Exelon Corporation: 10-K Risk Factor Changes

Demand for electricity within the Utility Registrants' service areas could stress available transmission capacity requiring alternative routing or curtailment of electricity usage. Also, insufficient availability of electric supply to meet customer demand could jeopardize the Utility Registrants' ability to comply with reliability standards and strain customer and regulatory agency relationships. As is the case for electric utilities generally, potential concerns over transmission capacity or generation facility retirements could result in PJM or FERC requiring the 27 27 27 Table of Contents Table of Contents Utility Registrants to upgrade or expand their respective transmission systems through additional capital expenditures. Delays in siting, permitting, and interconnection could defer the introduction of new generation resources that could address resource adequacy concerns. PJM’s systems and operations are designed to ensure the reliable operation of the transmission grid and prevent the operations of one utility from having an adverse impact on the operations of the other utilities. However, service interruptions at other utilities may cause interruptions in the Utility Registrants’ service areas. Additionally, efforts to artificially manipulate power demand on the grid, or even accidental activity that results in sharp fluctuations of demand, could disrupt grid operations.

Demand for electricity within the Utility Registrants' service areas could stress available transmission capacity requiring alternative routing or curtailment of electricity usage. Also, insufficient availability of electric supply to meet customer demand could jeopardize the Utility Registrants' ability to comply with reliability standards and 29 29 29 Table of Contents Table of Contents strain customer and regulatory agency relationships. As is the case for electric utilities generally, potential concerns over transmission capacity or generation facility retirements could result in PJM or FERC requiring the Utility Registrants to upgrade or expand their respective transmission systems through additional capital expenditures. PJM’s systems and operations are designed to ensure the reliable operation of the transmission grid and prevent the operations of one utility from having an adverse impact on the operations of the other utilities. However, service interruptions at other utilities may cause interruptions in the Utility Registrants’ service areas.

On July 17, 2020, ComEd entered into a Deferred Prosecution Agreement with the USAO for the Northern District of Illinois to resolve the USAO’s investigation into Exelon’s and ComEd’s lobbying activities in the State of Illinois. Exelon was not made a party to the DPA and no charges were brought against Exelon. Under the DPA, the USAO filed a single charge alleging that ComEd improperly gave and offered to give jobs, vendor subcontracts, and payments associated with those jobs and subcontracts for the benefit of the Speaker of the Illinois House of Representatives and the Speaker’s associates, with the intent to influence the Speaker’s action regarding legislation affecting ComEd’s interests. The DPA provided that the USAO would defer any prosecution of such charge and any other criminal or civil case against ComEd in connection with the matters identified therein for a three-year period. That period expired, and the pending charge was dismissed, in July 2023. In October 2019, the SEC notified Exelon and ComEd that it had opened an investigation into their lobbying activities in the state of Illinois. On September 28, 2023, Exelon and ComEd reached a settlement with the SEC to fully resolve the matter. The DPA and the settlement with the SEC could have a material adverse impact on Exelon’s and ComEd’s reputation or relationships with regulatory and legislative authorities, customers, and other stakeholders. Those impacts could affect, or make more difficult, their efforts to achieve actions or approvals associated with operations. See Note 18 — Commitments and Contingencies of the Combined Notes to Consolidated Financial Statements for more information regarding the DPA and SEC settlement. 24 24 24 Table of Contents Table of Contents

On July 17, 2020, ComEd entered into a Deferred Prosecution Agreement with the USAO for the Northern District of Illinois to resolve the USAO’s investigation into Exelon’s and ComEd’s lobbying activities in the State of Illinois. Exelon was not made a party to the DPA and no charges were brought against Exelon. Under the DPA, the USAO filed a single charge alleging that ComEd improperly gave and offered to give jobs, vendor subcontracts, and payments associated with those jobs and subcontracts for the benefit of the Speaker of the Illinois House of Representatives and the Speaker’s associates, with the intent to influence the Speaker’s action regarding legislation affecting ComEd’s interests. The DPA provided that the USAO would defer any prosecution of such charge and any other criminal or civil case against ComEd in connection with the matters identified therein for a three-year period. That period expired, and the pending charge was dismissed, in July 2023. In October 2019, the SEC notified Exelon and ComEd that it had opened an investigation into their lobbying activities in the state of Illinois. On September 28, 2023, Exelon and ComEd reached a settlement with the SEC to fully resolve the matter. The DPA and the settlement with the SEC could have a material adverse impact on Exelon’s and ComEd’s reputation or relationships with regulatory and legislative authorities, customers, and other stakeholders. Those impacts could affect, or make more difficult, their efforts to achieve actions or approvals associated with operations. See Note 18 — Commitments and Contingencies of the Combined Notes to Consolidated Financial Statements for more information regarding the DPA and SEC settlement.

Risks from cybersecurity and physical threats to energy infrastructures are increasing. Threat actors, including sophisticated nation-state actors and criminal groups, exploit potential vulnerabilities in the electric and natural gas utility industry, grid infrastructure, and other energy infrastructures. Attacks and disruptions, which could involve physical, cyber, and hybrid targeting of physical and cyber assets, are increasingly sophisticated and dynamic. The increased implementation of, and reliance on, information technologies and networks to manage business operations, including the operation of technical systems, as well as the Registrants' use of numerous vendors and suppliers, create additional points of vulnerability that could be, and in certain instances have been, exploited by malicious threat actors. Several U.S. government agencies have warned that the energy sector and its supply chains are subject to increasing risks of physical attacks, ransomware attacks and cybersecurity threats, and that the risks may escalate during periods of heightened geopolitical tensions. In addition, the rapid evolution and increased adoption of artificial intelligence technologies may intensify the Registrants' cybersecurity risks. A security breach of the Registrants' physical assets or information systems or those of the Registrants' competitors, vendors, business partners and interconnected entities (including RTOs and ISOs) could materially impact Registrants by, among other things, impairing the availability of electricity and gas distributed by Registrants and/or the reliability of transmission and distribution systems, damaging grid infrastructure, interrupting critical business functions, impairing the availability of vendor services and materials that the Registrants rely on to maintain their operations, or by leading to the theft or inappropriate release of certain types of information, including critical infrastructure information, system data and architecture, sensitive customer, vendor, or employee data, or other confidential data. While Registrants and some of the Registrants' vendors have experienced cybersecurity incidents, such incidents have not, to Registrants' knowledge, resulted in material impact to any of the Registrants to date. If a material physical or cybersecurity breach or disruption were to occur, the Registrants' reputation could be negatively affected, customer confidence in the Registrants could be diminished and the Registrants could be subject to legal claims, regulatory exposure, loss of revenues, and increased costs, including infrastructure repairs or operations shutdown, all of which could materially affect the Registrants' financial condition and materially damage their business reputation. Moreover, the amount and scope of insurance maintained against losses resulting from any such security breaches or disruptions may not be sufficient to cover losses or otherwise adequately compensate for any resulting business disruptions. The continued increase in Federal and state regulatory requirements related to cybersecurity and evolving threat actor-capabilities could require changes to measures currently undertaken by the Registrants or to their business operations and could adversely affect their consolidated financial statements. 25 25 25 Table of Contents Table of Contents

Risks from cybersecurity and physical threats to energy infrastructures are increasing. Threat actors, including sophisticated nation-state actors, continue to seek to exploit potential vulnerabilities in the electric and natural gas utility industry, grid infrastructure, and other energy infrastructures, and attacks and disruptions, both physical, cyber, and hybrid targeting physical and cyber assets, are becoming increasingly sophisticated and dynamic. Several U.S. government agencies have warned of increased risks related to physical attacks, ransomware attacks and cybersecurity threats related to the energy sector and its supply chains, and that the risks may escalate during periods of heightened geopolitical tensions. Continued implementation of advanced digital technologies increases the potentially unfavorable impacts of such attacks. In addition, the rapid evolution and increased adoption of artificial intelligence technologies may intensify the Registrants' cybersecurity risks. A security breach of the Registrants' physical assets or information systems or those of the Registrants' competitors, vendors, business partners and interconnected entities (including RTOs and ISOs) could materially impact Registrants by, among other things, impairing the availability of electricity and gas distributed by Registrants and/or the reliability of transmission and distribution systems, damaging grid infrastructure, interrupting critical business functions, impairing the availability of vendor services and materials that the Registrants rely on to maintain their operations, or by leading to the theft or inappropriate release of certain types of information, including critical infrastructure information, system data and architecture, sensitive customer, vendor, or employee data, or other confidential data. The Registrants' reliance on vendors to provide services and equipment, and its shared information systems with Constellation pursuant to the Transition Services Agreement between Exelon and Constellation, increases the risk to assets, systems, and data. While some of the Registrants' vendors have experienced cybersecurity incidents, such incidents have not, to Registrants' knowledge, resulted in material impact to any of the Registrants to date. The risk of these events and security breaches occurring continues to intensify. The Registrants have been, and will likely continue to be, subjected to physical and cyber-attacks. While to date none of the Registrants has directly experienced a material breach or material disruption to its network or information systems or operations, as such attacks continue to increase in sophistication and frequency, the Registrants may be subject to a material breach or material disruption in the future. If a significant physical or cybersecurity breach or disruption were to occur, the Registrants' reputation could be negatively affected, customer confidence in the Registrants could be diminished and the Registrants could be subject to legal claims, regulatory exposure, loss of revenues, increased costs including for infrastructure repairs, or operations shutdown, all of which could materially affect the Registrants' financial condition and materially damage its business reputation. Moreover, the amount and scope of insurance maintained against losses resulting from any such security breaches or disruptions may not be sufficient to cover losses or otherwise adequately compensate for any disruptions to business that could result. The continued increase in Federal and state regulatory requirements related to cybersecurity and evolving threat actor-capabilities could require changes to current measures taken by the Registrants or to their business operations and could adversely affect their consolidated financial statements.

The Utility Registrants' infrastructures and/or operations could be affected by extreme weather events, natural disasters, operational accidents such as wildfires or natural gas explosions or equipment or process failures due to aging infrastructure or otherwise, each of which could result in increased costs, including supply chain costs and claims for third-party property damage. An extreme weather event, natural disaster, wildfire, or operational accident within the Utility Registrants’ service areas can also directly affect their capital assets, causing disruption in service to customers due to downed wires and poles or damage to other operating equipment. The Registrants face a risk that their operations would be direct targets or indirect casualties of attacks or sabotaged by nation-states or their agents, or by foreign or domestic terrorist groups. Responses to such attacks or sabotage, and any resulting retaliatory actions or sustained conflict could affect the Registrants’ operations and finances in unpredictable and material ways. Furthermore, such events could compromise the physical or cybersecurity of the Registrants' facilities, which could adversely affect the Registrants' ability to manage their businesses effectively. Instability in the financial markets as a result of terrorism, war, natural disasters, public health crises, epidemics, pandemics, credit crises, recession, or other significant events also could result in a decline in energy consumption or interruption of fuel or the supply chain. In addition, the implementation of security guidelines and measures has resulted in and is expected to continue to result in increased costs. The Registrants could be significantly affected by public health crises, including epidemics or pandemics. The Registrants have plans in place to respond to such events. However, depending on the severity and the resulting impacts to workforce and other resource availability, a public health crisis, epidemic, or pandemic could adversely affect our vendors, or customers and customer demand as well as the Registrants’ ability to operate their transmission and distribution assets. In addition, Exelon, on behalf of the Registrants, maintains a level of insurance coverage consistent with industry practices against property, casualty, third party liability, and cybersecurity losses subject to unforeseen occurrences or catastrophic events that could damage or destroy assets or interrupt operations. However, such losses may not be covered under applicable insurance policies, or the amount of insurance may be inadequate to cover all such losses.

The Utility Registrants' infrastructures and/or operations could be affected by extreme weather events, natural disasters, or operational accidents such as wildfires or natural gas explosions which could result in increased costs, including supply chain costs and third-party property damage. An extreme weather event, natural disaster, or operational accident within the Utility Registrants’ service areas can also directly affect their capital assets, causing disruption in service to customers due to downed wires and poles or damage to other operating equipment. The impact that potential terrorist attacks could have on the industry and the Registrants is uncertain. The Registrants face a risk that their operations would be direct targets or indirect casualties of an act of terror. Any retaliatory military strikes or sustained military campaign could affect Registrants' operations in unpredictable ways, such as changes in insurance markets and disruptions of supplies and markets. Furthermore, such events could compromise the physical or cybersecurity of the Registrants' facilities, which could adversely affect the Registrants' ability to manage their businesses effectively. Instability in the financial markets as a result of terrorism, war, natural disasters, public health crises, epidemics, pandemics, credit crises, recession, or other significant events also could result in a decline in energy consumption or interruption of fuel or the supply chain. In addition, the implementation of security guidelines and measures has resulted in and is expected to continue to result in increased costs. The Registrants could be significantly affected by public health crises, epidemics, or pandemics. The Registrants have plans in place to respond to such events. However, depending on the severity and the resulting impacts to workforce and other resource availability, a public health crisis, epidemic, or pandemic could adversely affect our vendors, or customers and customer demand as well as the Registrants’ ability to operate their transmission and distribution assets. In addition, on behalf of the Registrants Exelon maintains a level of insurance coverage consistent with industry practices against property, casualty, and cybersecurity losses subject to unforeseen occurrences or catastrophic events that could damage or destroy assets or interrupt operations. However, there can be no assurance that the amount of insurance will be adequate to address such property and casualty losses.

Certain factors, such as employee strikes, work stoppages, loss of employees, loss of contract resources due to a major event, inability to negotiate future collective bargaining agreements on commercially reasonable terms, an aging workforce, mismatching of skill sets for current and future needs, and failing to appropriately anticipate future workforce needs, could lead to operating challenges and increased costs for the Registrants. Such challenges include lack of resources, loss of knowledge and a lengthy time period associated with skill development. Such events and other factors could result in increased costs, including costs of replacing lost labor through contractors or new hires, training costs, and costs of lost productivity. Such events also could increase operational risks. The Registrants are particularly affected due to the specialized knowledge required of the technical and support employees needed to conduct Registrants' transmission and distribution operations as well as areas where new technologies are pertinent.

Certain events, such as the separation transaction, an employee strike, loss of employees, loss of contract resources due to a major event, and an aging workforce without appropriate replacements, could lead to operating challenges and increased costs for the Registrants. Such challenges include lack of resources, loss of knowledge and a lengthy time period associated with skill development. As a result of such events, costs, including costs for contractors to replace employees, productivity costs, and safety costs, could rise. The Registrants are particularly affected due to the specialized knowledge required of the technical and support employees needed to conduct Registrants' transmission and distribution operations as well as areas where new technologies are pertinent.

Risks include changes to energy systems due to new technologies, changing customer expectations and/or voluntary GHG goals, as well as local, state, or federal regulatory requirements intended to reduce GHG emissions and/or mandate implementation of energy conservation programs, including through limitation of the use of natural gas. Changes to current state legislation or the development of Federal legislation that requires the use of low-emission, renewable, and/or alternate fuel sources could significantly impact the Utility Registrants, especially if timely cost recovery is not allowed. Federal and state legislation mandating the implementation of energy conservation programs that require the implementation of new technologies, such as smart grid, DERs and energy efficiency programs, could increase capital expenditures and could significantly impact the Utility Registrants' consolidated financial statements if timely cost recovery is not allowed. These energy conservation programs, regulated energy consumption reduction targets, and new energy consumption technologies could cause declines in customer energy consumption and lead to a decline in the Registrants' earnings, if timely recovery is not allowed. The Registrants also periodically perform analyses of potential energy system transition pathways to reduce economy-wide GHG emissions to mitigate climate change. To the extent additional GHG reduction legislation and/or regulation becomes effective at the Federal and/or state levels, the Registrants could incur costs to further limit the GHG emissions from their operations or otherwise comply with applicable requirements and such legislation and/or regulation could otherwise adversely affect the Registrants' businesses. See ITEM 1. BUSINESS — Environmental Matters and Regulation — Renewable and Clean Energy Standards and "The Registrants are potentially affected by emerging technologies that could over time affect or transform the energy industry" above for additional information. 23 23 23 Table of Contents Table of Contents

Changes to current state legislation or the development of Federal legislation that requires the use of low-emission, renewable, and/or alternate fuel sources could significantly impact the Utility Registrants, especially if timely cost recovery is not allowed. Federal and state legislation mandating the implementation of energy conservation programs that require the implementation of new technologies, such as smart meters and smart grid, could increase capital expenditures and could significantly impact the Utility Registrants' consolidated financial statements if timely cost recovery is not allowed. These energy conservation programs, regulated energy consumption reduction targets, and new energy consumption technologies could cause declines in customer energy consumption and lead to a decline in the Registrants' earnings, if timely recovery is not allowed. See ITEM 1. BUSINESS — Environmental Matters and Regulation — Renewable and Clean Energy Standards and "The Registrants are potentially affected by emerging technologies that could over time affect or transform the energy industry" above for additional information.

The Registrants periodically perform analyses to better understand long-term projections of climate change and how those changes in the physical environments where they operate could affect their facilities and operations. The Registrants primarily operate in the Midwest and Mid-Atlantic of the United States, areas that historically have been prone to various types of severe weather events, and the Registrants have well-developed response and recovery programs based on these historical events. However, the Registrants’ physical facilities could be at greater risk of damage as changes in the global climate affect temperature and weather patterns, including if 26 26 26 Table of Contents Table of Contents such climate changes result in more intense, frequent and extreme weather events, elevated or decreased levels of precipitation, sea level rise, increased surface water temperatures, wildfires and/or other effects. In addition, changes to the climate may impact levels and patterns of demand for energy and related services, which could affect Registrants’ operations and business.

The Registrants periodically perform analyses to better understand long-term projections of climate change and how those changes in the physical environments where they operate could affect their facilities and operations. The Registrants primarily operate in the Midwest and Mid-Atlantic of the United States, areas that historically have been prone to various types of severe weather events, and the Registrants have well-developed response and recovery programs based on these historical events. However, the Registrants’ physical facilities could be at greater risk of damage as changes in the global climate affect temperature and weather patterns, including if such climate changes result in more intense, frequent and extreme weather events, elevated levels of precipitation, sea level rise, increased surface water temperatures, wildfires and/or other effects. Over time, the Registrants are making additional investments to protect their facilities from physical climate-related risks. In addition, changes to the climate may impact levels and patterns of demand for energy and related services, which could affect Registrants’ operations and business. Over time, the Registrants are making additional investments to adapt to changes in operational requirements to manage demand changes and customer expectations caused by climate change. Climate Change risks include changes to energy systems due to new technologies, changing customer expectations and/or voluntary GHG goals, as well as local, state, or federal regulatory requirements intended to reduce GHG emissions, including through limitation of the use of natural gas. The Registrants also periodically perform analyses of potential energy system transition pathways to reduce economy-wide GHG emissions to mitigate climate change. To the extent additional GHG reduction legislation and/or regulation becomes effective at the Federal and/or state levels, the Registrants could incur costs to further limit the GHG emissions from their operations or otherwise comply with applicable requirements and such legislation and/or regulation could otherwise adversely affect the Registrants' businesses. See ITEM 1. BUSINESS — Environmental Matters and Regulation — Climate Change and ITEM 1.A. "The Registrants are potentially affected by emerging technologies that could over time affect or transform the energy industry" above for additional information.

Employees and contractors throughout the organization work in, and customers and the general public could be exposed to, potentially dangerous environments near the Registrants’ operations. As a result, employees, contractors, customers, and the general public may face, and in the past have experienced, serious injury, including loss of life, damage to or destruction of facilities and residences, business interruptions, and environmental pollution. These risks include, among others, gas explosions, uncontrolled release of natural gas and other environmental hazards, fires, pole strikes, and electric contact cases. Further, the location of natural gas pipelines and associated distribution facilities, or electric generation, transmission, substations and distribution facilities near populated areas, including residential areas, commercial business centers and industrial sites, increases the potential damages resulting from these risks.

Employees and contractors throughout the organization work in, and customers and the general public could be exposed to, potentially dangerous environments near the Registrants’ operations. As a result, employees, 28 28 28 Table of Contents Table of Contents contractors, customers, and the general public are at some risk for serious injury, including loss of life. These risks include gas explosions, pole strikes, and electric contact cases.