirements to disclose climate-related information. In particular, the EPA has issued various regulations and may issue additional regulations targeting emission reductions, including rules and standards governing emissions from certain stationary and mobile sources. Any of these pending or proposed laws or regulations, could adversely affect the Company's operations and financial results by, among other things: (i) reducing coal-fired electricity generation due to mandated emission standards; (ii) reducing the consumption of coal as a viable energy resource in the United States and Canada; (iii) increasing the Company's fuel, capital and other operating costs and negatively affecting operating and fuel efficiencies; and (iv) making it difficult for the Company's customers in the U.S. and Canada to produce products in a cost competitive manner. Any of these factors could reduce the amount of shipments the Company handles and have a material adverse effect on the Company's financial condition, results of operations or liquidity. In addition, CSX may become subject to legal requirements to disclose climate-related information and may become subject to demands or expectations by its supply chain partners, customers or other stakeholders to disclose information relating to climate risk or set related targets or goals. The Company's current practices with respect to climate risk disclosure may fail to meet these developing legal requirements or stakeholder demands or expectations. In addition, legislative or regulatory uncertainties and change regarding climate-related risks, including inconsistent perspectives or requirements, are likely to result in higher regulatory, compliance, credit, reputational and other risks and costs. CSX 2024 Form 10-K p.12 CSX 2024 Form 10-K p.12 CSX 2024 Form 10-K p.12 CSX 2024 Form 10-K p.12 CSX 2024 Form 10-K p.12 CSX 2024 Form 10-K p.12

The Company relies on information technology in all aspects of its business. The security, stability and availability of the Company’s and its key third-party vendors’ information technology systems are critical to its ability to operate safely and effectively and to compete within the transportation industry. A successful data breach, cyber-attack, or the occurrence of any similar incident that impacts the Company’s or its key third-party vendors’ information technology systems could result in a service interruption, train accident, misappropriation of confidential or proprietary information (including personal information), process failure, or other operational difficulties. A disruption or compromise of the Company’s or its key third-party vendors' information technology systems, even for short periods of time, and any resulting theft or compromise of Company confidential or proprietary information (including personal information), could adversely affect the Company’s business or reputation, create significant legal, regulatory or financial exposure and have a material adverse impact on CSX’s business, financial condition or operations. The Company, its third-party vendors and other companies in the rail and transportation industries have been subject to, and are likely to continue to be the target of, data breaches, cyber-attacks and other similar incidents. These incidents may include, among other things, malware, ransomware, distributed denial of service attacks, social engineering, phishing, theft, malfeasance or improper access by employees or third-party vendors, software bugs, server malfunctions, software or hardware failures, human error, fraud, or other modes of attack or disruption. Attacks of these nature are increasing in frequency, levels of persistence, intensity and sophistication, including by nation-state threat actors or those associated with nation-states. Further, the Company may be at increased risk of experiencing a cyber-attack as a result of being a component of the critical U.S. infrastructure. If such an event takes place, the Company may be required to incur significant expenses in excess of existing cybersecurity insurance coverage. As cybersecurity threats continue to evolve, including the increased maturity of artificial intelligence leveraged by threat actors, the Company may be required to expend significant additional resources to continue to modify or enhance its protective measures or to investigate and remediate any information security vulnerabilities, data breaches, cyber-attacks or other similar incidents. The Company or its third-party vendors may also experience cybersecurity incidents as a result of employees, third-party vendors and other third parties with which they interact working remotely on less secure systems and environments. Despite the Company’s efforts to protect its information technology systems, it may not be able to prevent or anticipate all data breaches, cyber-attacks or other similar incidents, detect or react to such incidents in a timely manner or adequately remediate any such incident. Due to applicable laws, rules and regulations or contractual obligations, CSX may be held responsible for data breaches, cyber-attacks CSX 2025 Form 10-K p.8 CSX 2025 Form 10-K p.8 CSX 2025 Form 10-K p.8 CSX 2025 Form 10-K p.8 CSX 2025 Form 10-K p.8 CSX 2025 Form 10-K p.8

The Company relies on information technology in all aspects of its business. The security, stability and availability of the Company’s and its key third-party vendors’ information technology systems are critical to its ability to operate safely and effectively and to compete within the transportation industry. A successful data breach, cyber-attack, or the occurrence of any similar incident that impacts the Company’s or its key third-party vendors’ information technology systems could result in a service interruption, train accident, misappropriation of confidential or proprietary information (including personal information), process failure, or other operational difficulties. A disruption or compromise of the Company’s or its key third-party vendors' information technology systems, even for short periods of time, and any resulting theft or compromise of Company confidential or proprietary information (including personal information), could adversely affect the Company’s business or reputation, create significant legal, regulatory or financial exposure and have a material adverse impact on CSX’s business, financial condition or operations. CSX 2024 Form 10-K p.8 CSX 2024 Form 10-K p.8 CSX 2024 Form 10-K p.8 CSX 2024 Form 10-K p.8 CSX 2024 Form 10-K p.8 CSX 2024 Form 10-K p.8

PART I or other similar incidents attributed to its third-party vendors as they relate to the information CSX shares with them. Additionally, if CSX is unable to successfully acquire, develop, implement, or update new or existing technology, including artificial intelligence, it may suffer adverse financial impacts or a competitive disadvantage within the rail industry and with companies providing other modes of transportation services.

PART I The Company, its third-party vendors and other companies in the rail and transportation industries have been subject to, and are likely to continue to be the target of, data breaches, cyber-attacks and other similar incidents. These incidents may include, among other things, malware, ransomware, distributed denial of service attacks, social engineering, phishing, theft, malfeasance or improper access by employees or third-party vendors, software bugs, server malfunctions, software or hardware failures, human error, fraud, or other modes of attack or disruption. Attacks of these nature are increasing in frequency, levels of persistence, intensity and sophistication, including by nation-state threat actors or those associated with nation-states. Further, the Company may be at increased risk of experiencing a cyber-attack as a result of being a component of the critical U.S. infrastructure. If such an event takes place, the Company may be required to incur significant expenses in excess of existing cybersecurity insurance coverage. As cybersecurity threats continue to evolve, the Company may be required to expend significant additional resources to continue to modify or enhance its protective measures or to investigate and remediate any information security vulnerabilities, data breaches, cyber-attacks or other similar incidents. The Company or its third-party vendors may also experience cybersecurity incidents as a result of employees, third-party vendors and other third parties with which they interact working remotely on less secure systems and environments. Despite the Company’s efforts to protect its information technology systems, it may not be able to prevent or anticipate all data breaches, cyber-attacks or other similar incidents, detect or react to such incidents in a timely manner or adequately remediate any such incident. Due to applicable laws, rules and regulations or contractual obligations, CSX may be held responsible for data breaches, cyber-attacks or other similar incidents attributed to its third-party vendors as they relate to the information CSX shares with them. Additionally, if CSX is unable to successfully acquire, develop, implement, or update new or existing technology, including artificial intelligence, it may suffer adverse financial impacts or a competitive disadvantage within the rail industry and with companies providing other modes of transportation services.