Risk management is critical for corporate finance management systems, in addition to corporate social responsibility (CSR) and sustainable development (SD) programs. Stakeholders need risk information to make informed judgments as to their involvement. No studies exist to date concerning disclosure of non-financial and financial risks in corporate annual statements and Polish strategic sector company reports. The authors sought to determine whether energy companies disclosed risks in non-financial annual reports in 2011–2020 (e.g., CSR, integrated, and board activity reports), and whether one can assess threats, including business activity risks and SD, based on these reports. We assessed the reports of all large Polish energy companies on a three- and five-degree scale to develop a model for risk information disclosures. We have three key empirical findings. Only half the analysed companies disclose annual financial data, threats, and risks. Less than half have implemented and operate enterprise risk management systems. The current ‘soft’ regulatory solutions give energy companies appreciable risk disclosure options, which often is counterproductive. We suggest developing a single integrated European Union (EU) regulation (e.g., directives, standards, or official principles) for non-financial risk disclosures. Our model classifies Polish energy company risks to business activity operations and risk management systems. Other sectors can use this universal model. Our results constitute progress in identifying company risks and may encourage continuing studies of other energy companies, especially in Central and Eastern Europe (CEE), which should be intensively developed. Research should also occur in other strategic sectors.