Artificial intelligence

The loss of a source of supply, or lack of sufficient availability of key components, could require that we locate an alternate source or redesign our products, either of which could result in business interruption and increased costs. Increases in market demand or scarcity of raw materials or components have resulted, and may in the future result, in shortages in availability of important components for our solutions, supply allocation challenges, deployment delays and increased cost, lead times and delivery cycle timelines. There are a number of significant technology trends or developments underway or emerging – including AI, the IoT, autonomous vehicles, and advances in mobile communications such as 5G technologies – that have previously resulted in, and we believe will continue to result in, increased market demand for key raw materials or components upon which we rely.

Read in the 10-K filed Dec 20, 2024 ↗

In the ordinary course of our business, our network environment and assets, and the networks and assets of our third-party business partners, including our supply chain and other vendors, maintain certain information that is confidential, regulated, proprietary or otherwise sensitive in nature to our business. This information may include intellectual property and product information, personal data, financial information and other confidential business information relating to us and our employees, customers, suppliers and other business partners. The frequency, sophistication and unpredictability of cybersecurity events globally have increased, and can be more acute during times of geopolitical tension or instability between countries. In addition, companies in the technology industry, and in particular, manufacturers of networking and communications products, have been increasingly subjected to a wide variety of data security incidents, including cyber-attacks, attacks against products, and other attempts to gain unauthorized access to network assets, infrastructure or sensitive information. Our network systems, devices, storage and other business applications, and those that we rely on, and that are maintained by our third-party providers, have been in the past, and may be in the future, subjected to security incidents including attack, exploitation, intrusion, disruption and other malfeasance or attempts to gain unauthorized access or conduct other unauthorized activities. Further, our network systems, devices, storage and other business applications may be targeted for data security incidents as a vicarious method to target our customers. Such data security incidents may be caused by malice or negligence from either third-party or internal actors. These threats arise from actions by nation states, independent hackers, hacktivist groups, organized cybercrime entities, and other third parties, as well as from malicious actors from within or supporting our organization. Further, evolving technologies, including AI, pose new threats. In some cases, it is difficult to anticipate, detect or identify indicators of such incidents and assess the damage caused thereby. If an actual or perceived data security incident affects our network or any of our third-party providers’ networks, we could incur significant costs, our technology and operations could be impacted, our customers and other stakeholders and/or their network environments could be impacted, our reputation could be harmed, and we may become involved in litigation, including with respect to allegations of breach of contract. We may also be subject to increased regulatory oversight, including governmental investigations, enforcement actions, and regulatory fines. We could also experience delays in reporting our financial results, and we may lose revenue and profits as a result of our inability to timely produce, distribute, invoice, and collect payments for our products and services. Additionally, a data security incident may result in significant remediation expenses and increased cybersecurity protection and insurance costs.

Read in the 10-K filed Dec 20, 2024 ↗

•the introduction of disruptive technologies, such as AI/HPC, that compete for large scale sites; and

Read in the 10-K filed Feb 25, 2025 ↗

As a publicly traded company, we and third parties that we rely upon face numerous and evolving cybersecurity threats and experience cyber-attacks, such as phishing and other attempts to gain unauthorized access to our systems on a regular basis, and we anticipate continuing to be subject to such attempts. There is an ongoing risk that some or all of our bitcoin could be lost or stolen as a result of one or more of these security incidents. As we increase in size, and threat actors become increasingly sophisticated in using techniques and tools—including artificial intelligence—that circumvent security controls, evade detection and remove forensic evidence, we may become a more appealing target of hackers, malware, cyber-attacks or other security threats. We may also be unable to detect, investigate, remediate or recover from future attacks or incidents and eliminate all such vulnerability. For example, we provide cybersecurity training for employees, but we cannot guarantee that we will not be affected by further phishing attempts.

Read in the 10-K filed Feb 25, 2025 ↗

Additionally, we may not be able to ensure the adequacy of our security measures or those employed by third parties, including our mining pool service providers, custodians or other counterparties. Our business operations and reputation depend on our ability to maintain the confidentiality, integrity and availability of data, digital assets and systems related to our business, personal information, proprietary technologies, processes and intellectual property (“Confidential Information”). We, our business and commercial partners rely extensively on third-party service providers’ information technology, computer systems, hardware, software, technology infrastructure and online sites and networks (collectively, “IT Systems”), including renewable energy infrastructure, cloud-based systems and on-premises servers (i.e., data centers), to record and process transactions and manage our operations, among other matters. We and our third-party service providers, partners, custodians and collaborators, may experience failures of, or disruptions to, IT systems and may be subject to attempted and successful security breaches or cybersecurity incidents. Efforts to limit the ability of malicious actors to disrupt the operations of the internet or undermine our own security efforts may be costly to implement and may not be successful. Such incidents, whether attributable to a vulnerability in our or third party IT Systems, or otherwise, could result in claims of liability against us, damage our reputation and materially harm our business. Remote and hybrid working arrangements at our company, and at many third-party providers, also increase cybersecurity risks due to the challenges associated with managing remote computing assets and security vulnerabilities that are present in many non-corporate and home networks. Additionally, any integration of artificial intelligence in our or any service providers’ or partners’ operations, products or services is expected to pose new or unknown cybersecurity risks and challenges.

Read in the 10-K filed Feb 25, 2025 ↗

Media or other reports of existing or perceived security vulnerabilities in our systems or those of our third-party business partners or service providers can also adversely impact our brand and reputation and negatively impact our business. Additionally, the techniques and sophistication used to conduct cyber-attacks and compromise information technology systems, as well as the sources and targets of these attacks, change frequently and are often not recognized until such attacks are launched or have been in place for a period of time. The rapid evolution and increased adoption of artificial intelligence technologies amplifies these concerns. We continue to make significant investments in technology, third-party services and employees to develop and implement systems and processes that are designed to anticipate cyber-attacks and to prevent or minimize breaches of our information technology systems or data loss, but these security measures cannot provide assurance that we will be successful in preventing such breaches or data loss.

Read in the 10-K filed Feb 5, 2025 ↗

While we continuously update our policies, programs, processes and practices, many of our data management, modeling, AI, aggregation and implementation processes are manual and may be subject to human error, data limitations, process delays or system failure. Failure to manage data effectively and to aggregate data in an accurate and timely manner may limit our ability to manage current and emerging risk, to produce accurate financial, regulatory and operational reporting as well as to manage changing business needs. If our Framework is ineffective, we could suffer unexpected losses which could materially adversely affect our results of operation or financial condition. Also, any information we provide to the public or to our regulators based on incorrectly designed or implemented models or AI could be inaccurate or misleading. Some of the decisions that our regulators make could be affected adversely due to the perception that the quality of the data, models and AI used to generate the relevant information is insufficient. In addition, regulation of AI is rapidly evolving worldwide as legislators and regulators are increasingly focused on these powerful emerging technologies. The technologies underlying AI and its uses are subject to a variety of laws and regulations, including intellectual property, privacy, data protection and data security, consumer protection, competition, and equal opportunity laws, and are expected to be subject to increased regulation and new laws or new applications of existing laws and regulations. AI is the subject of ongoing review by various U.S. governmental and regulatory agencies, and various U.S. states and other foreign jurisdictions are applying, or are considering applying, their platform moderation, privacy, data protection and data security laws and regulations to AI or are considering general legal frameworks for AI. We may not be able to anticipate how to respond to these rapidly evolving frameworks, and we may need to expend resources to adjust our offerings in certain jurisdictions if the legal frameworks are inconsistent across jurisdictions. Furthermore, because AI technology itself is highly complex and rapidly developing, it is not possible to predict all of the legal, operational, competitive or technological risks that may arise relating to the use of AI.

Read in the 10-K filed Feb 20, 2025 ↗

•Our increased focus on HPC hosting may not be successful and depends on the continuing development and resource and computational requirements of HPC hosting applications such as cloud computing, machine learning and artificial intelligence and continuing need for the infrastructure and services we provide. If our target customer markets, which are new and still developing, do not grow or develop as expected or in a manner consistent with our current business model, our business, financial condition and results of operation would be adversely affected.

Read in the 10-K filed Feb 27, 2025 ↗

Our increased focus on HPC hosting may not be successful and depends on the continuing development and resource and computational requirements of HPC hosting applications such as cloud computing, machine learning and artificial intelligence and continuing need for the infrastructure and services we provide. If our target customer markets, which are new and still developing, do not grow or develop as expected or in a manner consistent with our current business model, our business, financial condition and results of operation would be adversely affected. Further, increases in power costs could negatively impact our hosting customers’ demand for services, harm our growth prospects and could have a material adverse effect on our business, financial condition and results of operations.

Read in the 10-K filed Feb 27, 2025 ↗

We and our customers are affected by general business and economic conditions in the United States and globally, particularly those impacting the cloud computing, machine learning and AI industries. These conditions include short-term and long-term interest rates, inflation, money supply, political issues, legislative and regulatory changes, including the imposition of new tariffs affecting our or our customers’ products and services, fluctuations in both debt and equity capital markets and broad trends in industry and finance, all of which are beyond our control. Macroeconomic conditions that affect the economy and the economic outlook of the United States and the rest of the world could adversely affect our customers and vendors, which could have a material adverse effect on our business, financial condition and results of operations.

Read in the 10-K filed Feb 27, 2025 ↗

We continue to evaluate emerging technologies like artificial intelligence, machine learning, and generative artificial intelligence for incorporation into our business to augment our products and services. Such technologies present unique business opportunities along with ever-changing legal and regulatory risks. Both state and federal regulations relating to these emerging technologies are quickly and constantly evolving and may require significant resources to modify and maintain business practices to comply with laws, the nature of which cannot be determined at this time. Our failure to accurately identify and address our responsibilities and liabilities in this new environment could negatively affect any solutions we develop incorporating such technology and could subject us to reputational harm, regulatory action, or litigation, which may harm our financial condition and operating results. These same risks apply to our third-party service providers who are implementing these tools into the products or services they provide to us. Any failures to manage and mitigate these risks by these third-party service providers may negatively affect the products and services we provide our clients.

Read in the 10-K filed Sep 26, 2025 ↗

•evolving techniques used to breach or sabotage IT systems and infrastructure, including as a result of the increased use of AI technologies by bad actors, which are generally not recognized until launched against a target, and could result in our being unable to anticipate or implement adequate measures to prevent such techniques;

Read in the 10-K filed Mar 5, 2025 ↗

We are increasingly building AI into many of our offerings, including generative and agentic AI. As with many innovations, AI offerings, such as Agentforce, and our Salesforce Platform present additional risks and challenges that could affect their adoption and therefore our business. For example, the development of our AI offerings and the Salesforce Platform, which provides information regarding our customers’ customers, present emerging ethical issues. If we enable or offer solutions that draw controversy due to their perceived or actual impact on human rights, privacy, employment, or in other social contexts, we may experience new or enhanced governmental or regulatory scrutiny, brand or reputational harm, competitive harm or legal liability, especially as geopolitical turmoil creates increasingly volatile political and market conditions. Inadequate or ineffective AI development, deployment, content labeling or governance by us or others that result in controversy could also impair the acceptance of AI solutions or result in unintended performance of the services. This in turn could undermine confidence in the decisions, predictions, analysis or other content that our AI applications produce, subjecting us to competitive harm, legal liability and brand or reputational harm. The rapid evolution of AI will require the application of resources to develop, test and maintain our products and services to help ensure that AI is implemented ethically in order to minimize unintended, harmful impact. Uncertainty around new and emerging AI applications such as generative AI content creation and AI agents will require additional investment in compliance, governance and the licensing or development of proprietary datasets, machine learning models and systems to test for accuracy, bias and other variables, which are often complex, may be costly and could impact our profit margin. Moreover, the move from AI content classification to AI content generation through our development of Agentforce and other generative AI products brings additional risks and responsibility. Known risks of generative AI currently include risks related to accuracy, bias, toxicity, privacy and security and data provenance. For example, AI technologies, including generative AI, may create content that appears correct but is factually inaccurate or flawed, or contains copyrighted or other protected material, and if our customers or others use this flawed or protected content to their detriment, or the owners of such copyrighted material seek to enforce their rights, we may be exposed to brand or reputational harm, competitive harm and/or legal liability. Developing, testing and deploying AI systems may also increase the cost profile of our offerings due to the nature of the computing costs involved in such systems. If we are unable to mitigate these risks, or if we incur excessive expenses in our efforts to do so, our reputation, business, operating results and financial condition may be harmed.

Read in the 10-K filed Mar 5, 2025 ↗

•evolving regulations of cloud computing, AI and cross-border data transfer restrictions and similar regulations; and

Read in the 10-K filed Mar 5, 2025 ↗

The world has experienced an exponential level of growth in the availability of potential applications of artificial intelligence (AI). AI could disrupt certain aspects of our business and evolve use of technology in ways that are not yet known. If we are not able to adapt and effectively incorporate potential advantages of AI in our business, it may negatively impact our ability to compete. On the other hand, if we are not able to effectively manage the risks of AI, including the potential for poor or inconsistent quality, privacy concerns, risks related to automated decision-making, and the potential for exposure of confidential and/or propriety information, we may suffer harm to our consolidated results of operations and reputation.

Read in the 10-K filed Jul 28, 2025 ↗

The footwear, apparel, and accessories industry is highly competitive and subject to changing consumer preferences and tastes. Our inability to compete effectively could cause our market share to decline, which could harm our reputation and have a material adverse effect on our financial condition and results of operations. Our competitors include both established companies and newer entrants into the market. In particular, we believe that, as a result of the growth of the UGG and HOKA brands, competitors have entered the marketplace specifically in response to the success of our brands, and other competitors may do so in the future, particularly as access to offshore manufacturing and changes in technology make it easier and more cost effective to compete. A number of our larger competitors have significantly greater financial, technological, engineering, manufacturing, marketing, and distribution resources than we do, as well as greater brand awareness in the footwear, apparel, and accessories markets among consumers. As a result, we have faced, and expect to continue to face, intense pressure with respect to competition for key customer accounts and distribution channels. These competitors may have relationships with our key retail customers that are more important to those customers because of the significantly larger volume and product mix that our competitors sell to them. Our competitors’ greater resources may enable them to more effectively compete on the basis of price and production, develop new products more quickly or with superior technical capabilities, adapt to changes in technology, including the successful utilization of data analytics, artificial intelligence, and machine learning, market their products and brands more successfully, identify or influence consumer preferences, increase their market share, withstand the effects of seasonality, and manage periodic downturns in the footwear, apparel, and accessories industry or in economic conditions. As a result of these pressures, we have faced, and expect to continue to face, intense pricing pressure. Efforts by our competitors to dispose of excess inventories may significantly reduce prices of competitive products, which may pressure us to reduce the pricing of our products to compete, or cause consumers to shift their purchasing decisions away from our products entirely. Further, we believe that our key customers face intense competition from their competitors, which could negatively affect the financial stability of their businesses and their ability to conduct business with us.

Read in the 10-K filed May 23, 2025 ↗

We store and transmit a significant amount of sensitive information, including the personal information of our customers and employees, credit card information, and our proprietary financial, operational, and strategic information. The loss, theft, misuse, or unauthorized disclosure or access to such information could lead to significant reputation or competitive harm, result in litigation, expose us to regulatory proceedings, and cause us to incur substantial losses. As a result, we believe our future success and growth depends, in part, on the ability of our systems, including those utilizing artificial intelligence (AI) such as generative AI, to prevent the theft, loss, misuse, or unauthorized access of this information, and to respond quickly and effectively if data security incidents occur. Data privacy and security incidents may prevent us from maintaining the privacy of this information, result in the disruption of our business, and require us to expend significant resources to secure such information and respond to incidents, any of which could materially adversely affect our business, financial condition, or results of operations.

Read in the 10-K filed May 23, 2025 ↗

The frequency, intensity, and sophistication of cyber and data security incidents have significantly increased in recent years. Like other businesses, we have experienced, and are continually at risk of, attacks and incidents. Our risk and exposure to these matters remains heightened because of, among other things, the evolving nature of these threats, the current global economic and political environment, our prominent size and scale, the advances in computer capabilities and AI, and the interconnectivity and interdependence of third parties to our systems. We

Read in the 10-K filed May 23, 2025 ↗

We continually strive to improve and automate our operational and IT systems and processes as part of our ongoing effort to improve the overall efficiency and competitiveness of our business. Transitioning to these new or upgraded processes and systems requires significant capital investments and personnel resources. Implementation is also highly dependent on the coordination of numerous employees, contractors and software and system providers. While these efforts have resulted in improvements to our operational systems, we expect to continue to incur expenses to implement additional improvements and upgrades to our systems. Many of these expenditures have been and may continue to be incurred in advance of the realization of any direct benefits to our business. We cannot guarantee that we will be successful at improving our operational systems, adapting to changes in technology, including the successful utilization of data analytics, AI, and machine learning, or that our efforts will result in the anticipated benefits to us. In addition, the integration of emerging technologies, including data analytics, AI, and machine learning, into our systems and processes may require us to address rapidly developing laws and regulations governing AI. We may also experience difficulties in implementing or operating our new or upgraded operational or IT systems, including, but not limited to, ineffective or inefficient operations, significant system failures, system outages, delayed implementation and loss of system availability, which could lead to increased implementation and/or operational costs, loss or corruption of data, delayed shipments, excess inventory and interruptions of operations resulting in lost sales and/or profits. If our operational or IT system upgrades, improvements and associated implementation efforts are not successful, our financial condition and results of operations could be adversely affected, and our business may become less competitive.

Read in the 10-K filed May 23, 2025 ↗

We use generative artificial intelligence, including in certain of our products and services, which may result in operational challenges, legal liability and reputational concerns that could adversely affect our business and results of operations.

Read in the 10-K filed Mar 27, 2025 ↗

We deploy generative AI into certain of our products and services, which may result in adverse effects to our operations, legal liability, reputation and competitive risks. The use of generative AI may lead to challenges, concerns and risks that are significant or that we may not be able to predict, especially if our use of these technologies in our products and services becomes more important to our operations over time.

Read in the 10-K filed Mar 27, 2025 ↗

Generative AI in our products and services may be difficult to deploy successfully due to operational issues inherent to the nature of such technologies. For example, AI algorithms use machine learning and predictive analytics which may be insufficient or of poor quality and reflect inherent biases and could lead to flawed, biased, and inaccurate results. In addition, generative AI may create content that appears correct but is factually inaccurate or flawed, or contains copyrighted or other protected material, and if our customers or others use this flawed content to their detriment, we may be exposed to brand or reputational harm, competitive harm, and/or legal liability. For example, deficient or inaccurate recommendations, summaries, or analyses that generative AI features assist in producing could lead to customer rejection, or skepticism of our products, affect our reputation or brand, and negatively affect our financial results. Further, unauthorized use or misuse of generative AI by our employees or others may result in disclosure of confidential company and customer data, reputational harm, privacy law violations and legal liability. Generative AI is also the subject of a quickly evolving legal and regulatory environment, and new or enhanced governmental or regulatory scrutiny, litigation, ethical concerns, or other complications related to our use of generative AI could cause us to divert resources towards compliance and adversely affect our business, reputation, or financial results. Our use of generative AI may also lead to novel and urgent cybersecurity risks, including the misuse of personal data, which may adversely affect our operations and reputation.

Read in the 10-K filed Mar 27, 2025 ↗

To remain competitive, we must continue to develop new product offerings, applications, features, and enhancements to our products. Maintaining adequate resources to meet the demands of our customers and the market is essential. If we are unable to develop our products and services, including through the development of emerging technologies, such as AI, we may miss market opportunities, and our products may become less attractive to users. Our competitors may have or expend a greater amount of resources to improve technology, and our failure to maintain adequate development programs or compete effectively could materially and adversely affect our business.

Read in the 10-K filed Mar 27, 2025 ↗

Our use of generative artificial intelligence tools may pose particular risks to our proprietary software and systems and subject us to legal liability.

Read in the 10-K filed Mar 27, 2025 ↗

We use generative AI tools in our business and expect to use generative AI tools in the future. We have no formal policy regarding use of generative AI and have taken a discretionary-based approach with respect to our employee’s use of generative AI tools. Although we have guidelines with respect to our employees’ use of generative AI tools that encourage the review of certain use cases at the executive level, we do not have processes in place to track and evaluate our employees’ use of generative AI tools and cannot guarantee that all uses will be in accordance with our guidelines.

Read in the 10-K filed Mar 27, 2025 ↗

Generative AI tools producing content which can be indistinguishable from that generated by humans is a relatively novel development, with benefits, risks, and liabilities still unknown. Recent decisions of governmental entities and courts (such as the U.S. Copyright Office, U.S. Patent and Trademark Office, and U.S. Court of Appeals for the Federal Circuit) interpret U.S. copyright and patent law as limited to protecting works and inventions created by human authors and inventors, respectively. We are therefore unlikely to be able to obtain U.S. copyright or patent protection for works or inventions wholly created by a generative AI tool, and our ability to obtain U.S. copyright and patent protection for source code, text, images, inventions or other materials, which are developed with some use of generative AI tools may be limited, if available at all. Likewise, the availability of such IP protections in other countries is unclear. As a result, we could have no remedy if third parties reused those same materials, or similar materials, also generated by AI tools. In addition, we may have little or no insight into the third-party content and materials used to train third party generative AI tools, or the extent of the original works which remain in the outputs. As a result, we may face claims from third parties claiming infringement of their intellectual property rights, or mandatory compliance with open-source software or other license terms, with respect to software, or other materials or content we believed to be available for use, and not subject to license terms or other third-party proprietary rights. We could also be subject to claims from the providers of the generative AI tools, if we use any of the generated materials in a manner inconsistent with their terms of use. Any of these claims could result in legal proceedings and could require us to purchase a costly license, comply with the requirement of open source software license terms, or limit or cease using the implicated software, or other materials or content unless and until we can re-engineer such software, materials, or content to avoid infringement or change the use of, or remove, the implicated third party materials, which could reduce or eliminate the value of our technologies and services. Any use of generative AI tools to develop source code may also present additional security risks because the generated source code may have been modelled from publicly available code, or otherwise not subject to all of our standard internal controls, which may make it easier for hackers and other third parties to determine how to breach our website and systems that rely on the code. Any of these risks could be difficult to eliminate or manage, and, if not addressed, could have a material adverse effect on our business, results of operations, financial condition, and future prospects.

Read in the 10-K filed Mar 27, 2025 ↗

New and changing technologies, industry-wide standards, and laws and regulations can also impact our ability to develop and implement the programs, products and services that our consumers want in a timely, effective and compliant manner. For example, the AI regulatory landscape is still uncertain and evolving, and the development and use of AI technologies, including Gen AI, in new or existing products and features may be subject to new or enhanced governmental or regulatory restrictions and scrutiny, litigation, ethical concerns or other complications over time. Our future success depends not only on our ability to develop new technologies, but also on our ability to identify and adapt to the technological changes that matter to our consumers and evolving legal, regulatory and industry standards that will govern those technologies. A shift in industry standards or laws and regulations could render some of our products and services obsolete or place them at a competitive disadvantage against other consumer buying and selling alternatives. We may lack the time, resources or experience to deliver the products and services that our consumers need when they need them, which could impact our ability to attract buyer and sellers to our platforms and harm our business. For example, our AI technologies will need to comply with AI regulations in all of our markets. We expect AI regulations in certain markets, such as the European Union and the United States, to be more restrictive than in other markets, which can place us at a disadvantage compared to companies that do not focus on markets with the most restrictive AI regulations. It may be more expensive or time consuming to develop an AI technology that satisfies AI regulations in each market that we serve and we cannot guarantee we will have the time or resources to develop multiple, compliant versions of these technologies.

Read in the 10-K filed Feb 27, 2025 ↗

In the United States, numerous states have adopted generally applicable and comprehensive consumer privacy laws, with the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”) extending more broadly to personal data about any type of California resident (including employees and individuals acting in a professional capacity at other companies as well). These new and developing state laws provide new privacy rights for residents of these states and impose corresponding obligations on organizations doing business in these states. Not only do these laws require that we make disclosures about our data collection, use and sharing practices, but they also require that we provide new rights to individuals, such as the right to access, delete and correct personal data. Complying with new and developing laws has required, and will continue to require, us to incur substantial costs and expenses. In addition, a number of other U.S. states are continuing to propose laws and regulations imposing obligations regarding the handling of personal data. Compliance with the GDPR, the new U.S. state laws, and other current and future applicable U.S. and international privacy, data protection, cybersecurity, AI, and other data-related laws can be costly and time-consuming. For example, the European Union’s comprehensive Artificial Intelligence Act (“EU AI Act”), which lays out the parameters for AI systems where non-compliance can result in fines up to 35 million euros or 7% of global turnover, came into force in August 2024. AI regulation is also expanding in the United States. For example, the California AI Transparency Act, which codifies detailed AI-related disclosure requirements, will come into force in January 2026, and the Colorado AI Act will come into force in February 2026. Implementing and complying with these varying data, privacy, and AI-related requirements in different jurisdictions could cause us to incur substantial costs and/or require us to change our business practices in a manner adverse to our business and violations of these laws can result in significant penalties.

Read in the 10-K filed Feb 27, 2025 ↗

The market for the services we offer is intensely competitive. We compete with both established and emerging online and traditional providers of travel-related services, including online travel agencies; alternative accommodation providers; wholesalers and tour operators; travel product suppliers (including hotels, airlines and car rental companies); search engines and large online portal websites; travel metasearch services; corporate travel management service providers; mobile platform travel applications; social media websites; eCommerce and group buying websites; B2B businesses and other participants in the travel industry. In addition, technological developments in generative artificial intelligence ("AI") tools may be increasingly used to create competing offerings such as AI powered digital assistants, which may further increase competition.

Read in the 10-K filed Feb 7, 2025 ↗

In recent years, search engines have increased their focus on acquiring or launching travel products that provide increasingly comprehensive travel planning content and direct booking capabilities, comparable to OTAs. For example, Google has continued to add features and functionality to its Google Travel, Google Flights, Hotel Ads and alternative accommodations metasearch products. In addition, Google may be able to leverage the data they collect on users to the detriment of us and other OTAs. Search engines may also continue to expand their voice and AI capabilities. To the extent these actions have a negative effect on our search traffic or the cost of acquiring such traffic, our business and financial performance could be adversely affected.

Read in the 10-K filed Feb 7, 2025 ↗

AI technologies used in our products and processes may use or incorporate data from third-party sources, including information they input into the AI tools, which may expose us to risks associated with data rights and protection.

Read in the 10-K filed Oct 22, 2025 ↗

Each year, an increasing amount of free or relatively inexpensive information becomes available, particularly through the internet, and this trend is likely to continue, especially with the deployment of AI tools. The availability of free or relatively inexpensive information may reduce demand for our products and services. While we believe our offerings are distinguished by such factors as standardization, timeliness, normalization, accuracy, ease-of-use, completeness and other value-added factors, if users choose to obtain the information they need from public or other sources, our business, results of operations, and cash flows could be adversely affected.

Read in the 10-K filed Oct 22, 2025 ↗

Our security processes and initiatives may be unable to detect or prevent a breach or disruption in the future. Additionally, the rapid ongoing evolution and increased adoption of emerging technologies such as artificial intelligence and machine learning may make it more difficult to anticipate and implement protective measures to recognize, detect, and prevent the occurrence of any of the cyber events described above.

Read in the 10-K filed Jul 21, 2025 ↗

•our ability to mitigate the technological, operational, legal and regulatory, and reputational risks related to autonomous technology and artificial intelligence;

Read in the 10-K filed Jul 21, 2025 ↗

As a source of critical infrastructure, the energy industry is at heightened threat of cyber-attacks, which are becoming increasingly more difficult to anticipate and prevent due to their rapidly evolving nature. We cannot anticipate, detect, or implement fully preventive measures against all cybersecurity threats because the techniques used are increasingly sophisticated and constantly evolving and in some cases, assisted by artificial intelligence.

Read in the 10-K filed Feb 27, 2025 ↗

•rapid changes in technology, including as a result of artificial intelligence, evolving industry standards, and requirements for continuous improvement in products and services that result in short product lifecycles;

Read in the 10-K filed May 21, 2025 ↗

Many governments, regulators, investors, customers, employees, and other stakeholders remain focused on sustainability practices and matters, including climate change and greenhouse gas ("GHG") emissions, environmental stewardship, responsible sourcing, social responsibility, human capital management, labor practices and workplace conduct, the usage of artificial intelligence, data privacy and human rights, with some expressing opposition to certain of these practices and matters. This attention has resulted in a variety of required and voluntary reporting regimes that are not harmonized and continue to change, including the EU’s Corporate Sustainability Reporting Directive ("CSRD") and the California Climate Corporate Data Accountability Act and Climate-Related Financial Risk Act, among other similar laws. A number of our customers have adopted, or may adopt, procurement policies that include sustainability provisions that their suppliers should comply with, or they may seek to include such provisions in their procurement terms and conditions. Moreover, a number of investors have adopted, or may adopt, sustainability policies with which they expect their portfolio companies to comply.

Read in the 10-K filed May 21, 2025 ↗

•The use of new and evolving technologies, such as AI, in our offerings may result in reputational harm and liability.

Read in the 10-K filed Feb 20, 2025 ↗

The use of new and evolving technologies, such as AI, in our offerings may result in reputational harm and liability.

Read in the 10-K filed Feb 20, 2025 ↗

Issues in the development and deployment of artificial intelligence (“AI”) may result in reputational harm and legal liability and could adversely affect our results of operations.

Read in the 10-K filed May 15, 2025 ↗

Energy intensive technological innovations and efficiencies, such as artificial intelligence, may affect or may be perceived to affect

Read in the 10-K filed Feb 6, 2025 ↗

particularly generative AI, which raises novel privacy and security issues. Enforcement practices vary widely in the jurisdictions in which our

Read in the 10-K filed Feb 6, 2025 ↗

implementation of AI in our offerings and internal systems) could subject us to regulatory action and legal liability, including under specific legislation regulating AI, as well as new applications of existing data protection, cybersecurity, privacy, intellectual property, and other laws.

Read in the 10-K filed Feb 5, 2025 ↗

readily, more successfully utilize developing technology, including data analytics, artificial intelligence, and machine

Read in the 10-K filed Feb 21, 2025 ↗

There has also been increased regulatory scrutiny of the use of emerging technologies related to artificial intelligence, including

Read in the 10-K filed Feb 21, 2025 ↗

We conduct most of our business with the U.S. Government, primarily the DoD. The majority of our business consists of the design, construction, repair, and maintenance of nuclear-powered ships and non-nuclear ships for the U.S. Navy and coastal defense surface ships for the U.S. Coast Guard, as well as the refueling and overhaul and inactivation of nuclear-powered ships for the U.S. Navy. We also provide integrated solutions that enable today's connected, all-domain force, including C5ISR systems and operations; the application of artificial intelligence and machine learning to battlefield decisions; defense and offensive cyberspace strategies and electronic warfare; uncrewed autonomous systems; live, virtual, and constructive training solutions; fleet sustainment; and critical nuclear operations. Substantially all of our revenues in 2024 were derived from products and services sold to the U.S. Government, and we expect this to continue for the foreseeable future. In addition, substantially all of our backlog as of December 31, 2024, was related to products and services deliverable to the U.S. Government. Our U.S. Government contracts are subject to various risks, including customer political and budgetary constraints and processes, changes in customer short-term and long-term strategic plans, the timing of contract awards, significant changes in contract scheduling, recessionary impacts on government spending, intense contract award and funding

Read in the 10-K filed Feb 6, 2025 ↗

to expand our business. For example, EU’s AI Act, which became effective on August 1, 2024, governs the development, marketing and use of AI in the EU and could impose significant additional costs on us to comply or significant fines for failing to comply.

Read in the 10-K filed Feb 18, 2025 ↗

As a leading technology firm, we are exposed to attacks from criminals, nation state actors, malicious insiders, and activist hackers (collectively, “malicious parties”) who have at times been able to circumvent or bypass our cyber security measures. Although some of these attacks have caused disruptions or exposure of information, so far, these attacks have not resulted in material negative impacts to HPE, nor have any of HPE’s consumers, customers, or employees informed HPE that these attacks resulted in material harm to them. While we investigate and remediate incidents, there can be no assurance that we will do so comprehensively or that the threat actor will not identify alternative means of intrusion or opportunities to otherwise utilize the information it accessed to adversely affect our business or results of operations. It is also possible that incidents may embolden other malicious actors to perpetrate future attacks that may result in material misappropriation, system disruptions or shutdowns, malicious alteration, or destruction of our confidential or personal information or that of third parties. Further, there has been an increase in the frequency and sophistication of such attacks, and we expect these activities to continue to increase, including malicious actors potentially leveraging AI to develop malicious code or sophisticated phishing attempts. Malicious parties may also be able to otherwise develop and deploy viruses, worms, ransomware, and other malicious software programs that attack our products or otherwise exploit any security vulnerabilities of our products, including within our cloud-based environments and offerings, such that we may be unable to anticipate such malicious parties’ techniques, implement adequate preventative measures, or remediate any intrusion on a timely or effective basis even if our security measures are appropriate, reasonable, and comply with applicable legal requirements. Further, cyberattacks or incidents have in the past gone, and could in the future go, undetected in our environments for a period of time, and we may discover additional impacts of earlier incidents that we believe were remediated. For example, as previously disclosed in our Form 8-K filed with the Securities and Exchange Commission on January 24, 2024, we learned in December 2023 that, beginning in May 2023, a nation-state-

Read in the 10-K filed Dec 19, 2024 ↗

In January 2024, we entered into a definitive agreement to acquire Juniper Networks, Inc., a leader in AI-native networks. Consummation of the Merger is subject to the satisfaction or waiver of certain conditions, including but not limited to (i) the adoption of the Agreement and Plan of Merger (the “Merger Agreement”), by and among Juniper Networks, HPE and Jasmine Acquisition Sub, Inc., a Delaware corporation and a wholly owned subsidiary of HPE (“Merger Sub”), by Juniper Networks’ stockholders (which was completed on April 2, 2024); (ii) the absence of any injunction, order or law preventing, prohibiting or making illegal the consummation of the Merger; (iii) the expiration or termination of the waiting period (or extension thereof) under the Hart-Scott-Rodino Antitrust Improvement Act of 1976, as amended, and the receipt of all other required approvals, consents or clearances under specified foreign antitrust laws and foreign investment laws without imposition of a Burdensome Condition (as defined in the Merger Agreement); and (iv) in the case of the obligations of HPE and Merger Sub to effect the Merger, the absence of a material adverse effect with respect to Juniper Networks that is continuing as of the closing. There can be no assurance that these or other closing conditions will be satisfied in a timely manner or at all. Any delay in completing the Merger could cause us not to realize some or all of the anticipated benefits when expected, if at all.

Read in the 10-K filed Dec 19, 2024 ↗

Further, countries are applying their data and consumer protection laws to AI, particularly generative

Read in the 10-K filed Feb 25, 2025 ↗

AI technologies are constantly evolving, and any flaws in or misuse of AI, even if committed by other third parties, could have a negative impact on our business, reputation, brands, and the general acceptance of AI solutions by society.

Read in the 10-K filed Mar 3, 2025 ↗

AI technologies are still in a preliminary stage of development and are constantly evolving. As with many disruptive innovations, AI presents risks and challenges that could affect user perception and its adoption. Any flaws in or insufficiencies of AI, and any inappropriate or premature usage thereof, whether actual or perceived, and whether by us or by other third parties, may dissuade prospective customers from adopting AI solutions, and may impair the general acceptance of AI by broader society.

Read in the 10-K filed Mar 3, 2025 ↗

•We are subject to risks associated with the potential use of AI in our own operations and by third-party partners that we may engage with.

Read in the 10-K filed Feb 28, 2025 ↗

A disruption to our information technology systems could result in the loss of confidential business, customer, supplier or employee information, litigation or fines, and may require substantial investigations, repairs or replacements or impact our ability to summarize and report financial results in a timely manner, affecting our productivity or resulting in significant financial, legal and relational costs and potentially harming our reputation and adversely impacting our operations, customer service and results of operations. Additionally, the increasing use and evolution of technology, including cloud-based computing and AI, may lead to potential loss or unauthorized disclosure or use of personal data and proprietary information that was collected, used, stored, or transferred with respect to our business, and to dissemination or destruction of confidential information, unintentionally or otherwise, stored in our or in our third-party providers’ systems or through use of AI, which may significantly increase our business and information security costs, and expose us to reputational harm, penalties, or legal liability. As we complete integration of systems of prior acquired companies with IFF’s systems and prepare for the announced divestitures, we reduce our risk profile. Additionally, an information security or data breach could require us to devote significant management and financial resources to address the problems created, and, as a result of the private rights of action provided for under the European Union’s General Data Protection Regulation (the “GDPR”), the California Consumer Privacy Act (the “CCPA”) and other laws relating to data protection and privacy in other jurisdictions, in the event of such breaches, additional private litigation against us may result. These types of adverse impacts could also occur in the event the confidentiality, integrity or availability of company, customer, supplier or employee information are compromised due to a data loss by us or a trusted third party. We or the third parties with which we share information may not discover any such incidents and/or loss of information for a significant period of time after the incident occurs. In addition, our hybrid and remote work arrangements could introduce operational risk, including cybersecurity and IT systems management risks.

Read in the 10-K filed Feb 28, 2025 ↗

We are subject to risks associated with the potential use of AI in our own operations and by third-party partners that we may engage with.

Read in the 10-K filed Feb 28, 2025 ↗

The use of AI by us, our employees or any of our third-party partners may result in unauthorized disclosure of personal data, proprietary information and trade secrets, commercially sensitive or confidential information of IFF, our employees or our partners. Similarly, we may become, through the use of AI and unbeknownst to us, recipients or users of such information provided by other parties, which may enable, among other things, third parties to claim that we infringed on their intellectual property rights. Such unauthorized disclosures or uses of information can result, among other things, in reputational harm, loss of confidence by our customers or employees, penalties, litigation costs, or legal liability.

Read in the 10-K filed Feb 28, 2025 ↗

We are not always successful or efficient in developing or implementing new process nodes and manufacturing processes. We experienced significant delays in implementing our 10nm process technology, and in 2020, we encountered a defect mode in the development of our 7nm process technology that resulted in delays relative to our prior expectations. In 2022, Intel's 4th Gen Intel Xeon Scalable processor was delayed to allow for more platform and product validation time. These delays have allowed competitors using third-party foundries, such as TSMC, to benefit from advancements in manufacturing processes introduced ahead of us, including improvements in performance, energy efficiency, and other features, which have helped increase the competitiveness of their products. On the product side, we have had limited market success with our accelerator offerings, and in 2024 we recognized $922 million in Gaudi AI accelerator inventory-related charges. We may experience greater adverse competitive impacts in the event of further delays in the development of future manufacturing process technologies and products or lack of market success with our offerings.

Read in the 10-K filed Jan 31, 2025 ↗

Our implementation of new business strategies, including our foundry strategy and our cost reduction measures, as well as our many internal structural, systems, and process changes, may subject us to a number of risks. We have entered new businesses and introduced new products and services as we seek to capitalize on the opportunities presented by growth in semiconductor demand, ubiquitous compute, pervasive connectivity, cloud-to-edge infrastructure, AI, and sensing. As part of our strategy, we announced plans to establish Intel Foundry as a major provider of foundry capacity to manufacture semiconductors for others and to implement an internal foundry operating model through updates to our processes, systems, and guardrails between our manufacturing and our individual product-based business units. The implementation of our internal foundry operating model requires many internal structural, system, and process changes to support the separation of the product and manufacturing sides of our business and our external foundry business, including a new enterprise resource planning system. In parallel, we are undertaking significant efforts to separate out portions of our business, such as operating Intel Foundry, Altera and IMS, as autonomous subsidiaries that we majority own and consolidate in order to potentially raise capital and unlock value as we focus on our core product and manufacturing capabilities. Significant business changes are inherently risky and are not always successful. For example, in 2022, we wound down Intel Optane; in 2020, we agreed to sell our NAND memory business to SK hynix; and in 2019, we exited the 5G smartphone modem business based on our determination that there was no clear path to profitability for those businesses.

Read in the 10-K filed Jan 31, 2025 ↗

These new and developing areas and products represent a significant portion of our revenue growth opportunity, and they also introduce new sources of competition in not just new and evolving markets but also in our existing markets. These new sources of competition can include established competitors with well-developed and highly competitive technologies, ecosystems, and customer bases, lower prices, margins, or costs, and greater brand recognition. These developing products and market segments require significant investment, do not always grow as projected or at all, or sometimes adopt competing technologies, and we may not realize an adequate return on our investments. For example, AI and machine learning are increasingly driving innovations in technology, but if we fail to develop leading products for these workloads, or if our customers use competing technologies, we may not realize a return on our investments in these areas. We may also not be successful in developing a competitive foundry business for external customers with respect to either leading-edge or mature process nodes, which would make it difficult for us to realize a favorable return on our investments in process technology and manufacturing capacity investments. To be successful, we need to cultivate relationships with customers and partners in these market segments and continue to improve our offerings. Despite our ongoing efforts, there is no guarantee that we will achieve or maintain market demand or acceptance for our products and services in these various market segments or realize an adequate return on our investments, which could lead to impairment of assets and restructuring charges, as well as opportunity costs.

Read in the 10-K filed Jan 31, 2025 ↗

Our global marketing objectives are to build a strong, well-known, differentiated, and meaningful Intel corporate brand that drives preference with businesses and consumers, and to offer a limited number of meaningful and valuable brands in our portfolio to aid businesses and consumers in making informed choices about technology purchases. The Intel Core processor family and Intel Xeon trademarks make up our key CPU brands. This year we introduced our new Intel Core Ultra processors, powering the latest AI PCs, and our Intel Xeon 6 processors, built with AI acceleration in every core. Our foundry services business aims to offer leading-edge packaging and process technology, geographically balanced manufacturing capacity, and a world-class IP portfolio.

Read in the 10-K filed Jan 31, 2025 ↗

In addition to bringing new products to market in 2024, we focus on building brand awareness and driving demand through our own direct marketing and co-marketing programs with partners. Our direct marketing activities primarily include advertising through digital and social media, as well as consumer and trade events, industry and consumer communications, and public relations. We market to consumer and commercial audiences. Our key messaging reinforces the Intel brand pillars of exceptionally engineered, collaboratively innovative, and responsibly built, while emphasizing our ability to bring AI everywhere across data center, cloud, edge, and PC.

Read in the 10-K filed Jan 31, 2025 ↗

We operate in a competitive international environment in all operating segments. Our products compete with products produced by other forest products companies. Product innovations, manufacturing and operating efficiencies, additional manufacturing capacity, distribution and commercial strategies pursued or achieved by competitors, the increased use of artificial intelligence ("AI") and machine learning solutions in the paper industry, and the entry of new competitors, could negatively impact our financial results. In addition, our products compete with companies that produce substitutes for wood-fiber products, such as plastics and various types of metal. Customer shifts away from wood-fiber products toward such substitute products may adversely affect our business and financial results. Further, we depend on critical suppliers and key

Read in the 10-K filed Feb 21, 2025 ↗

Pricing in the paper and packaging industry can be affected by, among other things, product commoditization, changes in demand, price reductions, entrance of new competitors or capacity, changes in product supply, and the introduction of new products, technologies and equipment, including the use of AI and machine learning solutions. We face significant pressure to reduce per unit costs to achieve commercially acceptable returns. In circumstances where we are unable to adjust the relevant cost base sufficiently, pricing pressure could have a material adverse effect on our business, financial condition, results of operations and/or future prospects.

Read in the 10-K filed Feb 21, 2025 ↗

our industry. Like other global companies, our systems are subject to recurring attempts by third parties to access information, manipulate data or disrupt operations. In this regard, we have experienced cyber threats and events from time to time, although none have materially affected us, including our results of operations or financial condition. Given the current cyber threat environment, the volume and intensity of cybersecurity attacks and attempted intrusions are expected to increase in the future. We work with a large number of third-party vendors, suppliers, platforms, software, applications, and technologies, each of which may be subject to a cybersecurity incident or information technology failure that impacts our business or operations. We may be required to spend significant resources to verify the implementation of cybersecurity controls by our vendors and suppliers. In addition, despite careful security and controls design, implementation, updating, monitoring and independent third-party verification, our information technology systems, together with those of our third-party providers or joint venture partners, have been and could again be compromised or disrupted due to factors such as employee error or malfeasance, cyber-attacks, including ransomware, malware, phishing attacks, advanced persistent threats, social engineering, credential stuffing or distributed denial-of-service attacks or data or security breaches by malicious actors such as common hackers, criminal groups or nation-state organizations or social activist (“hacktivist”) organizations, disruptions resulting from geopolitical events, natural disasters, failures or impairments of telecommunications networks or other catastrophic events. Such attacks are increasing in complexity, and the rapid evolution and increased adoption of AI technologies may intensify cybersecurity risks by making cyber-attacks more difficult to detect, contain, and mitigate. Furthermore, remote working and personal device use increases the risks of cyber incidents and the improper dissemination of personal or confidential information. Moreover, the hardware, software or applications we use may have inherent vulnerabilities or defects of design, manufacture or operations or could be inadvertently or intentionally implemented or used in a manner that could compromise information security. In addition, cybersecurity-related threats may remain undetected for an extended period of time.

Read in the 10-K filed Feb 21, 2025 ↗

As with many technological innovations, AI presents risks and challenges that could affect its adoption, and therefore our business. Uncertainty in the legal regulatory regime relating to AI may require significant resources to modify and maintain business practices to comply with international laws, the nature of which cannot be determined at this time. Several jurisdictions, including Europe, the U.S. federal government, and certain U.S. states, have already proposed or enacted laws, regulations, and other requirements governing AI. For example, on May 21, 2024, the Council of the European Union adopted the EU AI Act, regulating the developments and deployment of AI systems. The EU AI Act imposes obligations on transparency, risk management and data governance for AI systems, particularly those classified as high risk, with significant fines for noncompliance. Other jurisdictions may decide to adopt similar or more restrictive requirements that may render the use of AI challenging. These requirements may make it harder for us to conduct our business using AI, lead to regulatory fines or penalties, require us to change our business practices, or limit AI usage, which may lead to inefficiencies or competitive disadvantages.

Read in the 10-K filed Feb 21, 2025 ↗

We may fail to identify or leverage digital and/or AI transformation initiatives in areas from point-of-sale through to manufacture and delivery to customers, or miss the opportunity to meet the demand for smart products. Failure to implement digital and data programs or identify or prioritize the latest digital and/or AI transformation initiatives may result in us falling behind our competitors with regards to speed to market, smart product offerings, manufacturing capacity and service levels, each of which could have a material adverse effect on our business, financial condition, results of operations and/or future prospects.

Read in the 10-K filed Feb 21, 2025 ↗

In the U.S., an executive order was issued in October 2023 on the Safe, Secure and Trustworthy Development and Use of AI, emphasizing the need for transparency, accountability, and fairness in the development and use of AI, including in the healthcare industry. The order seeks to balance fostering innovation with addressing risks associated with AI by providing eight guiding principles and priorities, such as ensuring that consumers are protected from fraud, discrimination, and privacy risks related to AI. The order also calls for future regulations from various agencies, such as the Department of Commerce (to draft guidance for detecting and authenticating AI content) and the Federal Trade Commission (to ensure fair competition and reduce consumer harm). In alignment with the order, other agencies have published guidance. Agencies such as the Department of Commerce and the Federal Trade Commission have also issued proposed rules governing the use and development of AI technologies. Further, legislation related to AI technologies has been introduced at the federal level and is advancing at the state level. For example, on March 13, 2024, Utah passed the Utah AI Policy Act, which took effect in May 2024, imposing certain disclosure requirements on the use of AI and, on May 17, 2024, Colorado enacted the Colorado AI Act, which will take effect in February 2026. Further, the California Privacy Protection Agency is currently in the process of finalizing regulations under the CCPA regarding the use of automated decision-making. Such additional regulations may impact our ability to develop, use, and commercialize AI technologies in the future.

Read in the 10-K filed Jan 31, 2025 ↗

Other jurisdictions where we operate have already or are also expected to introduce guidelines and regulations around the use of AI within the next few years. The regulations may impose onerous obligations and may require us to rework or reevaluate improvements to be compliant, potentially increasing costs.

Read in the 10-K filed Jan 31, 2025 ↗

in part on the manner in which those third parties develop and train their models. This results in risks arising from the inclusion of any unauthorized material in the training data for their models, and the effectiveness of the steps these third parties have taken to limit the risks associated with the output of their models, matters over which we may have limited visibility. Any of these risks could expose us to liability or adverse legal or regulatory consequences and harm our reputation and the public perception of our business or the effectiveness of our security measures. In addition to our use of AI technologies, we are exposed to risks arising from the use of AI technologies by bad actors to commit fraud and misappropriate funds and to facilitate cyberattacks. Generative AI, if used to perpetrate fraud or launch cyberattacks, could result in losses, liquidity outflows, or other adverse effects at a particular financial institution or exchange. If our use of AI becomes controversial, we may experience brand or reputational harm, competitive harm, or legal liability.

Read in the 10-K filed Feb 25, 2025 ↗

Artificial intelligence, machine learning, data science and similar technologies (collectively, “AI”), including third-party AI tools, may be enabled by, or integrated into some of our business and solutions. As with many developing technologies, AI presents risks and challenges that could affect its further development, adoption, and use, and therefore our business. AI algorithms may be flawed or biased. Datasets used to train or develop AI systems may be insufficient, of

Read in the 10-K filed Nov 25, 2024 ↗

•incorrect, biased or misleading results or content generated by artificial intelligence, leading to harmful outcomes, including discrimination in lending practices against vulnerable populations, fraud, manipulation of customers, privacy breaches or intellectual property infringement

Read in the 10-K filed Feb 14, 2025 ↗

•the use of generative artificial intelligence tools by our competitors may disrupt our industry and existing business models, including ours; and

Read in the 10-K filed Feb 28, 2025 ↗

The use of artificial intelligence by us and others, and the overall adoption of artificial intelligence throughout society, may exacerbate or create new and unpredictable competitive, operational, legal and regulatory risks to our businesses. There is substantial uncertainty about the extent to which artificial intelligence will result in dramatic changes throughout the world, and we may not be able to anticipate, prevent, mitigate, or remediate all of the potential risks, challenges, or impacts of such

Read in the 10-K filed Feb 28, 2025 ↗

changes. These changes could potentially disrupt, among other things, our business models, investment strategies, operational processes, and our ability to identify and hire employees. Some of our competitors may be more successful than us in the development and implementation of new technologies, including services and platforms based on artificial intelligence, to address investor demands or improve operations. If we are unable to adequately advance our capabilities in these areas, or do so at a slower pace than others in our industry, we may be at a competitive disadvantage.

Read in the 10-K filed Feb 28, 2025 ↗

We may use artificial intelligence and other quantitative analysis tools and models, developed by us or third-party service providers, to inform certain of our decisions. Such technology, analysis and models are highly complex and subject to limitations and risks that have the potential to adversely impact us to the extent that we rely on artificial intelligence. If the data we, or third parties whose services we rely on, use in connection with the development or deployment of artificial intelligence is incomplete, inadequate or biased in some way, the performance of our products, services, and businesses could suffer. In addition, we analyze data through different means, including manual reviews, automated rules as well as the use of artificial intelligence and machine-learning technologies to better manage our business. Recent technological advances in artificial intelligence and machine-learning technology both present opportunities and pose risks to us. Data in technology that uses artificial intelligence may contain a degree of inaccuracy and error, which could result in flawed algorithms in various models used in our businesses. Our personnel or the personnel of our service providers could, without being known to us, improperly utilize artificial intelligence and machine-learning technology while carrying out their responsibilities. This could reduce the effectiveness of artificial intelligence technologies and adversely impact us and our operations to the extent that we rely on the work product of such artificial intelligence in such operations.

Read in the 10-K filed Feb 28, 2025 ↗

There is also a risk that artificial intelligence may be misused or misappropriated by our employees or third parties engaged by us. For example, a user may input confidential information, including material non-public information or personally identifiable information, into artificial intelligence applications, resulting in such information becoming a part of a dataset that is accessible by third-party technology applications and users, including our competitors. If we or third-party developers whose artificial intelligence we utilize do not have sufficient rights to use the data or other material relied upon by such developers, we also may incur liability through the alleged violation of applicable laws and regulations, third-party intellectual property, data privacy, or other rights, or contractual obligations. Further, we may not be able to control how third-party artificial intelligence that we choose to use are developed or maintained, or how data we input is used or disclosed, even where we have sought contractual protections with respect to these matters. The misuse or misappropriation of our data, unavoidable deficiencies in the practices associated with data collection, training AI technology on large data sets, and big data analytics and difficulties validating data, could have an adverse impact on our reputation and could subject us to legal and regulatory investigations or actions or create competitive risk.

Read in the 10-K filed Feb 28, 2025 ↗

Regulators are also increasing scrutiny and considering, and in some cases enacting, regulation of the use of artificial intelligence technologies, including regarding the use of "big data," diligence of data sets and oversight of data vendors. The use of artificial intelligence by us or others may require compliance with legal or regulatory frameworks that are not fully developed or tested, and we may face litigation and regulatory actions related to our use of artificial intelligence. In April 2023, the U.S. Federal Trade Commission (“FTC”), DOJ, CFPB, and EEOC released a joint statement on artificial intelligence, demonstrating their interest in monitoring the development and use of automated systems and enforcement of their respective laws and regulations. Such enforcement has included “sweeps” by the FTC focused on unfair or deceptive practices by companies purporting to use artificial intelligence in their operations or selling artificial intelligence products that may be used to mislead or deceive consumers. The NAIC has established a dedicated working group and adopted bulletins and reports on the use of artificial intelligence by insurers. Existing laws and regulations may be interpreted in new ways, which would affect the way in which we or our portfolio companies use artificial intelligence and machine-learning technology. In January 2025, the U.S. Department of Commerce’s Bureau of Industry and Security issued a rule requiring licenses to export certain closed-weight AI models and advanced computing integrated circuits beginning on May 15, 2025. In addition to the U.S. regulatory framework, in August 2024, the EU finalized a new regulation on artificial intelligence (the "EU AI Act"), parts of which are currently in effect and others of which are slated to take effect from late 2026. The EU AI Act is a legal framework, which governs the development and deployment of artificial intelligence placed on the EU market, used in the EU, or where the output is used or intended to be used within the EU. The framework bans certain uses of artificial intelligence outright based on its risk and impose material obligations on both the providers and deployers of certain other artificial intelligence activities. The fine threshold for non-compliance is expected to be 35 million euros or 7% of total annual worldwide turnover, whichever is higher, and regulators are expected to have powers to remove non-compliant products from the EU market. Other jurisdictions, such as Canada with its Artificial Intelligence and Data Act and Brazil with its AI Legal Framework, have either implemented or are also considering similar legal frameworks.

Read in the 10-K filed Feb 28, 2025 ↗

Once effective, regulations relating to artificial intelligence may expand our compliance obligations and impact our business or the business of our portfolio companies. In July 2023, the SEC proposed new predictive data analytics rules, which would require registered investment advisers (and broker-dealers) to eliminate or neutralize (rather than just disclosing and mitigating) certain conflicts of interest posed by covered technologies including artificial intelligence and machine-learning, with respect to their interactions with clients and investors in pooled investment vehicles. In order to limit their potential liability under this rule, our investment adviser entities could choose to change or discontinue some of their activities related to such technologies. We cannot predict what, if any, actions may be taken, but such developments could have a materially adverse impact to us.

Read in the 10-K filed Feb 28, 2025 ↗

Additionally, our business could be adversely affected if we or our portfolio companies fail to comply with existing and potential new applicable regulations relating to artificial intelligence, including the EU AI Act, privacy, data, and information security. The potential impact to us of these regulations is in “—Risks Related to Our Business—Rapidly developing and changing global privacy and data laws and regulations could further increase compliance costs and subject us to enforcement risks and reputational damage” and "—Risks Related to Our Business—Cybersecurity failures and data security breaches may disrupt or have a material adverse impact on our businesses, operations and investments."

Read in the 10-K filed Feb 28, 2025 ↗

•Investments in real assets may be subject to construction risks, including: (i) labor disputes, shortages of material and skilled labor, or work stoppages; (ii) the availability and timely receipt of zoning and other regulatory or environmental approvals; (iii) the availability of construction financing on favorable terms, or at all; (iv) slower than projected construction progress and the unavailability or late delivery of necessary equipment; (v) less than optimal coordination with public utilities in the relocation of their facilities; (vi) natural disasters, adverse weather conditions and unexpected construction conditions; (vii) accidents or the breakdown or failure of construction equipment or processes; and (viii) catastrophic events such as explosions, fires and terrorist activities or cyberattacks, and other similar events. Recourse against the contractor may be subject to liability caps or may be subject to default or insolvency on the part of the contractor. These risks could create substantial unanticipated delays or expenses and, under certain circumstances, could result in prolonged construction periods or prevent completion of construction activities once undertaken, which could cause investments to not be cash generative for a prolonged period or indefinitely.

Read in the 10-K filed Feb 28, 2025 ↗

The Company has previously experienced and expects to continue to experience attempts by unauthorized parties to compromise the Company’s cybersecurity controls, like the 2018 ransomware attack. The Company has also experienced and expects to continue to experience similar attempts by threat actors to penetrate the systems of third-party suppliers and vendors to whom the Company has provided data, like the 2019 AMCA data breach. These attempts, if successful, could result in the misappropriation or compromise of personal information or proprietary or confidential information stored within the Company's systems or within the systems of third parties, create system disruptions or cause shutdowns. Threat actors have a variety of attack methods, including without limitation, by developing and deploying viruses, worms, and other malicious software programs that attack the Company’s systems, the systems of third-parties, or otherwise exploit any security vulnerabilities. In addition, the increased use of AI by threat actors is enhancing the scale sophistication and effectiveness of their cyberattacks. Outside parties may also attempt to fraudulently induce employees to take actions, including the release of confidential or sensitive information or to make fraudulent payments through illegal electronic spamming, phishing, spear phishing, and other tactics.

Read in the 10-K filed Feb 25, 2025 ↗

protect against these evolving threats. In addition, as cyber threats continue to evolve including the use of AI by threat actors to compromise systems, the Company may be required to expend additional resources to continue to enhance the Company’s cybersecurity measures or to investigate and remediate any cybersecurity vulnerabilities. The Company’s remediation efforts may not be sufficient and could result in interruptions, delays, cessation of service, loss of data integrity, loss of confidentiality, and/or loss of data. This could also impact the cost and availability of cyber insurance to the Company. Cybersecurity incidents affecting the Company’s or third parties' security measures and the unauthorized dissemination of personal, proprietary or confidential information about the Company or its customers or other third parties could expose customers’ private information. Such incidents could expose customers to the risk of financial or medical identity theft or expose the Company or other third parties to a risk of loss or misuse of this information, result in litigation and potential liability for the Company, damage the Company’s brand and reputation, or otherwise harm the Company’s business. Any of these incidents could have a material adverse effect on the Company’s business, regulatory compliance, financial condition, reputation, and/or results of operations.

Read in the 10-K filed Feb 25, 2025 ↗

The Company and its third parties leverage AI and machine learning tools to increase productivity and innovation. The Company also faces potential risks from the use of AI and machine learning tools. The Company, or its customers' sensitive, proprietary, or confidential information could be leaked, disclosed, or revealed as a result of or in connection with employees' or vendors' use of generative AI technologies. In addition, the Company may use AI outputs to inform certain decisions, and AI models may create incomplete, inaccurate, or otherwise flawed outputs, some of which may appear correct. Due to the potential flaws in the use of AI, the Company could make incorrect decisions, including decisions that could bias certain individuals or classes of individuals and adversely impact their rights. The rapid development of AI tools could render obsolete certain technologies or tools we currently use, or otherwise provide competitors with a technological edge. New or evolving legislation or regulations might impose restrictions on how AI and machine learning tools can be used, requiring the Company to adapt its tools or face various penalties for non-compliance, including potential disgorgement of data and associated capabilities. As a result, the Company could face adverse consequences, including exposure to reputational and competitive harm, customer loss, and legal liabilities. The AI tools may also be subject to additional, and as yet unidentified, security threats.

Read in the 10-K filed Feb 25, 2025 ↗

In addition to the existing requirements under HIPAA, HHS issued an NPRM regarding revising the HIPAA Security Rule, which, if adopted, would impose increased requirements on regulated entities such as the Company. The Company has implemented policies and procedures designed to comply with the HIPAA privacy and security requirements as applicable. The privacy and security regulations establish a “floor” and do not supersede state laws that are more stringent. Therefore, the Company is required to comply with both additional federal privacy and security regulations and varying state privacy and security laws. To the extent applicable, newer laws like the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), the Washington My Health My Data Act, and similar consumer privacy laws in other states, may impose additional obligations on the Company. Federal and state laws that protect the privacy and security of patient information may be subject to enforcement and interpretations by various governmental authorities and courts, resulting in complex compliance issues. In addition, laws regulating artificial intelligence and machine learning, including the use of algorithms and automated processing, may impact the Company and lead to increases in the cost of compliance. Noncompliance with these laws could result in the imposition of fines, penalties, or orders to stop certain activities, and potentially expose the Company to actions for the wrongful use or disclosure of health information or other personal information.

Read in the 10-K filed Feb 25, 2025 ↗

successful. Our competitors may incorporate AI technologies into their products or services more quickly or more

Read in the 10-K filed Feb 14, 2025 ↗

Further, governments and courts are considering new issues in intellectual property law with respect to work created by artificial intelligence (“AI”) technology, which could result in different intellectual property rights in development processes, procedures and technologies we create with AI technology, which could have an adverse effect on our business.

Read in the 10-K filed Aug 19, 2025 ↗

significantly due to a significant portion of our workforce working in a hybrid environment. These threats also may be further enhanced in frequency or effectiveness through threat actors’ use of AI.

Read in the 10-K filed Feb 12, 2025 ↗

We must attract and retain qualified personnel to be successful, and competition for qualified personnel and available labor may intensify for a variety of reasons, including the increase in work-from-home arrangements, the wage inflation in our industry, and the demand for employees with expertise in developing fields such as AI.

Read in the 10-K filed May 23, 2025 ↗

maintaining, training, monitoring and enforcement of appropriate guidelines and procedures governing the use of AI tools, and the results of any such use, by us or our partners.

Read in the 10-K filed May 23, 2025 ↗

Governments and courts are considering new issues in intellectual property law with respect to works created by AI technology, which could result in changing and inconsistent intellectual property rights in development processes, procedures and technologies we create with AI technology, which could have a material adverse effect on our business.

Read in the 10-K filed May 23, 2025 ↗

The EU AI Act has introduced a risk-based framework for regulating AI systems which applies different obligations to various actors in the AI supply chain. These rules apply to, among others, product manufacturers incorporating AI systems into regulated products sold into the EU as well as to providers whose AI systems or their outputs are made available in the EU. This Act will increase costs to MA including cost of establishing processes and procedures around applicability and implementation of the Act’s requirements for MA products and services. MA also faces a risk of cost of penalties or fines due to noncompliance.

Read in the 10-K filed Feb 14, 2025 ↗

Furthermore, our information technology systems, and the systems of our customers, vendors, suppliers, and other third-party service providers, are subject to cyber-attacks or other security incidents including computer viruses or other malicious codes, phishing attacks, unauthorized access attempts, cyber extortion, business email compromise, deepfake or social engineering schemes, denial of service attacks, hacking, ransomware, or other cyberattacks attempting to exploit vulnerabilities. Cybercriminals have increasingly demonstrated advanced capabilities, such as use of zero-day vulnerabilities, and rapid integration of new technology such as generative artificial intelligence. Continued geographical turmoil, including the ongoing conflicts between Russia and Ukraine, the war in the Middle East, and rising tensions between China and Taiwan, has heightened the risk of cyberattack. Such incidents could result in unauthorized access to information including customer, consumer or other company

Read in the 10-K filed Jan 23, 2025 ↗

The Company or its third-party vendors may develop or incorporate artificial intelligence technology in certain business processes, services or products. The development and use of artificial intelligence may present risks to the Company’s business. Also, the rapidly evolving legal and regulatory environment relating to artificial intelligence, in the United States and internationally, could impact the Company’s implementation of artificial intelligence technology, and increase compliance costs and the risk of non-compliance. While the Company will seek to develop and use artificial intelligence responsibly, and will attempt to identify and mitigate ethical, privacy, legal or other issues presented by its use, there can be no assurance that the Company will be fully successful in doing so, and may be subject to data breaches, allegations of unauthorized access to, or use of, third party data, information, or intellectual property rights, or other risks, which may lead to financial losses, legal liability, regulatory scrutiny and reputational damage.

Read in the 10-K filed Feb 5, 2025 ↗

The development and use of GenAI and other AI technologies (collectively, AI Technologies), along with an uncertain regulatory landscape, pose risks that could harm our reputation, expose us to liability or otherwise adversely affect our business. The integration of AI Technologies into our and our vendors’ systems (potentially without the vendor disclosing such use to us) subjects us to the risk that the providers of AI Technologies may not meet existing or rapidly evolving regulatory or industry standards with respect to privacy and data protection. Further, bad actors around the world use increasingly sophisticated methods, including the use of AI technologies, to engage in illegal activities involving the theft and misuse of personal information, confidential information and intellectual property. These factors may lead to breaches of security or privacy, reduced levels of service or experience, loss of intellectual property or exposure of confidential or proprietary information. Sophisticated cyber-attacks, including those using AI, could exacerbate these risks. Additionally, GenAI’s potential for producing false or misleading outputs, reflecting biases or generating content that may not be subject to IP protection or that infringes proprietary rights of others, poses additional risks to our business. Regulatory changes or reinterpretations could introduce new compliance risks, including potential government enforcement actions or civil lawsuits. Our competitors’ faster or more effective adoption of AI could also disadvantage us.

Read in the 10-K filed Feb 21, 2025 ↗

partnerships with technology companies as part of our growth strategy, as well as investments in technology, including generative AI, and infrastructure to support our own systems.

Read in the 10-K filed Feb 10, 2025 ↗

Our focus on cloud-based and AI services presents execution and competitive risks. We are incurring significant costs to build and maintain infrastructure to support cloud-based and AI services, reducing operating margins. Whether we succeed in cloud-based and AI services depends on our execution in several areas, including:

Read in the 10-K filed Jul 30, 2025 ↗

Our AI systems offer users powerful tools and capabilities. However, there may be instances where these systems are used in ways that are unintended or inappropriate. In addition, some users may also engage in fraudulent or abusive activities through our cloud-based and AI services, such as unauthorized account access, payment fraud, or terms of service violations including cryptocurrency mining or launching cyberattacks. While we are committed to detecting and controlling such misuse of our cloud-based and AI services, our efforts may not be effective, and we may incur reputational damage or experience adverse impacts to our business and results of operations.

Read in the 10-K filed Jul 30, 2025 ↗

adopt similar or more restrictive legislation that may render the use of such technologies challenging. These restrictions may make it harder for us to conduct our business using AI, lead to regulatory fines or penalties, require us to change our product offerings or business practices, or prevent or limit our use of AI.

Read in the 10-K filed Feb 18, 2025 ↗

In June 2024, the U.S. Supreme Court overturned the Chevron doctrine, ending judicial deference to regulatory agencies. This shift could significantly impact environmental regulation, consumer protection, advertising, privacy, artificial intelligence, and other regulatory frameworks we must comply with. This may impact our ability to operate our business in the manner in which we are accustomed and could negatively impact how we market our offerings, and could increase our regulatory compliance expense, which could in turn have a material adverse effect on our business, financial conditions, and results of operations. Political policies in the U.S., China, the U.K., Canada, and Europe may affect global trade, domestic purchasing, or create uncertainty. In recent years, the U.S. government has taken a new approach to trade policy, renegotiating or potentially terminating agreements and imposing tariffs, particularly on

Read in the 10-K filed Feb 7, 2025 ↗

In our technology operations, we have invested substantial amounts in the development of system platforms, the rollout of our platforms and the adoption of new technologies, including cloud-based infrastructure and AI for certain of our offerings. Although investments are carefully planned, there can be no assurance that the demand for such platforms or technologies will justify the related investments. If we fail to generate adequate revenue from planned system platforms or the adoption of new technologies, or if we fail to do so within the envisioned timeframe, it could have an adverse effect on our results of operations and financial condition. In addition, clients may delay purchases in anticipation of new products or enhancements. We may allocate significant amounts of cash and other resources to product technologies or business models for which market demand is lower than anticipated. In addition, the introduction of new products by competitors, the emergence of new industry standards or the development of entirely new technologies to replace existing product offerings could render our existing or future products obsolete.

Read in the 10-K filed Feb 21, 2025 ↗

While we continue to employ and invest resources to monitor our systems and protect our infrastructure, these measures may prove insufficient due to the continuously evolving nature of threat activity. Any system issue, whether as a result of an intentional breach, collateral damage from a cybersecurity incident involving our supply chain vendors, a negligent or malicious act by an insider, or the use of AI by bad actors, including the use of such tools to engage in social engineering or similar activities, or due to a cybersecurity breach of a customer that results in a loss of our data or

Read in the 10-K filed Feb 21, 2025 ↗

Our AI initiatives under development and the use of AI in certain of our existing products may be unsuccessful and may give rise to various risks, which could adversely affect our business, reputation, or operating results.

Read in the 10-K filed Feb 21, 2025 ↗

We have made, and are continuing to make, significant investments in AI including generative AI, to, among other things, develop new products or features for our existing products, including our anti-financial crime, equity trading, investor relations, sustainability and investment analytics solutions, and to enhance and refine our internal business operations. As AI is a new and evolving technology in the early stages of commercial use, there are significant risks involved in the development and deployment of AI, and there can be no assurance that the use of AI will enhance our products or services or augment our business or operating results. Market acceptance of AI technologies is uncertain, and we may be unsuccessful in our product development efforts. Moreover, our AI-related product initiatives and offerings, or use in our internal business operations, may give rise to risks related to harmful content, accuracy, bias, discrimination, intellectual property infringement, the ability to obtain intellectual property protection, misappropriation or leakage of intellectual property, defamation, data privacy, and cybersecurity, among others. In addition, these risks include the possibility of the introduction of new or enhanced laws or regulations or novel enforcement of existing laws to uses of AI, for which compliance may be costly and burdensome or involve changes to our business practices or products, litigation or other legal liability, or additional oversight, audits or enforcement under existing laws or regulations. The use of AI may also give rise to ethical concerns or negative public perceptions, which may cause brand or reputational harm. Additionally, our competitors may be developing their own AI products and technologies, which may be superior in features or functionality, or cost, to our offerings. Any of these factors could adversely affect our business, reputation, or operating results.

Read in the 10-K filed Feb 21, 2025 ↗

Moreover, as we integrate AI into our operations, there may be increased cybersecurity and privacy risks, including the risk of unauthorized or misuse of AI tools, and threat actors may leverage AI to engage in automated, targeted and coordinated attacks against our systems.

Read in the 10-K filed Jul 17, 2025 ↗

The Company’s growing use of AI systems in its operations, services and products poses inherent risks, which may cause operational and reputational harm.

Read in the 10-K filed Feb 26, 2025 ↗

On January 15, 2025, the USG published the “AI Diffusion” IFR in the Federal Register. After a 120-day delayed compliance period, the IFR will, unless modified, impose a worldwide licensing requirement on all products classified under Export Control Classification Numbers, or ECCNs, 3A090.a, 4A090.a, or corresponding .z ECCNs, including all related software and technology. Any system that incorporates one or more of the covered integrated circuits, or ICs, (including but not limited to NVIDIA DGX, HGX, and MGX systems) will be covered by the new licensing requirement. The licensing requirement will include future NVIDIA ICs, boards, or systems classified with ECCN 3A090.a or 4A090.a, or corresponding .z ECCNs, achieving certain total processing performance and/or performance density.

Read in the 10-K filed Feb 26, 2025 ↗

The AI Diffusion IFR would divide the world into three tiers, relegating most countries to “Tier 2” status. The AI Diffusion IFR would confer special benefits on select “Universal Verified End Users”, or UVEU, and lesser benefits on “National Verified End Users”, or NVEU. The AI Diffusion IFR would have numerous effects that may negatively impact our long-term financial results and competitive position, including but not limited to the following.

Read in the 10-K filed Feb 26, 2025 ↗

The AI Diffusion IFR would reduce the market for U.S.-designed and manufactured computing products and services, by expressly limiting exports, reexports, and transfers of covered products to Tier 2 countries and companies in Tier 1 countries that are either headquartered in Tier 2, or have an ultimate parent headquartered in a Tier 2 country. These restrictions would apply to all covered products, including products sold years ago.

Read in the 10-K filed Feb 26, 2025 ↗

The AI Diffusion IFR would limit access to the market for IT services and computing infrastructure, by favoring a select number of government-approved firms that achieve UVEU status. UVEUs may choose to favor their own accelerators, platforms, and systems, rather than selecting products based on merit.

Read in the 10-K filed Feb 26, 2025 ↗

The AI Diffusion IFR would encourage our customers to invest in alternatives that are not affected by USG regulations, including foreign competition.

Read in the 10-K filed Feb 26, 2025 ↗

The AI Diffusion IFR would increase our and our customers’ costs of doing business, creating compliance challenges and risks, and impact our supply and distribution chains, which will be subject to new compliance burdens and related extraterritorial regulatory obligations.

Read in the 10-K filed Feb 26, 2025 ↗

The AI Diffusion IFR would expose U.S. providers and the U.S. industry to an enhanced risk of retaliation from other countries, in the form of tariffs, import/export controls, or other regulatory actions.

Read in the 10-K filed Feb 26, 2025 ↗

The AI Diffusion IFR’s licensing requirement could impact our ability to complete development of products in a timely manner, support existing customers using covered products, or supply customers with covered products outside the impacted regions, and may require us to transition certain operations out of one or more of the identified countries.

Read in the 10-K filed Feb 26, 2025 ↗

Following these 2022 export controls, we transitioned some operations, including certain testing, validation, and supply and distribution operations out of China and Hong Kong. Any future transitions could be costly and time consuming, and adversely affect our research and development and supply and distribution operations, as well as our revenue, during any such transition period. We expanded our Data Center product portfolio to offer new solutions, including those for which the USG does not require a license or advance notice before each shipment. To the extent that a customer requires products covered by the licensing requirements, we may seek a license for the customer. However, the licensing process is time-consuming. We have no assurance that the USG will grant such a license or that the USG will act on the license application in a timely manner or at all. Even if a license is approved, it may impose burdensome conditions that we or our customer or end users cannot or decide not to accept. The USG evaluates license requests in a closed process that does not have clear standards or an opportunity for review. For example, the Notified Advanced Computing, or “NAC,” process has not resulted in approvals for exports of products to customers in China. The license process for exports to D1 and D4 countries has been time-consuming and resulted in license conditions that are onerous, even for small-sized systems that are not able to train frontier AI models. The requirements have a disproportionate impact on NVIDIA and already have disadvantaged and may in the future disadvantage NVIDIA against certain of our competitors who sell products that are not subject to the new restrictions or may be able to acquire licenses for their products.

Read in the 10-K filed Feb 26, 2025 ↗

Given the increasing strategic importance of AI and rising geopolitical tensions, the USG has changed and may again change the export control rules at any time and further subject a wider range of our products to export restrictions and licensing requirements, negatively impacting our business and financial results. In the event of such change, we may be unable to sell our inventory of such products and may be unable to develop replacement products not subject to the licensing requirements, effectively excluding us from all or part of the China market, as well as other impacted markets, including the Middle East and countries designated “Tier 2” by the AI Diffusion IFR. For example, the USG has already imposed conditions to limit the ability of foreign firms to create and offer as a service large-scale GPU clusters, for example by imposing license conditions on the use of products to be exported to certain countries, and may impose additional conditions such as requiring chip tracking and throttling mechanisms that could disable or impair GPUs if certain events, including unauthorized system configuration, use, or location, are detected. The USG has already imposed export controls restricting certain gaming GPUs, and if the USG expands such controls to restrict additional gaming products, it may disrupt a significant portion of our supply and distribution chain and negatively impact sales of such products to markets outside China, including the U.S. and Europe. In addition, as the performance of the gaming GPUs increases over time, export controls may have a greater impact on our ability to compete in markets subject to those controls. Export controls may disrupt our supply and distribution chain for a substantial portion of our products, which are warehoused in and distributed from Hong Kong. Export controls restricting our ability to sell data center GPUs may also negatively impact demand for our networking products used in servers containing our GPUs. The USG may also impose export controls on our networking products, such as high-speed network interconnects, to limit the ability of downstream parties to create large clusters for frontier model training. Any new control that impacts a wider range of our products would likely have a disproportionate impact on NVIDIA and may disadvantage us against certain of our competitors that sell chips that are outside the scope of such control. Excessive or shifting export controls have already and may in the future encourage customers outside China and other impacted regions to “design-out” certain U.S. semiconductors from their products to reduce the compliance burden and risk, and to ensure that they are able to serve markets worldwide. Excessive or shifting export controls have already encouraged and may in the future encourage overseas governments to request that our customers purchase from our competitors rather than NVIDIA or other U.S. firms, harming our business, market position, and financial results. As a result, excessive or shifting export controls may negatively impact demand for our products and services not only in China, but also in other markets, such as Europe, Latin America, and Southeast Asia. Excessive or shifting export controls increase the risk of investing in U.S. advanced semiconductor products, because by the time a new product is ready for market, it may be subject to new unilateral export controls restricting its sale. At the same time, such controls may increase investment in foreign competitors, which would be less likely to be restricted by U.S. controls. If additional products are subject to worldwide licensing requirements, we may incur significant inventory provisions and excess purchase obligation charges.

Read in the 10-K filed Feb 26, 2025 ↗

scale, financial leverage and/or access to content, data, information, technology (including AI) and other offerings. If the Company is unable to compete successfully, its business, results of operations and financial condition could be adversely affected.

Read in the 10-K filed Aug 6, 2025 ↗

In addition, to streamline our operations and for efficiency purposes, we are pursuing a number of actions, including the outsourcing of certain internal business processes and the deployment of enhanced end-to-end digital processes (which, in some cases, include the use of AI) for certain business use cases. Such opportunities for improvement and enhanced productivity bring risks associated with managing change, transition costs, and the potential for reduced productivity or user error, in addition to those risks specific to each new process.

Read in the 10-K filed Feb 10, 2025 ↗

In addition, Occidental has exposure to cybersecurity risks where its data and proprietary information are collected, hosted, and/or processed by third-party cloud and service providers. Occidental’s risks may be exacerbated by a delay or failure to detect a cybersecurity incident or understand the full extent of such incident notwithstanding its risk management processes and controls. Occidental faces risks associated with new and ever-increasing phishing technologies and hidden malware as well as risks associated with electronic data proliferation and technology digitization. Occidental also faces increased risk with the growing sophistication of generative artificial intelligence capabilities, which may improve or expand the existing capabilities of cybercriminals described above in a manner Occidental cannot predict at this time.

Read in the 10-K filed Feb 18, 2025 ↗

Longer term, APS has been preparing for and can serve significant load growth from residential and business customers. On top of these existing growth trends, APS is also now receiving unprecedented incremental requests for service from extra-large commercial energy users (over 25 MW) with very high energy demands that persist virtually around-the-clock. These incremental requests for service by extra-large energy users far exceed available generation and transmission resource capacity in the Southwest region for the foreseeable future. APS is exploring available options for securing sufficient electric generation and transmission to meet these projections of future customer needs; however, there are difficulties in properly forecasting the demands of these extra-large customers due to factors such as the nascent nature of the industries (e.g., artificial intelligence) that these customers are supporting and the multiple variables that impact their usage ramp-up and ultimate level of demand. As data center and other extra-large customer opportunities evolve and develop, we may also enter into arrangements with customers and potential customers that require us to invest capital and assume credit risk related to such developments and the related generation and transmission investments before we receive any potential return. APS is implementing strategies to attempt to reduce this risk; however, the difficulty in forecasting these demands and the additional risk of these arrangements could lead to stranded costs and other effects that could have material adverse impacts on APS’s financial condition, results of operations, and cash flows.

Read in the 10-K filed Feb 25, 2025 ↗

The rapidly-changing technical and regulatory environment and our AI-related activities may have an adverse effect on our business.

Read in the 10-K filed Feb 21, 2025 ↗

AI technologies are still in their early stages of development and deployment. Ineffective or inadequate AI development or deployment practices by PPL, its subsidiaries or third-party vendors could result in unintended consequences. While we seek contractual protections with our third-party vendors regarding the use of AI technology, we may not have full awareness of, or control or visibility over, the quality, performance, security or compliance of the products and services that incorporate AI-related technology used by such vendors. AI algorithms that we or our third-party vendors use may be flawed or may be based on datasets that are biased or insufficient. These limitations or failures, or inaccurate results generated as a result of our employees’, contractors’ or vendors’ use or misuse of AI technologies could lead to operational interruptions or otherwise adversely affect our business, reputation or financial results. Developing, testing, and deploying resource-intensive AI systems may require additional investment and increase our costs. In addition, the rapidly evolving nature of AI technologies may cause new laws and regulations to be enacted which could dramatically affect business practices, including the costs to comply with such new laws and regulations. We cannot predict the future development of AI technologies and the nature of any related new laws and regulations, and their costs and consequences.

Read in the 10-K filed Feb 13, 2025 ↗

such as processing hardware and network capacity, as to which we cannot control the availability or pricing, especially in a highly competitive environment. Our competitors may also adopt AI or Generative AI more quickly or more effectively than we do, which could cause competitive harm. Because the Generative AI technology is so new, some of the potential risks of Generative AI are currently unknowable; however, specific risks relating to AI and Generative AI could include, among others:

Read in the 10-K filed Feb 13, 2025 ↗

While we have been expanding the use of machine learning across the platform, we have also been exploring the use of generative AI within our platform, as well as the use and licensing of Reddit content for generative AI purposes. For example, we are experimenting with using generative AI to scale our content translation efforts as we grow our presence in international markets, to assist Redditors to find more relevant content and to create post and comment suggestions that abide by community rules. We are also experimenting with using generative AI to assist advertisers to create ads, improve the placement of

Read in the 10-K filed Feb 13, 2025 ↗

We face potential risks and challenges in evaluating and leveraging our remaining power capacity for AI/HPC uses.

Read in the 10-K filed Feb 28, 2025 ↗

The demand for power in emerging and evolving industries, such as AI and HPC, has increased. We believe that by maintaining a clear and transparent focus on both our Bitcoin Mining activities and evaluating expansion into emerging, high-demand markets, we can deliver long-term value for our stockholders. In January 2025, we launched a formal process to evaluate the feasibility of developing the approximately 600 MW of remaining power capacity at the Corsicana Facility for artificial intelligence AI/HPC uses. As we evaluate the potential uses for our remaining power capacity at the Corsicana Facility, and determine if a pivot to AI/HPC is appropriate, we could face reputational harm, liability and adverse financial results making our evaluation of our business and future prospects uncertain. Deviating from Bitcoin Mining focus may harm our reputation with a variety of stakeholders, including investors, stockholders, employees, and the broader crypto industry. If we are unable to maintain, or strengthen, our reputation and brand recognition and are not able to timely and appropriately adapt to changes in our business environment, our business and the

Read in the 10-K filed Feb 28, 2025 ↗

loyalty, and a reputation for quality, including through digital brand engagement and online and social media presence; (iii) developing and producing innovative, high-quality products in sizes, colors, and styles that appeal to consumers of varying demographics; (iv) competitively pricing our products and creating a compelling value proposition for consumers; (v) providing strong and effective marketing support in several diverse demographic markets, including through digital and social media platforms in order to stay better connected to consumers; (vi) establishing relationships with athletes, musicians, influencers, and other celebrities to promote our brands and products; (vii) providing attractive, reliable, secure, and user-friendly digital commerce sites; (viii) adapting to changes in technology, including the successful utilization of data analytics, artificial intelligence, and machine learning; (ix) obtaining sufficient and desirable retail floor space and effective presentation of our products at stores and shop-within-shops; (x) attracting consumer traffic to stores, shop-within-shops, and digital commerce sites; (xi) sourcing sustainable and traceable raw materials at cost-effective prices; (xii) anticipating and maintaining proper inventory levels; (xiii) ensuring product availability and optimizing supply chain and distribution efficiencies with third-party manufacturers and retailers; (xiv) maintaining and growing market share; (xv) recruiting and retaining talent to operate our retail stores, distribution centers, and various corporate functions; (xvi) protecting our intellectual property; and (xvii) ability to withstand prolonged periods of adverse economic conditions or business disruptions.

Read in the 10-K filed May 22, 2025 ↗

We may be affected by laws and regulations that govern the use of AI. For example, the EU AI Act places new requirements on providers of AI technologies that will need to be addressed in alignment with various deadlines in the coming years. These and other laws or regulations may cause us to modify our data handling and compliance practices, which could be costly or disruptive to our operations, and may also impact our ability to use certain data to support our products or our product development efforts or hinder our customers’ ability to adopt or continue to use our products.

Read in the 10-K filed Feb 24, 2025 ↗

Erosion of trust in our brand value can be caused by isolated or recurring incidents originating both from us or our business partners, or from external events. Such incidents can potentially trigger boycotts of our stores or result in civil or criminal liability, which can have a negative impact on our financial results. Incidents that can erode trust in our brand value include actual or perceived breaches of privacy or violations of domestic or international privacy laws, contaminated food, product recalls, store employees or other food handlers infected with communicable diseases, safety-related incidents, or other potential incidents discussed in this risk factors section. The impact of such incidents may be exacerbated if they receive considerable publicity, including rapidly through social or digital media (including for malicious reasons), or if they result in litigation. Negative postings or comments on social media or networking websites about Starbucks, even if inaccurate or malicious, have in the past, and could in the future, generate negative publicity about Starbucks across media channels that could damage the value of our brand. It may be difficult to address such negative publicity, including as a result of fictitious media content (such as content produced by generative artificial intelligence or bad actors) across media channels. Additionally, consumer demand for our products and our brand value could diminish significantly if we, our employees, licensees, or other business partners fail to preserve the quality of our products, act or are perceived to act in an unethical, illegal, racially-biased, unequal, inequitable, or socially irresponsible manner, including with respect to the sourcing, content, or sale of our products, service and treatment of customers at Starbucks stores, treatment of employees, including our responses to unionization efforts, or the use of customer data for general or direct marketing or other purposes. Allegations, even if untrue, that we are not respecting internationally recognized human rights, are failing to comply with applicable workplace and labor laws, or are aligned with positions on social or geopolitical issues could also negatively impact our brand value. Additionally, if we fail to comply with laws and regulations, take controversial positions or actions, fail to deliver a consistently positive consumer experience in each of our markets, including by failing to invest in the right balance of wages and benefits to attract and retain employees who represent the brand well, or fail to foster an inclusive and diverse environment, our brand value may be diminished. In addition, we cannot ensure that our store partners, licensees, or other business partners will not take actions that adversely affect the value and relevance of our brand.

Read in the 10-K filed Nov 20, 2024 ↗

some of this data, including on personally-owned digital devices. To the extent we, a third party, or such an individual were to experience a breach of our or their information technology systems that results in the unauthorized access, theft, use, destruction or other compromises of customers’ or employees’ data or confidential information of the Company stored in or transmitted through such systems, including through cyber-attacks or other external or internal methods, it could result in a material loss of revenues from the potential adverse impact to our reputation and brand, a decrease in our ability to retain customers or attract new ones, the imposition of potentially significant costs (including loss of data or payment for recovery of data) and liabilities, loss of business, loss of business partners and licensees, and the disruption to our supply chain, business, and plans. Unauthorized access, theft, use, destruction, or other compromises are becoming increasingly sophisticated and may occur through a variety of methods, including attacks using malicious code, vulnerabilities in software, hardware, or other infrastructure (including systems used by our supply chain), system misconfigurations, phishing, deepfakes, ransomware, malware, or social engineering. The rapid evolution and increased adoption of artificial intelligence technologies may intensify our cybersecurity risks. Our logging capabilities, or the logging capabilities of third parties, are not always complete or sufficiently granular, affecting our ability to fully understand the scope of security breaches.

Read in the 10-K filed Nov 20, 2024 ↗

Media or other reports of existing or perceived security vulnerabilities in our systems, or those of our third-party business partners or service providers, can also adversely impact our brand and reputation and materially impact our business. Additionally, the techniques and sophistication used to conduct cyber-attacks and compromise information technology systems, as well as the sources and targets of these attacks, change frequently and are often not recognized until such attacks are launched or have been in place for a period of time. The rapid evolution and increased adoption of artificial intelligence technologies by attackers amplifies these concerns. We continue to make significant investments in technology, third-party services, and personnel to develop and implement systems and processes that are designed to anticipate cyber-attacks and to prevent or minimize breaches of our information technology systems or data loss, but these security measures cannot provide assurance that we will be successful in preventing such breaches or data loss.

Read in the 10-K filed Nov 20, 2024 ↗

We rely heavily on information technology systems across our operations for numerous purposes, including for administrative functions, point-of-sale processing and payment in our stores and online, management of our supply chain, Starbucks Cards, online business, delivery services, mobile technology (including mobile payments and ordering apps), reloads and loyalty functionality, and various other processes and transactions (including providing Starbucks Digital Solutions to participating licensees), and many of these systems are interdependent on one another for their functionality. Many of our non-store employees continue to work on a remote or hybrid basis, which has resulted in increased demand on our information technology infrastructure. Additionally, the success of several of our initiatives to drive growth, including our ability to increase digital relationships with our customers to drive incremental traffic and spend, is highly dependent on our technology systems. Furthermore, we continue to expand convenience-led formats, which depend heavily on our mobile ordering capabilities. Any failure, inadequacy, or interruption of these systems could harm our ability to effectively operate and grow our business and could adversely affect our financial results. In addition, the technologies and artificial intelligence tools we are incorporating into certain aspects of our operations may not generate the intended efficiencies and may impact our business results.

Read in the 10-K filed Nov 20, 2024 ↗

Despite the measures we and our vendors put in place designed to protect our computer equipment, data and systems, our customers, suppliers, employees or other third parties have been and may continue to be vulnerable to phishing and other forms of social engineering attacks, employee or contractor error, hacking, cyberattacks, ransomware and other malware, malfeasance, system error or other irregularities or incidents, including from attacks or breaches and incidents at third party vendors we utilize. In addition, the measures we and our vendors take may not be sufficient for all eventualities. Threat actors are increasingly using tools and techniques that circumvent controls, evade detection, and remove forensic evidence, which means that we and others may be unable to anticipate, detect, deflect, contain or recover from cyberattacks in a timely or effective manner. As AI capabilities improve and are increasingly adopted, we may be subject to cyberattacks created and/or augmented with AI. For example, attacks could be crafted with an AI tool to attack information systems by creating more effective phishing emails or social engineering or by exploiting vulnerabilities in electronic security programs utilizing false image or voice recognition, or could result from us or our customers, vendors or business partners incorporating the output of AI tools, such as malicious code from an AI-generated source code. Our network and storage applications, as well as those of our customers, business partners, and third-party providers, have been and may in the future be subject to unauthorized access by hackers or breached due to operator error, malfeasance or other system disruptions. Additionally, there have been and may continue to be significant supply chain attacks, and we cannot guarantee that our or our suppliers’ or other vendors’ systems, networks, or other components or infrastructure have not been compromised or do not contain exploitable defects, bugs or vulnerabilities. We anticipate that these threats will continue to grow in scope and complexity over time due to the development and deployment of increasingly advanced tools and techniques.

Read in the 10-K filed Aug 1, 2025 ↗

The swift pace of technological change has led to a nonuniform and complex set of cybersecurity and data privacy laws, regulations, and standards. Meanwhile, the recent proliferation and rapid evolution of AI

Read in the 10-K filed Apr 23, 2025 ↗

We operate in a highly competitive industry in which competition and the regulatory burden in the development and improvement of new and existing products is significant: The markets in which we compete are highly competitive, and a significant element of our strategy is to increase revenue growth by focusing on innovation, new product development and improvement of existing products. New business models, products and surgical procedures, as well as improvements to existing products, are introduced on an ongoing basis and our present or future products could be rendered obsolete or uneconomical by internal or external technological advances, including by our existing competitors and new market entrants, which could adversely impact demand for certain of our existing products. The success of our products and services depends on, among other things, our ability to properly identify customer needs and predict future needs; innovate and develop new technologies, services and applications at an accelerated pace; and appropriately allocate our research and development spending to products and services with higher growth. Our existing competitors and new market entrants may respond more quickly to or integrate new or emerging technologies such as robotics, artificial intelligence and machine learning in their product offerings, undertake more extensive marketing campaigns, have greater access to clinical information to support ongoing product position in the market, have greater financial, marketing and other resources or be more successful in attracting potential customers, employees and strategic partners. There can be no assurance that any products now in development, or that we may seek to develop in the future, will achieve technological feasibility, obtain regulatory approval or gain market acceptance. If we are unable to develop and launch new products, our ability to maintain or expand our market position in the markets in which we participate may be negatively impacted.

Read in the 10-K filed Feb 12, 2025 ↗

We, our business partners or our third-party vendors could experience a material failure or breach of a key information technology system, network, process or site: We rely extensively on information technology (IT) systems to conduct business. In addition, we rely on networks and services, including internet sites, cloud and software-as-a-service solutions, data hosting and processing facilities and tools and other hardware, software (including open-source software) and technical applications and platforms, some of which are managed, hosted, provided and/or used by third parties or their vendors, to assist in conducting our business. Furthermore, numerous and evolving cybersecurity threats have posed, and will continue to pose, risks to the security of our IT systems, networks and product offerings, as well as the confidentiality, availability and integrity of our data. Emerging technologies such as generative artificial intelligence (AI) may be used by malicious actors to create more targeted

Read in the 10-K filed Feb 12, 2025 ↗

phishing narratives, spread disinformation about us or our products or otherwise strengthen social engineering capabilities. Some of our products, services, and information technology systems contain or use open-source software which poses particular risks, including potential security vulnerabilities, licensing compliance issues and quality issues. We, our customers and third-party hosting services have experienced, and expect to continue to experience, security breaches of, unauthorized access to, and disruptions of, products or systems. While such breaches, unauthorized access and disruptions have not had a material effect on us to date, we cannot guarantee that any future breach or unauthorized access will not be material and any breach or unauthorized access could impact the use of such products and systems and the security of information stored therein. Although we have made investments and expect to continue to make investments seeking to address these threats, including monitoring of networks and systems, use of artificial intelligence, hiring of experts, employee training and security policies for employees and third-party providers, the techniques used in these attacks change frequently and may be difficult to detect for periods of time and we may face difficulties in anticipating and implementing adequate preventative measures.

Read in the 10-K filed Feb 12, 2025 ↗

Our use of AI and other emerging technologies could adversely impact our business and financial results: We have begun to deploy AI and other emerging technologies in various facets of our operations and we continue to explore further use cases. The rapid advancement of these technologies presents opportunities for us in research, manufacturing, commercialization, and other business endeavors, but also entails risks, including that AI-generated content, analyses, or recommendations we utilize could be deficient, that our competitors may more quickly or effectively adopt AI capabilities, or that our use of AI or other emerging technologies increases regulatory, cybersecurity and other significant risks. In addition, any disruption or failure in the AI functionality we incorporate into our business activities, products or services could adversely impact our business or result in delays or errors in our product offerings. The legal and regulatory landscape surrounding AI technologies is rapidly evolving and uncertain, including in the areas of intellectual property, cybersecurity and privacy and data protection. Compliance with new or changing laws, regulations or industry standards relating to AI may impose significant costs on us and limit our ability to effectively develop, deploy or use AI technologies. Furthermore, if we are unable to effectively manage the use of AI technologies by our employees and service providers, our confidential information, intellectual property and reputation could be put at risk. Failure to appropriately respond to this evolving landscape may result in reputational, competitive and business harm as well as litigation and regulatory action and fines, penalties and expenses related thereto.

Read in the 10-K filed Feb 12, 2025 ↗

types, including phishing and other attempts to breach or gain unauthorized access to our systems. As artificial intelligence becomes increasingly integrated into business systems, concerns about data exposure and privacy risks are intensifying. Additionally, artificial intelligence is being used to carry out advanced social engineering attacks, increasing potential for harm. To date, these attacks have not had a material impact on our operations, but we cannot provide assurance that cyber-attacks will not have a material impact in the future.

Read in the 10-K filed Aug 14, 2025 ↗

We depend upon our employees and contractors to appropriately handle confidential and sensitive data, including customer data, and to deploy our IT resources in a safe and secure manner that does not expose our network systems to security breaches or incidents or the loss, alteration, unavailability, or other unauthorized processing of data. We have been and expect to be subject to cybersecurity threats and incidents, including denial-of-service attacks, employee errors or individual attempts to gain unauthorized access to information systems. We also continue to incorporate AI solutions and features into our platform, which may result in security incidents or otherwise increase cybersecurity risks. Further, AI technologies may be used in connection with certain cybersecurity attacks, resulting in heightened risks of security breaches and incidents. Any security incidents, including internal malfeasance or inadvertent disclosures by our employees or a third-party’s fraudulent inducement of our employees to disclose information, unauthorized access or usage, the introduction of viruses or other malicious code or any other breach or incident or disruption of our platform, systems, or networks or those of our service providers, could result in loss, corruption, unavailability, or other unauthorized processing of confidential information, and any such event, or the perception that it has occurred, may result in damage to our reputation, erosion of customer trust, loss of customers, litigation, regulatory investigations, fines, penalties and other liabilities. For example, in June and August 2022, we became aware that threat actors had conducted sophisticated social engineering campaigns against some of our employees after having obtained employee names and mobile phone numbers from unknown sources. The attack identified in August 2022, which involved smishing text messages that purported to be from our IT department, resulted in the threat actor obtaining some of our employees’ credentials and access to certain data of approximately 209 customers out of our total customer base of approximately 270,000 at that time. We notified and worked with our affected customers. We also notified appropriate regulators and addressed their questions about the incident. We also took steps to remediate the incident, including enhancing our security training, improving our two factor authentication requirements, implementing additional layers of control within our VPN, reducing access to certain internal applications and tools, running simulated phishing attempts to increase employee security awareness, and increasing the refresh frequency for access to certain internal applications. Industry reports indicate that the threat actors also attacked other technology, telecommunication and cryptocurrency companies.

Read in the 10-K filed Feb 26, 2025 ↗

Outside the United States, an increasing number of laws, regulations, and industry standards apply to privacy, data protection and cybersecurity. For example, the GDPR, the United Kingdom’s General Data Protection Regulation and Data Protection Act 2018 (“UK GDPR”) and the Swiss Federal Act on Data Protection, impose strict requirements for processing the personal information of individuals protected by the legislation, whether their data is processed within or outside the European Economic Area (“EEA”), the United Kingdom (“UK”) and Switzerland, respectively (such jurisdictions, collectively, “Europe”). For example, the GDPR imposes significant requirements regarding the processing of individuals’ personal information, including in relation to transparency, lawfulness of processing, individuals’ privacy rights, compliant contracting, data minimization, data breach notification, data re-usage, data retention, security of processing and international data transfers. Under the GDPR and UK GDPR, government regulators may impose temporary or definitive bans on data processing or data transfers, require a company to delete data, as well as impose significant fines, potentially ranging up to 20 million Euros under the GDPR, 17.5 million GBP under the UK GDPR, or 4% of a company’s worldwide revenue, whichever is higher. Further, individuals may initiate compensation claims or litigation related to our processing of their personal information. Other privacy and data protection laws in Europe impose strict requirements around marketing communications and the deployment of cookies on users’ devices. As another example, Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados Pessoais, or “LGPD”) (Law No. 13,709/2018) may apply to our operations. The LGPD broadly regulates processing of personal information of individuals in Brazil and imposes compliance obligations and penalties comparable to those of the GDPR. Additionally, we expect an increase in the regulation of the use of AI and ML in products and services. For example, in Europe, the Artificial Intelligence Act (“AI Act”), once effective, will impose onerous obligations related to the development, placing on the market and use of AI-related systems. In the United States, numerous states have established study commissions that could lead to regulation of AI, and certain states have enacted legislation regulating aspects of AI. Other countries also are contemplating laws regulating AI and ML. We may have to change our business practices to comply with obligations under these or other new and evolving regimes.

Read in the 10-K filed Feb 26, 2025 ↗

Evolving laws, regulations, and other actual and asserted obligations relating to privacy, data protection, and cybersecurity, as well as any new or evolving obligations relating to the use of AI and ML technologies, could reduce demand for our platform, increase our costs, impair our ability to grow our business, or restrict our ability to store and process data or, in some cases, impact our ability to offer our service in some locations and may subject us to liability. Further, in view of new or modified federal, state or foreign laws and regulations, industry standards, contractual obligations and other actual and asserted obligations, or any changes in their interpretation, we may find it necessary or desirable to fundamentally change our business activities and practices or to expend significant resources to modify our practices and platform and otherwise adapt to these changes. We may be unable to make such changes and modifications in a commercially reasonable manner or at all, and our ability to develop new products and features could be limited.

Read in the 10-K filed Feb 26, 2025 ↗

Automated systems and technologies, including AI, may become increasingly important in our operations over time. The Company may face challenges in implementing, integrating and modifying the automated systems and technologies required to

Read in the 10-K filed Feb 27, 2025 ↗

Our business relies on the processing of data across national borders. Legislators and regulators around the world are increasingly adopting or revising privacy, data protection, data management, data transfer, AI and cybersecurity laws and regulations. For example, our ongoing efforts to comply with complex U.S. and international privacy and data protection laws may increase the complexity of our compliance operations, entail substantial expenses, divert resources from other initiatives and projects, require us to modify our data processing practices, policies or services, and adversely impact our business. In addition, privacy laws in numerous jurisdictions, including but not limited to the U.S., China, India, Australia, New Zealand, Brazil, Kingdom of Saudi Arabia, Hong Kong and Japan, have established specific legal requirements for cross-border transfers of personal information and substantial compliance and audit obligations. Certain countries have also established specific legal requirements for data localization, such as where personal data must remain stored in the country. The global proliferation of new privacy and data protection laws may lead to inconsistent and conflicting requirements or legal interpretations, which create an uncertain regulatory environment. Noncompliance could also result in regulatory penalties and significant legal liability. Enforcement actions and investigations by regulatory authorities into companies related to data security incidents and privacy violations are generally increasing. In Europe, data protection authorities continue to apply and enforce the General Data Protection Regulation (GDPR), imposing record setting fines. As we develop integrated and personalized products and services and acquire new companies to meet the needs of a changing marketplace, we may expand our data profile through additional data types and sources, across multiple channels, and involving new partners. This potential expansion could amplify the impact of these various laws and regulations on our business. As a result, we are required to constantly monitor our privacy, data and cybersecurity practices and potentially change them when necessary or appropriate. We also may need to provide increased care in our data management, governance and quality practices, particularly as it relates to the use of data in products leveraging AI.

Read in the 10-K filed Nov 6, 2025 ↗

We are also subject to a variety of laws and regulations governing the development, use and deployment of AI technologies. These laws and regulations are increasingly complex, fragmented and still evolving, and there is no single global regulatory framework for AI. Our development, deployment and use of AI and machine learning is subject to various risks at each stage of use. In the context of AI development, risks include those related to intellectual property considerations, the collection and use of personal data, third party risks, technical limitations of algorithms and the accuracy of training data, and compliance with emerging AI legal standards. The increased risk of inadvertent disclosure of confidential information or personal data in connection with the utilization of AI technologies may result in stronger regulatory scrutiny, leading to legal and regulatory investigations and

Read in the 10-K filed Nov 6, 2025 ↗

enforcement actions that may negatively affect our business, even if unfounded. In the context of use and deployment, risks include technical, operational and compliance considerations, and our ability to monitor and safely deploy AI systems throughout the organization with appropriate safeguards and in compliance with the various regulatory schemes related to AI technology.

Read in the 10-K filed Nov 6, 2025 ↗

In particular, the adoption of agentic commerce, in which autonomous AI agents initiate and execute transactions on behalf of users, presents novel and complex regulatory, privacy and cybersecurity risks. Legal frameworks governing such autonomous agents remain nascent, with limited direct guidance specific to payments. The interplay between payments regulations, data privacy laws and evolving AI regulations may create uncertainty around compliance obligations and potential liability exposure as more participants (including sellers, fintechs, AI developers and enablers) enter the agentic commerce ecosystem. The market is still assessing how regulators may apply existing consumer protection and other laws in the context of AI. For example, as agentic commerce solutions scale, we may see increased instances of erroneous or disputed payments, increased chargebacks and reputational harm. Furthermore, reliance on agentic AI introduces challenges in monitoring cross-border, prohibited or high-risk transactions, where conflicting regulatory requirements may apply. The fragmented regulatory landscape for emerging technologies such as AI and inconsistent requirements across legal frameworks may amplify difficulties in identifying, preventing or mitigating risk with a single global approach, potentially increasing our compliance costs or stratifying our ability to leverage certain data or technologies for innovation. For instance, the EU has adopted a comprehensive AI Act that establishes harmonized rules across Europe, with key provisions for high-risk AI systems taking effect in August 2026. Meanwhile, several U.S. states, including California, Colorado and Utah, have adopted AI-specific frameworks or are considering applying existing consumer and data protection laws to regulate AI. Depending on how these different regulations are interpreted and enforced, they may limit the ability to develop and deploy AI systems or significantly increase associated compliance costs. Our development and implementation of governance frameworks aimed at complying with emerging laws and regulations applicable to our AI and machine learning systems may not be successful in mitigating all of these emerging risks.

Read in the 10-K filed Nov 6, 2025 ↗

Our competitors may acquire, develop or make better use of substantially better technology, have more widely adopted delivery channels, or have greater financial resources. They may offer more effective, innovative or a wider range of programs, products and services. They may use more effective advertising and marketing strategies that result in broader brand recognition and greater use, including with respect to issuance and seller acceptance. They may also develop better solutions or offer more favorable pricing. Moreover, even if we successfully adapt to technological change and the proliferation of alternative types of payment services by developing and offering our own services in these areas, such services may provide less favorable financial terms for us, which could hurt our financial results. We expect to face more competition as AI continues to advance and GenAI and agentic AI capabilities become integrated into payments and related services in two main ways: first, by competitors successfully enhancing their products, services and external offerings with AI to achieve greater and faster product adoption; and second, by competitors providing internal AI tools to upskill their employees for greater operational efficiencies and impact. In addition, our competitors may have, or in the future may obtain, proprietary rights that would prevent, limit or interfere with our ability to design, use or sell our own AI-based offerings or services to our clients and other third parties. If we do not continue to invest in developing and supporting our AI-based initiatives, we may fall behind technological developments and evolving industry standards, which would likewise harm our reputation and ability to effectively compete, retain clients or grow our business.

Read in the 10-K filed Nov 6, 2025 ↗

The use of social media platforms and artificial intelligence tools presents risks and challenges.

Read in the 10-K filed Feb 13, 2025 ↗

Social media is being used by third parties to communicate about our products and product candidates and the diseases our therapies are designed to treat. We believe that members of the communities supporting serious diseases may be more active on social media as compared to other patient populations due to the demographics of those patient populations. Social media practices in the pharmaceutical and biotechnology industries are evolving, which creates uncertainty and risk of noncompliance with regulations applicable to our business. For example, patients may use social media platforms to comment on the effectiveness of, or adverse experiences with, a product or a product candidate, which could result in reporting obligations. In addition, our employees may engage on social media in ways that may not comply with legal or regulatory requirements, which may give rise to liability, lead to the loss of trade secrets and other intellectual property, or result in public disclosure of protected personal information. There is a risk of inappropriate disclosure of sensitive information or negative or inaccurate posts or comments about us on any social networking website. Negative sentiment about us or our business shared over social media, or misinformation disseminated from fraudulent accounts impersonating our employees or our business, or otherwise, could harm our business and reputation, whether or not it is based in fact. Certain data protection regulations, such as the GDPR, apply to personal data contained on social media. If any of these events were to occur or we otherwise fail to comply with applicable regulations, we could incur liability, face regulatory actions or incur harm to our business, including damage to our reputation. Similar risks relating to inappropriate disclosure of sensitive information or inaccurate information appearing in the public domain may also apply from our employees engaging with and use of new artificial intelligence tools, such as ChatGPT.

Read in the 10-K filed Feb 13, 2025 ↗

Generative Artificial Intelligence, such as large language models like ChatGPT, present a range of challenges and potential risks as we consider impacts to the business. These challenges involve navigating the complexities of creating and deploying AI models that generate content autonomously. Data privacy, legal concerns, and security issues are all risks as this technology continues to be adopted.

Read in the 10-K filed Feb 27, 2025 ↗

Moreover, technology and consumer offerings continue to develop and evolve and we cannot predict consumer or team member acceptance of these existing and new technologies (e.g. automation, AI, new delivery channels) or their impact on our business, and/or our growth prospects, nor can we be certain of our ability to implement or execute such technologies, which could result in loss of sales; dissatisfaction from our customers, employees, or employees of our Concepts’ franchisees; or negative publicity that could adversely impact our reputation or financial results.

Read in the 10-K filed Feb 19, 2025 ↗

• Laws relating to information and data security, privacy, cashless payments, consumer protection, and the use of AI and other emerging technologies.

Read in the 10-K filed Feb 19, 2025 ↗