Governance

Strong governance is a core principle at Southwest®. It starts with a commitment to integrity, transparency, and accountability. Our Board of Directors provides active oversight and helps set the tone for how we approach risk, ethics, and business decisions across the Company. Supported by well-established practices and a strong Culture of responsibility, our approach to governance reflects both our history and our focus on continuing to earn the trust of those we serve. The sections below highlight key elements of our governance approach.

Board Oversight

Our Board of Directors believes that strong corporate governance is critical to promoting the best long-term interests of our Shareholders, Employees, and Customers. Thoughtful consideration is given to the composition, refreshment, and structure of the Board for it to effectively fulfill its oversight responsibilities. More information on our Board is available on our Investor Relations website

 

Risk Management

In an increasingly complex operating environment, Southwest focuses on proactively identifying and managing risks that could affect safety, operational reliability, financial performance, and reputation. The Enterprise Risk Management (ERM) Program enables the Company to identify, assess, monitor, and address risks that could impact the achievement of strategic business objectives, while promoting informed risk-based decision-making across the enterprise. 

A cross-functional Risk Steering Group provides management-level oversight of key enterprise risks, reviewing risk exposure, mitigation progress, and emerging issues.

Strengthening Risk Focus and Discipline

In 2025, Southwest enhanced its ERM program to further align risk management with Company strategy, particularly in areas such as operational reliability and technology resilience. Key updates include:

  • Sharper prioritization of enterprise risks with clearer thresholds and consistent evaluation criteria across financial, operational, safety, regulatory, and reputational impacts
  • Closer integration with Internal Audit strengthening oversight of mitigation effectiveness
  • Expanded use of data and tools including a centralized platform that provides an enterprise-wide view of risk exposure
  • Introduction of key risk indicators, enabling earlier identification of risks approaching defined thresholds

These enhancements support greater transparency, consistency, and accountability in how risks are identified, assessed, and managed.

Emergency Response and Business Continuity

Preparedness is central to maintaining safe and resilient operations. Southwest’s Emergency Response and Business Continuity programs are designed to support effective response to major incidents and continuity during disruptions.

These teams maintain and regularly test comprehensive response and continuity plans across a range of scenarios, including severe weather, operational disruptions, and technology events. Lessons learned from exercises and real-world events are incorporated into ongoing program improvements. We strive to support our communities through times of crisis through our Corporate Responsibility efforts where we partner with national and local organizations to support services focused on preparedness, response, building resilience, and living responsibly.

Strengthening Supply Chain Risk Insights

In 2025, Southwest expanded its use of third-party tools to enhance visibility into supply chain risks. This platform provides continuous monitoring across key risk areas, including operational, financial, cybersecurity, geopolitical, and environmental and social considerations, across a multi-tier supplier network. These capabilities strengthen visibility into supplier dependencies, support risk monitoring, and enhance the Company’s ability to identify and respond to emerging supply chain risks.

Ethics

Southwest is committed to operating with integrity, transparency, and accountability. Our Code of Ethics, which is reviewed by our Board of Directors annually, establishes the standards that guide our Employees, Board Members, and business associates in conducting business ethically and in compliance with applicable laws and regulations. Employees are required to acknowledge the Code of Ethics every year.

Our commitment to ethics extends beyond compliance. It’s embedded in our Culture and reflected in how we care for our People, serve our Customers, and support our communities. Leaders throughout the Company, including the Executive Leadership Team, are responsible for reinforcing our Core Values and promoting behaviors grounded in integrity and honesty.

To uphold these standards, Southwest provides reporting channels for Employees to report potential violations of the Code of Ethics, Company policies, or applicable laws and regulations.

For more information on Southwest’s policies, please visit our governance library on our Investor Relations website.

Cybersecurity, Data Privacy, and AI

At Southwest, cybersecurity, data privacy, and responsible artificial intelligence (AI) practices are foundational to maintaining the trust of our Customers, Employees and partners. We continue to enhance our capabilities through governance, employee education, system and data security, and industry collaboration, helping support safe, reliable operations and strengthen resilience against an evolving threat landscape. 

Cybersecurity

Southwest’s Cybersecurity Team is made up of skilled professionals dedicated to protecting the Company’s systems, networks, and information while defending against evolving cybersecurity threats and managing cybersecurity risks across the enterprise.  

Our broader cybersecurity strategy aligns with the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) to help govern, identify, protect against, detect, respond to and recover from cybersecurity threats targeting facilities, airports, aircraft, and enterprise technology. The Cybersecurity Team uses a range of tools and technologies to identify, assess, and monitor cybersecurity risks across the Company’s technology and operational systems that support Southwest’s business and operations.

Every Employee has a role in protecting information and systems, so annual cybersecurity awareness training and policy acknowledgments are required for all Employees. Throughout the year, our Cybersecurity Team promotes a culture of security awareness by reinforcing key risks such as phishing and social engineering, through targeted awareness activities, interactive activities, and frontline engagement. These efforts help strengthen cybersecurity vigilance and encourage consistent cybersecurity practices across the organization. Each year, a cross-functional Team tests and refines Southwest’s Cybersecurity Incident Response Plan to support timely incident response, operational resilience, and business continuity. In addition, Software Developers receive secure code training annually to help embed security as early as possible in the development lifecycle.

As aviation grows more sophisticated, our Aircraft Cybersecurity Team is dedicated to securing aircraft and connected systems. This specialized focus supports identification and mitigation of cybersecurity risks unique to aircraft operations and the broader aviation ecosystem. The same risk-based mindset that guides enterprise cybersecurity also applies to aviation systems, where Southwest uses threat intelligence, regular testing, and adaptive controls to identify and address emerging risks. This supports safe, reliable operations for Customers and Employees, while recognizing that digital systems are now as critical to aviation as the physical infrastructure they support.

Southwest also helps advance cybersecurity across the aviation industry by sharing expertise and collaborating with peers and government partners. The Company is a founding member of the Aviation Information Sharing and Analysis Center (A-ISAC) and actively participates in the Airlines for America (A4A) Cybersecurity Council. Southwest Cybersecurity Leaders and Team Members also present at key aviation and cybersecurity forums globally.

Data Privacy

As our world becomes more connected, protecting the personal data of our Customers, Employees, and partners is more important than ever. Southwest continues to strengthen privacy in ways that support safe, reliable operations and builds trust with Customers, Employees, and partners.

Southwest’s Data Privacy Operations Program is built around a clear set of privacy principles and applicable laws, with a dedicated Data Privacy Office responsible for day-to-day operations. The Office manages key functions, such as responding to personal information requests, conducting third-party risk reviews, performing privacy impact assessments, supporting incident response, and overseeing data privacy training.

Privacy is treated as a shared responsibility, so data privacy training is mandatory for all Employees. Additionally, Employees can access specialized courses to help embed privacy into day-to-day work.

Certain employees are embedded across business units and may receive additional education to serve as knowledgeable advocates for data privacy, helping drive awareness of privacy standards and controls, integrate privacy into processes, and support incident identification and reporting. Ongoing training and awareness activities continue to evolve as technology, regulations, and business needs change.

Southwest is committed to transparency, helping Customers understand how their data is used and the choices they have. In addition to the Company’s privacy policy, a dedicated page in the Help Center on Southwest.com provides more information about data processing, options for submitting data privacy inquiries, and other related topics in one convenient place.

Learn more about our Privacy Policy

Responsible AI

Southwest is dedicated to using AI responsibly—protecting privacy, securing data, and optimizing resources—because trust and accountability are at the Heart of everything we do. In balancing innovation and responsible implementation, we prioritize accuracy, explainability, data security, regulatory compliance, safety, and privacy protection, while continually enhancing our organizational practices to proactively address emerging risk. Human oversight is a key part of how Southwest keeps AI grounded in accountability, quality, and trust.

Southwest has implemented an AI Acceptable Use Policy that empowers our People to use AI responsibly while upholding our commitment to protecting our values, our Customers, and our data.

AI tools go through a multi-step review to identify both benefits and risks. The review process includes evaluating the types of data and personal information the tool uses, assessing accuracy and quality of outputs, identifying any safety and security implications, and confirming that appropriate safeguards are in place before the tool is approved for use.

Our AI literacy strategy is to lead in People-centered, responsible AI adoption by focusing on enabling every Employee, at all skill levels, to confidently use AI tools. Our approach prioritizes agility and personalization, meeting Employees where they are in their AI journey while driving workforce empowerment, operational efficiency, and risk mitigation.

Our AI Literacy program is built on four key pillars:

  1. Training & Development: Build foundational and functional understanding of AI across roles and levels.
  2. Change Management: Prepare the organization for new ways of working with AI.
  3. AI Governance: Ensure AI is used responsibly, safely, in alignment with Southwest’s AI Acceptable Use Policy, and in line with enterprise risk tolerance.
  4. Communities of Practice: Foster peer-to-peer learning and collaboration through structured communities.