XML 470 R40.htm IDEA: XBRL DOCUMENT
v3.25.4

Cybersecurity Risk Management and Strategy Disclosure | 12 Months Ended
--- | ---
Dec. 31, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items] |
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | We believe A SML’s competitive edge is grounded in knowledge and IP built over decades. While this expertise is developed collaboratively by our people and our thriving ecosystem of suppliers, partners, customers and knowledge institutions, we aim to ensure it is systematically captured, documented and protected to maintain our industry leadership. Our innovation ecosystem is largely based on the exchange of ideas and insights, which makes the protection of knowledge a challenge, but also makes it difficult for others to replicate our work. This knowledge is captured in our information management infrastructure. Our prime objective is to protect the integrity and confidentiality of our critical information and data while ensuring continuity of our operations. This should be embedded in our processes, people and infrastructure. However, as we innovate and collaborate together, our partners inevitably need access to some parts of our systems’ infrastructure. We aim to enable this in a secure way, with best-in-class security functions deployed across our infrastructure to manage security threats and risks. We are also confronted w it h EU laws such as the NIS2 Directive and the Cyber Resilience Act (CRA), and with Cyber Incident Reporting for Critical Infrastructure (Cybersecurity and Infrastructure Security Agency) in the US, which highlight regulations seeking to ensure critical infrastructure organizations are securing themselves effectively. As perpetrators make use of more advanced methods, implementing adequate responses becomes more complex – so we continue to take steps to try to deal with this effectively. In the event of a security incident involving the loss of information assets, the materiality of the incident is jointly assessed by technology leaders and subject matter experts with support from Corporate Intellectual Property and Legal and Compliance. In 2025, as far as we are aware, ASML had zero incidents with a material impact. Read more in Strategic report – Risk and security – Risk factors – Cybersecurity and other security incidents, or disruptions in our processes or technology systems, could materially adversely affect our business operations How we m anage information secu rity We have a dedicated Security function to ensure we properly manage all security risks. The security risk assessment process, which includes cybersecurity, sits within our ERM process and follows our governance structure, with the Security Committee as a sub-committee of the CESR, which acts as the oversight committee mandated by the BoM. The three layers of our security governance framework are: 1.The Security Committee: Oversees and promotes the integration of security risk management methodologies and related controls in ASML’s business processes. T he Security Committee reports into the CESR. 2.The Security Function Management team: Monitors the implementation and execution of security risk management methodologies and related controls in ASML’s business processes. 3.The Security Expert team: Determines the risk and control strategies and generates input for tactical plans by providing content expertise and setting requirements. This governance framework enables cross- disciplinary alignment through structured meetings and ensures integration throughout our broader risk management profile. Alongside evaluation by our Internal Audit department, we have engaged several third parties to evaluate our security capabilities and maturity and provide both expertise and resources to assist in identifying and managing material cybersecurity risks. Some examples of these engagements include external validation of security management systems, capability assessments, red-teaming, penetration testing and tabletop exercises.
Cybersecurity Risk Management Processes Integrated [Flag] | true
Cybersecurity Risk Management Processes Integrated [Text Block] | How we m anage information secu rity We have a dedicated Security function to ensure we properly manage all security risks. The security risk assessment process, which includes cybersecurity, sits within our ERM process and follows our governance structure, with the Security Committee as a sub-committee of the CESR, which acts as the oversight committee mandated by the BoM. The three layers of our security governance framework are: 1.The Security Committee: Oversees and promotes the integration of security risk management methodologies and related controls in ASML’s business processes. T he Security Committee reports into the CESR. 2.The Security Function Management team: Monitors the implementation and execution of security risk management methodologies and related controls in ASML’s business processes. 3.The Security Expert team: Determines the risk and control strategies and generates input for tactical plans by providing content expertise and setting requirements.
Cybersecurity Risk Management Third Party Engaged [Flag] | true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] | true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] | false
Cybersecurity Risk Board of Directors Oversight [Text Block] | We have a dedicated Security function to ensure we properly manage all security risks. The security risk assessment process, which includes cybersecurity, sits within our ERM process and follows our governance structure, with the Security Committee as a sub-committee of the CESR, which acts as the oversight committee mandated by the BoM. The Security function led by the Chief Information Security Officer (CISO) monitors risk prevention, detection, mitigation and remediation processes related to cybersecurity, and regularly reports to the Security Governance and to the Audit Committee. We have implemented processes to identify and respond to cybersecurity threats intended to comply with standards set by the International Organization for Standardization (ISO 27002), International Society of Automation (ISA/ IEC 62443) and US National Institute of Standards and Technology (NIST Cybersecurity Framework). We have a dedicated team that works to increase our strength and maturity and minimize exploitable vulnerabilities by monitoring threats, assessing our vulnerability and defining incident responses. The central security organization was set up to define the policies, procedures and adherence to these policies in a second-line role, coordinated closely with the security representatives in the business. It also delivers operational services to the ASML organization via the Security Operations Center (SOC). In case of incidents, the SOC is to be the central point for dealing with these incidents effectively. In the event of a possible material cybersecurity incident, the Corporate Crisis Management team (CCMT) verifies the assessment and proposed response. The CCMT is chaired by the Chief Operations Officer, who r eports out to the BoM on the proposed response. A dedicated governance structure is in place to deal with a crisis situation effectively. The CISO coordinates the response as a second line of responsibility, along with the security teams in the business.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] | We have a dedicated Security function to ensure we properly manage all security risks. The security risk assessment process, which includes cybersecurity, sits within our ERM process and follows our governance structure, with the Security Committee as a sub-committee of the CESR, which acts as the oversight committee mandated by the BoM.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] | We have a dedicated Security function to ensure we properly manage all security risks. The security risk assessment process, which includes cybersecurity, sits within our ERM process and follows our governance structure, with the Security Committee as a sub-committee of the CESR, which acts as the oversight committee mandated by the BoM. It also delivers operational services to the ASML organization via the Security Operations Center (SOC). In case of incidents, the SOC is to be the central point for dealing with these incidents effectively. In the event of a possible material cybersecurity incident, the Corporate Crisis Management team (CCMT) verifies the assessment and proposed response. The CCMT is chaired by the Chief Operations Officer, who r eports out to the BoM on the proposed response. A dedicated governance structure is in place to deal with a crisis situation effectively. The CISO coordinates the response as a second line of responsibility, along with the security teams in the business.
Cybersecurity Risk Role of Management [Text Block] | The Security function led by the Chief Information Security Officer (CISO) monitors risk prevention, detection, mitigation and remediation processes related to cybersecurity, and regularly reports to the Security Governance and to the Audit Committee. We have implemented processes to identify and respond to cybersecurity threats intended to comply with standards set by the International Organization for Standardization (ISO 27002), International Society of Automation (ISA/ IEC 62443) and US National Institute of Standards and Technology (NIST Cybersecurity Framework). We have a dedicated team that works to increase our strength and maturity and minimize exploitable vulnerabilities by monitoring threats, assessing our vulnerability and defining incident responses. The central security organization was set up to define the policies, procedures and adherence to these policies in a second-line role, coordinated closely with the security representatives in the business. It also delivers operational services to the ASML organization via the Security Operations Center (SOC). In case of incidents, the SOC is to be the central point for dealing with these incidents effectively. In the event of a possible material cybersecurity incident, the Corporate Crisis Management team (CCMT) verifies the assessment and proposed response. The CCMT is chaired by the Chief Operations Officer, who r eports out to the BoM on the proposed response. A dedicated governance structure is in place to deal with a crisis situation effectively. The CISO coordinates the response as a second line of responsibility, along with the security teams in the business. Third-party cybersecurity risks In order to both oversee and identify risks from cybersecurity threats associated with our use of third parties, all of our providers are required to comply with our ASML Security Controls (part of the Supplier Security Policy). We assess and monitor providers using a risk-based approach based on ISO 27002, ISA/IEC 62443 and N IST Cybersecurity Framework. We also have a dedicated team to deploy procedures to increase our resistance strength and minimize vulnerabilities by monitoring threats, assessing our vulnerability through testing, and defining responses.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] | true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] | The Security function led by the Chief Information Security Officer (CISO) monitors risk prevention, detection, mitigation and remediation processes related to cybersecurity, and regularly reports to the Security Governance and to the Audit Committee. We have implemented processes to identify and respond to cybersecurity threats intended to comply with standards set by the International Organization for Standardization (ISO 27002), International Society of Automation (ISA/ IEC 62443) and US National Institute of Standards and Technology (NIST Cybersecurity Framework). We have a dedicated team that works to increase our strength and maturity and minimize exploitable vulnerabilities by monitoring threats, assessing our vulnerability and defining incident responses.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] | The Security function led by the Chief Information Security Officer (CISO) monitors risk prevention, detection, mitigation and remediation processes related to cybersecurity, and regularly reports to the Security Governance and to the Audit Committee. We have implemented processes to identify and respond to cybersecurity threats intended to comply with standards set by the International Organization for Standardization (ISO 27002), International Society of Automation (ISA/ IEC 62443) and US National Institute of Standards and Technology (NIST Cybersecurity Framework). We have a dedicated team that works to increase our strength and maturity and minimize exploitable vulnerabilities by monitoring threats, assessing our vulnerability and defining incident responses.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] | In the event of a possible material cybersecurity incident, the Corporate Crisis Management team (CCMT) verifies the assessment and proposed response. The CCMT is chaired by the Chief Operations Officer, who r eports out to the BoM on the proposed response. A dedicated governance structure is in place to deal with a crisis situation effectively. The CISO coordinates the response as a second line of responsibility, along with the security teams in the business.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] | true

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardOfDirectorsOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementExpertiseOfManagementResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleReportToBoardFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskManagementProcessesForAssessingIdentifyingAndManagingThreatsTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K + Details
Name: | cyd_CybersecurityRiskManagementStrategyAndGovernanceLineItems
Namespace Prefix: | cyd_
Data Type: | i:stringItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskManagementThirdPartyEngagedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskMateriallyAffectedOrReasonablyLikelyToMateriallyAffectRegistrantFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskProcessForInformingBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskProcessForInformingManagementOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskRoleOfManagementTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskThirdPartyOversightAndIdentificationProcessesFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration