Item 1A. RISK FACTORS

In addition to the other information set forth in this report, you should carefully consider the factors discussed in Part I, Item 1A — Risk Factors in the 2020 Form 10-K, which could materially affect the business, financial condition, cash flows or future results of Pinnacle West and APS. The risks described in the 2020 Form 10-K are not the only risks facing Pinnacle West and APS. Additional risks and uncertainties not currently known to us or that we currently deem to be immaterial also may materially adversely affect the business, financial condition, cash flows and/or operating results of Pinnacle West and APS.

The risk factors below are an update to our 2020 Form 10-K.

The outbreak of the COVID-19 pandemic could negatively affect our business.

The outbreak of COVID-19 is a continually developing situation around the globe that has led to economic disruption and volatility in the financial markets. The continued spread of COVID-19 and efforts to contain the virus and mitigate its public health effects, including but not limited to a vaccine mandate, could decrease demand for energy, lower economic growth, impact our employees and contractors, cause disruptions in our supply chain, increase certain costs, further increase volatility in the capital markets (and result in increases in the cost of capital or an inability to access the capital markets or draw on available credit facilities), delay the completion of capital or other construction projects and other operations and maintenance activities, delay payments or increase uncollectable accounts, impact our ability to hire or retain qualified employees, or cause other unpredictable events, each of which could adversely affect our business, results of operations, cash flows or financial condition.

As a result of the COVID-19 pandemic, from March 2020 through April 2021, APS experienced higher electric residential sales and lower electric commercial and industrial sales and the cumulative impact on weather normalized retail electricity sales usage was a net increase as compared to 2019. APS is also experiencing an increase in bad debt expense associated with the COVID-19 pandemic that resulted in a negative impact to its 2020 operating results and APS is anticipating a negative impact to its 2021 operating results. In mid-March 2020, we drew on our revolving credit facilities as a result of the commercial paper markets failing to function normally due to COVID-19, but we were subsequently able to utilize the commercial paper market in April 2020 and we have paid down the revolving credit facilities completely. We are also experiencing increased operations and maintenance expenses due to the need for personal protective equipment and other health and safety-related costs related to COVID-19.

Despite our efforts to manage the impacts, the degree to which the COVID-19 pandemic and related actions ultimately impact our business, financial position, results of operations and cash flows will depend on factors beyond our control including the duration, spread and severity of the outbreak, the actions taken to

contain COVID-19 and mitigate its public health effects, including but not limited to a vaccine mandate, the impact on the U.S. and global economies and demand for energy, and how quickly and to what extent normal economic and operating conditions resume.

We are subject to employee workforce factors that could adversely affect our business and financial condition.

Like many companies in the electric utility industry, our workforce is maturing, with approximately 31% of employees eligible to retire by the end of 2025. Although we have undertaken efforts to recruit, train and develop new employees, we face increased competition for talent. We are subject to other employee workforce factors, such as the availability and retention of qualified personnel and the need to negotiate collective bargaining agreements with union employees. Additionally, any regulatory changes requiring us to enforce a COVID-19 vaccination mandate could impact the availability of, and our ability to attract and retain, sufficient qualified employees. These or other employee workforce factors could negatively impact our business, financial condition or results of operations.

We are subject to cybersecurity risks and risks of unauthorized access to our systems that could adversely affect our business and financial condition.

We operate in a highly regulated industry that requires the continued operation of sophisticated information technology systems and network infrastructure. In the regular course of our business, we handle a range of sensitive security, customer and business systems information. There appears to be an increasing level of activity, sophistication and maturity of threat actors, in particular nation state actors, that seek to exploit potential vulnerabilities in the electric utility industry and wish to disrupt the U.S. bulk power system, our information technology systems, generation (including our Palo Verde nuclear facility), transmission and distribution facilities, and other infrastructure facilities and systems and physical assets. We have been and could be the target of attacks, and the aforementioned systems are critical areas of cyber protection for us.

We rely extensively on IT systems, networks, and services, including internet sites, data hosting and processing facilities, and other hardware, software and technical applications and platforms. Some of these systems are managed, hosted, provided, or used for third parties to assist in conducting our business. Malicious actors may attack vendors to disrupt the services these vendors provide to us or to use those vendors as a cyber conduit to attack us. As more third parties are involved in the operation of our business, there is a risk the confidentiality, integrity, privacy or security of data held by, or accessible to, third parties may be compromised.

If a significant cybersecurity event or breach were to occur, we may not be able to fulfill critical business functions and we could (i) experience property damage, disruptions to our business, theft of or unauthorized access to customer, employee, financial or system operation information or other information; (ii) experience loss of revenue or incur significant costs for repair, remediation and breach notification, and increased capital and operating costs to implement increased security measures; and (iii) be subject to increased regulation, litigation and reputational damage. If such disruptions or breaches are not detected quickly, their effect could be compounded or could delay our response or the effectiveness of our response and ability to limit our exposure to potential liability. These types of events could also require significant management attention and resources, and could have a material adverse impact on our financial condition, results of operations or cash flows.

We develop and maintain systems and processes aimed at detecting and preventing information and cybersecurity incidents which require significant investment, maintenance, and ongoing monitoring and updating as technologies and regulatory requirements change. These systems and processes may be

insufficient to mitigate the possibility of information and cybersecurity incidents, malicious social engineering, fraudulent or other malicious activities, and human error or malfeasance in the safeguarding of our data.

We are subject to laws and rules issued by multiple government agencies concerning safeguarding and maintaining the confidentiality of our security, customer and business information. One of these agencies, NERC, has issued comprehensive regulations and standards surrounding the security of bulk power systems, and is continually in the process of developing updated and additional requirements with which the utility industry must comply. The NRC also has issued regulations and standards related to the protection of critical digital assets at commercial nuclear power plants. The increasing promulgation of NERC and NRC rules and standards will increase our compliance costs and our exposure to the potential risk of violations of the standards. Experiencing a cybersecurity incident could cause us to be non-compliant with applicable laws and regulations, such as those promulgated by NERC and the NRC, privacy laws, or contracts that require us to securely maintain confidential data, causing us to incur costs related to legal claims or proceedings and regulatory fines or penalties.

The risk of these system-related events and security breaches occurring continues to intensify. We have experienced, and expect to continue to experience, threats and attempted intrusions to our information technology systems and we could experience such threats and attempted intrusions to our operational control systems. To date, we do not believe we have experienced a material breach or disruption to our network or information systems or our service operations. We may not be able to anticipate and prevent all cyberattacks or information security breaches, and our ongoing investments in security resources, talent, and business practices may not be effective against all threat actors. As such attacks continue to increase in sophistication and frequency, we may be unable to prevent all such attacks from being successful in the future.

We maintain cyber insurance to provide coverage for a portion of the losses and damages that may result from a security breach of our information technology systems, but such insurance is subject to a number of exclusions and may not cover the total loss or damage caused by a breach. Coverage for cybersecurity events continues to evolve as the industry matures. In the future, adequate insurance may not be available at rates that we believe are reasonable, and the costs of responding to and recovering from a cyber incident may not be covered by insurance or recoverable in rates.