{"url_path":"/sec/shmdw/10-k/2026/item-16k","section_key":"item-16k","section_title":"Item 16K CYBERSECURITY**","topic":"sec","document":{"doc_type":"20-F","doc_date":"2026-05-15","source_url":"https://www.sec.gov/Archives/edgar/data/1987240/0001104659-26-062643-index.html","accession_number":"0001104659-26-062643","cik":"0001987240","ticker":"SHMD","issuer_name":"SCHMID Group N.V.","edgar_url":"https://www.sec.gov/Archives/edgar/data/1987240/0001104659-26-062643-index.html","primary_entity_key":"0001987240","primary_entity_name":"SCHMID Group N.V."},"word_count":456,"has_tables":true,"body_markdown":"**ITEM 16K. CYBERSECURITY**\n\nRisk management and strategy\n\nOur approach to risk management is designed to identify, assess, prioritize and manage major risk exposures that could affect our ability to execute our corporate strategy and fulfill our business objectives.\n\nWe perform risk assessments and prioritize information security risks identified through the processes described below, including risks associated with our use of third-party service providers. We view information security risks as one of the key risk categories we face. We are at risk for interruptions, outages and breaches of the following systems, which are either owned by us or operated by our third-party vendors or suppliers: (a) operational systems, including business, financial, accounting, enterprise resource, product development, data processing or production processes; (b) facility security systems; (c) personal data of customers, employees, suppliers, or others; or (d) our digital software. As of the date of this Annual Report we are not aware of any information security threats that have or are reasonably likely to affect our business strategy, results of operations or financial condition and provide regular security awareness information for all employees and enhanced training for information security and other specialized personnel.\n\nOur processes for preventing, identifying, assessing and managing information security risks and vulnerabilities are embedded across our business. Among other things, we: (a) review our software and technology to ensure that our security capabilities are up to standard and protect SCHMID’s information technology; (b) review information security threat information published by government entities and other organizations in which we participate; and (c) engage third-party service providers to identify vulnerabilities and threats in our information technology environment, to enhance our security capabilities and protect our information technology and (d) adopt third-party tools for detecting and monitoring threats in our environment. We use the findings from these and other processes to improve our information security practices, procedures and technologies.\n\nGovernance\n\nThe audit committee, which was formed as of April 30, 2024, is responsible for oversight of cybersecurity risks and preparing decision making for the wider board of directors. Information and reports concerning any significant cybersecurity threats and risk and the processes we have implemented to address them is received from the management board, which addresses and heads our cybersecurity risk management as part of its general oversight function. The audit committee will also receive various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.\n\nOur cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including the Chief Financial Officer and the Chief Executive Officer. The company management is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company’s overall risk management strategy, and communicating key priorities to relevant personnel.\n\n​\n\n104\n\n[Table of Contents](#TOC)\n\n**PART III.**"}