Privacy and data rules

Our business involves the collection, use, sharing and retention of personal information (including payment card information and protected health information) and confidential business information. We share personal and confidential information with suppliers and other third parties and use third-party technology and systems that process and transmit information for a variety of activities.

Read in the 10-K filed Mar 18, 2026 ↗

Additionally, newly applicable and potential new or significantly revised state, provincial and federal laws and regulations in the jurisdictions in which we do business are expanding (and may further expand) our obligations to protect and honor the privacy and security of personal information, imposing new restrictions on the collection, use, sharing and retention of data and requiring additional implementation resources, all of which create incremental risk arising from a potential breach or compliance failure. The proliferation of new and updated privacy laws and regulations, including the rise of extreme data minimization legislation, has the potential to limit our ability to collect, use or share personal information and thus hinder our strategic and marketing efforts (e.g., Best Buy Ads and Best Buy’s own efforts to communicate with consumers). We could be subject to heightened regulatory investigations, penalties and fines if a cybersecurity event or privacy violation is related to data or sensitive personal information that is regulated by laws such as, for example, the Health Insurance Portability and Accountability Act (HIPAA), the Personal Information Protection and Electronic Documents Act (PIPEDA), or the California Consumer Privacy Act (CCPA).

Read in the 10-K filed Mar 18, 2026 ↗

risks, including from confidentiality, privacy, data protection, cybersecurity and compliance perspectives, and raises intellectual property issues and legal, regulatory, reputational ethical, operational, technological and other concerns (see, “Our operations are dependent in part on patents and other intellectual property assets” and “Cybersecurity incidents and breaches or breakdowns of our information and technology systems or infrastructure could have a material adverse effect on our operations” elsewhere in this Item 1A, Risk Factors). Additionally, if we do not effectively adopt and integrate AI into innovative, market-differentiated products in a timely manner, our competitive position could be adversely affected.

Read in the 10-K filed Nov 25, 2025 ↗

We are also subject to complex and rapidly evolving privacy and data protection laws, regulations and standards which govern the collection, use, storage, transfer, sharing and processing of personal data (particularly sensitive health information) across the U.S. and a significant number of other countries where we operate. The nature of our technologies and data-driven solutions amplifies privacy and data protection risks, especially as we employ could-based infrastructures, AI and other emerging digital capabilities. These innovations can introduce new vectors for data exposure, algorithmic bias, and regulatory scrutiny. These laws, rules and regulations require, among other things, proactive implementation of comprehensive compliance programs, continuous enhancement of internal policies, business practices, processes, and integration of technical and organizational safeguards across all assets and activities that process personal data. These requirements often entail operational constraints and higher compliance costs and may require us to modify existing or future products, potentially impacting innovation timelines and financial performance.

Read in the 10-K filed Nov 25, 2025 ↗

Furthermore, privacy and data protection risks extend beyond our direct operations. Non-compliance by third-party vendors, manufacturers, or service providers (especially those involved in data processing) can expose us to liability indirectly. Cybersecurity incidents, system failures, or breaches involving our own infrastructure or that of our partners may trigger regulatory scrutiny, financial penalties, business interruption, reputational harm, loss of competitive advantage and customer trust, as well as privacy litigation and civil lawsuits with damages.

Read in the 10-K filed Nov 25, 2025 ↗

To the extent we pursue our Investment Policy, including through our announced international expansion initiatives in Asia (including in Japan and India), we will be exposed to various risks associated with digital assets, including the following: Bitcoin does not pay interest, dividends or other returns and we can only generate cash from our Bitcoin holdings if we sell them or implement strategies to create income streams or otherwise generate cash by using those holdings; our lack of control over decentralized or third-party blockchains, networks, and custodians that may experience downtime, cyberattacks, critical failures, errors, bugs, corrupted files, data losses, or other similar software failures, outages, breaches and losses, including those due to third-party actions; breaches of security or privacy; further reductions in mining rewards of Bitcoin or increases in the costs associated with Bitcoin mining; transaction congestion and fees associated with processing transactions on the Bitcoin networks; developments in mathematics or technology or new applications of current knowledge that could result in the cryptography used by the Bitcoin blockchains becoming insecure or ineffective; pressures on trading platforms and infrastructure that can lead to inadvertent suspension of services across parts of the platforms or the entire platforms, which may cause outages; and differences in prices of digital assets between exchanges.

Read in the 10-K filed Mar 19, 2026 ↗

Additionally, the laws and regulations concerning the use of AI continue to evolve. If the use or integration of AI systems, or the outputs generated by such systems, were determined to be non-compliant (e.g., in relation to AI statutory regimes, data privacy rights or in relation to the use of AI for certain activities or use cases), this may expose us to regulatory action or litigation. It is possible that emerging regulations or changes to intellectual property laws may limit or block the use of AI in our business or otherwise impose restrictions that may adversely affect the efficiency of our business processes or solutions that were utilizing AI technologies.

Read in the 10-K filed Feb 5, 2026 ↗

•Digital Omnibus: In November 2025, the EC proposed a Digital Omnibus package intended to take a holistic view across digital legislation at the EU level, including the EU AI Act, GDPR, Data Act, ePrivacy Directive and cybersecurity laws to reduce complexity and duplication. The package proposes a delay to the introduction of rules relating to high-risk AI uses pending development of compliance guidance, targeted changes to data protection rules under GDPR to facilitate data use in the development and operation of AI models and systems, and streamlining of incident reporting obligations.

Read in the 10-K filed Feb 25, 2026 ↗

Cybersecurity, data privacy and intellectual property risks: Cybersecurity incidents may compromise systems; intellectual property disputes or alleged infringements could disrupt our business; accounting for digital assets and fair value measurements; potential impairment charges; auditor transitions; internal control considerations.

Read in the 10-K filed Nov 21, 2025 ↗

Various other technical issues have also been uncovered from time to time that resulted in disabled functionalities, exposure of certain users’ personal information, theft of users’ assets, and other negative consequences, and which required resolution with the attention and efforts of their global miner, user, and development communities. If any such risks or other risks materialize, and in particular if they are not resolved, the development and growth of digital assets may be significantly affected and, as a result, our business, operating results, and financial condition could be adversely affected.

Read in the 10-K filed Nov 21, 2025 ↗

The enhancement and development of technology systems may enhance cybersecurity risks and operational and technological risks, as any latency, disruption or failure in such technological tools could result in errors in analyses and compromise the integrity, security or privacy of generated content. Additionally, the process of integrating technology systems of businesses we acquire is complex and exposes us to additional risk. We may not adequately identify weaknesses in the information systems or information handling, privacy and security policies and protocols of targets, which could expose us to unexpected liabilities or make our own systems and data more vulnerable to cybersecurity incidents. For further discussion of risks relating to these technology systems, please see “A cybersecurity attack, or any other interruption in information technology and/or data security that may impact our operations or the operations of third parties that support us, could adversely affect our business, financial condition and reputation” above.

Read in the 10-K filed Feb 12, 2026 ↗

Various other technical issues have also been uncovered from time to time that resulted in disabled functionalities, exposure of certain users’ personal information, theft of users’ assets, and other negative consequences, and which required resolution with the attention and efforts of their global miner, user, and development communities. If any such risks or other risks materialize, and in particular if they are not resolved, the development and growth of digital assets may be significantly affected and, as a result, our business, operating results, and financial condition could be adversely affected.

Read in the 10-K filed Mar 27, 2026 ↗

result in exposure to claims for damages and other remedies by WhiteFiber’s customers and individuals whose personal data is the subject to a cybersecurity incident;

Read in the 10-K filed Mar 27, 2026 ↗

For example, California has enacted the California Consumer Privacy Act (“CCPA”) and the California Privacy Rights Act (“CPRA”), which, among other things, allows California consumers to request that certain companies disclose the types of personal information collected by such companies, to correct that information, to delete that information and to opt-out the sale or sharing of personal information for cross-context behavioral advertising. The California Privacy Protection Agency (“CPPA”) has proposed new regulations to require companies to conduct risk assessments, annual cybersecurity audits and set up notice and opt-out and access procedures for the use of automated decision-making technology. These proposed new requirements could increase our costs of compliance and impact our operations and the products and services we offer.

Read in the 10-K filed Mar 27, 2026 ↗

In addition, Iowa, Delaware, Maine, Virginia, Colorado, Utah, Oregon, Montana, Nebraska, New Hampshire, New Jersey, Texas, Utah and Connecticut enacted privacy and data protection laws in recent years that are currently in effect and grant similar rights and impose similar obligations as the CCPA. New privacy laws enacted in Maryland, Minnesota, Rhode Island, and Tennessee will take effect over the next couple years. Other states in the U.S. are also separately proposing laws to regulate privacy and security of personal data. Our failure, and/or the failure by the various third party vendors and service providers with which we do business, to comply with applicable privacy policies or federal or state laws or changes in applicable laws and regulations, or any compromise of security that results in the unauthorized release of personal information or other user data could damage our reputation and the reputation of our third party vendors and service providers, discourage potential users from trying their products and services and/or result in fines and/or proceedings by governmental agencies and/or consumers, any one or all of which could adversely affect our business, financial condition and results of operations and, as a result, our company. In addition, we, our subsidiaries or our business affiliates may not have adequate insurance coverage to compensate for losses.

Read in the 10-K filed Mar 27, 2026 ↗

Foreign data privacy laws, such as the General Data Protection Regulation (“GDPR”) in the European Union and the United Kingdom Data Protection Act (“UK GDPR”) impose data privacy and security requirements that may impact our ability to collect and process personal information of residents of the EU and the UK. The transfer of personal information from such jurisdictions may be subject to additional restrictions and require the use of transfer mechanisms recognized by GDPR and UK GDPR, such as the use of Standard Contractual Clauses, which impose numerous obligations on data importers and exporters. Violations of the GDPR or UK GDPR could impose us to fines of up to €20 million, or up to 4% of the annual worldwide turnover of the preceding financial year, whichever is greater.

Read in the 10-K filed Mar 27, 2026 ↗

Cybersecurity, privacy and data protection have become top priorities for regulators in the United States and around the world. Many jurisdictions in which we operate have laws and regulations relating to privacy, data protection and cybersecurity, including the Gramm-Leach-Bliley Act (“GLBA”) (including recent amendments to Regulation S-P),

Read in the 10-K filed Feb 27, 2026 ↗

violations. Several jurisdictions in which we operate are considering or have proposed or enacted legislation and policies regulating AI and non-personal data, such as the European Union’s AI Act. These new regulations may diverge from one another, which could require us to navigate different obligations and enforcement actions in different geographies. Any violations of these laws may lead to reputational damage, financial penalties and increased regulatory scrutiny and oversight.

Read in the 10-K filed Feb 12, 2026 ↗

•Any actual or perceived failure to comply with new or existing laws, regulations and other requirements relating to the privacy, security, processing and cross-border transfer of Personal Information (as defined below) could adversely affect our business, financial condition and results of operations.

Read in the 10-K filed Feb 19, 2026 ↗

Any actual or perceived failure to comply with new or existing laws, regulations and other requirements relating to the privacy, security, processing and cross-border transfer of Personal Information could adversely affect our business, financial condition and results of operations.

Read in the 10-K filed Feb 19, 2026 ↗

In connection with running our business, we receive, store, use and otherwise process Personal Information, including from and about actual and prospective customers and users, as well as our employees and business contacts. We are therefore subject to a variety of federal, state and foreign laws, regulations and other requirements relating to the privacy, security and handling of Personal Information. For example, the EU/UK General Data Protection Regulation, the California Consumer Privacy Act and related laws in other jurisdictions require us to adhere to certain disclosure restrictions and deletion obligations with respect to the Personal Information of their residents, and allow for penalties for violations and, in some cases, a private right of action. These laws also impose transparency and other obligations with respect to Personal Information of their respective residents and provide residents with similar rights with respect to their Personal Information. We have invested, and continue to invest, human and technology resources in our efforts to comply with such requirements that may be time-intensive and costly.

Read in the 10-K filed Feb 19, 2026 ↗

The application and interpretation of such requirements are constantly evolving and are subject to change, creating a complex compliance environment. In some cases, these requirements may be either unclear in their interpretation and application, or they may have inconsistent or conflicting requirements with each other. Further, there has been a substantial increase in legislative activity and regulatory focus on data privacy and security in the United States and elsewhere, including in relation to cybersecurity incidents. In addition, some such requirements place restrictions on our ability to process Personal Information across our business or across country borders.

Read in the 10-K filed Feb 19, 2026 ↗

It is possible that new laws, regulations and other requirements, or amendments to or changes in interpretations of existing laws, regulations and other requirements, may require us to incur significant costs, implement new processes or change our handling of information and business operations, which could ultimately hinder our ability to grow our business by extracting value from our data assets. In addition, any failure or perceived failure by us to comply with laws, regulations and other requirements relating to privacy, security and handling of information could result in legal claims or proceedings (including class actions), regulatory investigations or enforcement actions. We could incur significant costs in investigating and defending such claims and, if found liable, pay significant damages or fines or be required to make changes to our business. These proceedings and any subsequent adverse outcomes may subject us to significant negative publicity and an erosion of trust. If any of these events were to occur, our reputation, business, financial condition and results of operations could be materially adversely affected.

Read in the 10-K filed Feb 19, 2026 ↗

The use of AI technologies in our operations presents risks that could adversely affect our business, financial condition, results of operations and reputation. AI systems, whether developed internally or used by our vendors, service providers or business partners, may produce inaccurate, biased or misleading outputs or experience errors, security vulnerabilities or other failures, which could result in operational disruptions, flawed decision‑making, data loss, cybersecurity incidents or reputational harm. The use of AI may also increase the risk of inadvertent disclosure or misuse of proprietary, confidential or personal information. In addition, the legal and regulatory landscape governing AI technologies is rapidly evolving and uncertain, and compliance with new or changing requirements may impose significant costs or limit our ability to develop, deploy or use AI. If we fail to keep pace with the rapid evolution of AI technologies in our industry and the segments we serve, our competitive position and business results could be negatively impacted.

Read in the 10-K filed Feb 24, 2026 ↗

As of January 1, 2026, comprehensive privacy laws are in effect in 20 states, complicating our privacy compliance obligations through the introduction of increasingly disparate requirements across the various U.S. jurisdictions in which we operate. Additionally, certain other states have enacted specific health data privacy laws and other states are considering similar legislation. This imposes significant compliance costs and exposes us to substantial risks, particularly with respect to health data and other sensitive data. While Congress is considering legislation that may preempt some or all of such U.S. state privacy laws, such legislation may also provide a more expansive private right of action for privacy claims than exists under current state laws.

Read in the 10-K filed Feb 12, 2026 ↗

We are currently subject to numerous and evolving federal, state, local and foreign laws and regulations that protect the privacy and security of personal information, such as the California Consumer Privacy Act ( the "CCPA") as amended, other comprehensive US state privacy laws, the California Online Privacy Protection Act, the Personal information Protection and Electronic Documents Act, the Controlling the Assault of Non-Solicited Pornography and Marketing (CAN-SPAM) Act, the Telephone Consumer Protection Act of 1991, the Health Insurance Portability and Accountability Act of 1996 (HIPAA), and Section 5 of the Federal Trade Commission Act. Moreover, our use or sharing of certain data may subject us to the Video Privacy Protection Act (“VPPA“), and the California Invasion of Privacy Act (“CIPA”). Private plaintiffs and class action lawyers are increasingly bringing claims alleging violations of VPPA and CIPA, and courts have made inconsistent decisions regarding such claims. Such claims could thus lead to significant statutory damages or pressure to settle.

Read in the 10-K filed Feb 12, 2026 ↗

The CCPA contains significant obligations and requirements that have resulted in a greater compliance burden with respect to our operations and data usage of California residents, which will continue to increase our costs. The CCPA covers businesses that obtain or access personal information of California consumers, grants consumers enhanced privacy rights and control over their personal information and imposes significant requirements on covered companies with respect to consumer data privacy rights. The CCPA provides consumers with the right to opt out of the sale and “sharing” of their personal information. In November 2020, California voters adopted the CPRA that amends the CCPA, including creating a new agency to implement and enforce the law and enhancing and strengthening regulatory requirements and individual protections under the CCPA. As of January 2026, 19 other states have enacted, and more are considering, similar privacy, data protection and information security laws, which may subject us to additional requirements and restrictions that could have an impact on our business, further complicating our privacy compliance obligations through the introduction of increasingly disparate requirements across the various U.S. jurisdictions in which we operate. Additionally, several states have enacted health-specific privacy laws or strengthened protections of health- and location-related data, and other states are considering similar legislation. Our website ecommerce and customer relations businesses that store, process or transmit payment cardholder data are subject to be Payment Card Industry (PCI) compliance requirements as mandated by the credit card companies (Visa, Mastercard, and American Express) and the Payment Card Institute Data Security Standard (PCI-DSS). Moreover, the increasing use of ad-blocking technologies, browser and device privacy settings, and consumer opt-out choices may reduce advertising effectiveness and negatively impact our revenue.

Read in the 10-K filed Feb 12, 2026 ↗

notably to information, access, rectification, erasure of the personal data and the right to object to the processing. Despite Brexit, the UK also has data protection laws equivalent to the GDPR. Uncertainty about compliance with these data protection laws remains, with the possibility that data protection authorities located in different EU Member States may interpret GDPR differently, or requirements of national laws may vary between the EU Member States, or guidance on GDPR and compliance practices may be often updated or otherwise revised. Any of these events will increase the complexity and costs of processing personal data in the European Economic Area, UK or Switzerland or concerning individuals located in these jurisdictions.

Read in the 10-K filed Feb 12, 2026 ↗

It is also important to note that many countries are following the EU in producing a broad omnibus law in relation to privacy protection and enhanced cybersecurity requirements. In Asia, privacy and cybersecurity requirements are becoming more prescriptive and may include localization, mandatory breach notification obligations, security baseline requirements and cross-border transfer constraints. As a result of the various privacy, cybersecurity, and data protection regimes that apply to our operations globally, we may need to adapt our technologies or practices, incur material compliance and operational costs, restrict certain features or data uses in some jurisdictions, implement region-specific solutions, renegotiate vendor and customer terms, and/or change our business operations.

Read in the 10-K filed Feb 12, 2026 ↗

A successful cybersecurity incident or IT Systems failure could result in, among other things, (i) interruptions to our operations or services; (ii) loss of control or impaired operation of our equipment; (iii) misappropriation or loss of personal data, Confidential Information or other critical data; and (iv) loss, theft or irretrievable loss of bitcoin or other digital assets. Such incidents could materially harm our business and reputation, require significant incident response, remediation or system restoration efforts and expenses, and expose us to governmental or regulatory investigations,

Read in the 10-K filed Feb 24, 2026 ↗

enforcement actions, litigation (including class actions), fines, penalties or other liabilities. In addition, a data breach or cybersecurity incident may trigger mandatory notification obligations under applicable privacy and data protection laws, which could result in negative publicity and a loss of confidence in our security measures.

Read in the 10-K filed Feb 24, 2026 ↗

Our financial performance depends, in part, on our ability to develop and market new and innovative services that differentiate our products or provide cost efficiencies, while avoiding increased related expenses. As artificial intelligence is a new and evolving technology in the early stages of commercial use, there are significant risks involved in the development and deployment of artificial intelligence. Moreover, there can be no assurance that our use of artificial intelligence in our business processes, system development, operations, or as part of our product and service offerings will enhance our products or services or augment our business or operating results. Market acceptance of artificial intelligence technologies is uncertain, and we may be unsuccessful in our product development efforts. Our artificial intelligence-related product initiatives and offerings, or use in our internal business operations, may give rise to risks related to accuracy, bias, discrimination, intellectual property infringement, misappropriation or leakage of intellectual property, defamation, data privacy and cybersecurity, among others. We are also exposed to risks related to the use of artificial intelligence technologies by third-party service providers, clients and other financial intermediaries. Risks related to our development and use of artificial intelligence include the possibility of new or enhanced laws or regulations or novel enforcement of existing laws related to artificial intelligence, compliance with which may be costly and burdensome or involve changes to our business practices or products, litigation or other legal liability, or additional oversight, audits or enforcement under existing laws or regulations. Our use of artificial intelligence may also give rise to ethical concerns or negative public perceptions, which may cause brand or reputational harm. Additionally, our existing competitors or new entrants may be developing their own artificial intelligence products and technologies, which may be superior in features or functionality, or cost, to our offerings. Any of these factors could adversely affect our business, reputation or operating results.

Read in the 10-K filed Feb 26, 2026 ↗

We continue to invest in and utilize emerging technologies that have potential to make business tasks easier, more efficient and less labor intensive, including artificial intelligence and machine learning. These new technologies may not deliver the expected efficiencies and could expose us to new risks, including risks related to cybersecurity, data privacy, inaccuracies, hallucinations, bias or discrimination and claims of intellectual property infringement.

Read in the 10-K filed Feb 4, 2026 ↗

We are incorporating AI solutions into our business, products, services and features, and we are leveraging AI, including generative AI, machine learning and similar tools and technologies, in our product development, operations and software programming. There is inherent risk and uncertainty involved in using AI. The use of AI in the development of our products and services could cause loss or theft of intellectual property, as well as subject us to risks related to intellectual property infringement or misappropriation, data privacy and cybersecurity. The use of AI by us, our vendors or our suppliers can lead to unintended consequences, including

Read in the 10-K filed Feb 10, 2026 ↗

generating content that appears correct but is factually inaccurate, misleading or otherwise flawed, or that results in unintended biases and discriminatory outcomes, which could harm our stakeholders, our reputation and our business and expose us to risks related to inaccuracies or errors in the output of such technologies. If the AI tools that we use are deficient, inaccurate or controversial, we could incur operational inefficiencies, competitive harm, legal liability, brand or reputational harm, or other adverse impacts on our business and financial results. If we do not have sufficient rights to use the data or other material or content on which the AI tools we use rely, we also may incur liability through the violation of applicable laws and regulations, third-party intellectual property, data privacy, or other rights or contracts to which we are a party. In addition, our personnel could, unbeknownst to us, improperly utilize AI and machine learning-technology while carrying out their responsibilities.

Read in the 10-K filed Feb 10, 2026 ↗

Furthermore, the Transaction exposes us to additional cybersecurity risks, which we expect to continue until the integration of Discover is completed. These risks include the possibility of previously undetected cybersecurity threats in Discover's operations, systems and networks, as well as risks related to the cybersecurity posture of Discover and its third-party service providers. The materialization of such risks could lead to the degradation or disruption of our operations and services; unauthorized access; breach of confidentiality; and misuse or modification of systems, networks and data. Additionally, in connection with the integration of Discover, failures or difficulties in retaining new personnel, including those with access to our confidential or sensitive information (including personal information), and other difficulties in the organizational,

Read in the 10-K filed Feb 19, 2026 ↗

While we continuously update our policies, programs, processes and risk management practices, many of our data management, modeling, AI, aggregation and implementation processes are manual. They may be subject to human error, data limitations, process delays or system failure. If any of our employees, contractors, third-party service providers or other third parties with which we do business use any third-party AI solutions in connection with our business, it may lead to the inadvertent or unauthorized disclosure or incorporation of our sensitive and confidential information, including personal information, into third-party systems or publicly available or third-party training sets, which may impact our ability to realize the benefit of our intellectual property or other proprietary rights in such information. Failure to manage data effectively and to aggregate data in an accurate and timely manner may limit our ability to manage current and emerging risks; to produce accurate financial, regulatory and operational reporting; and to manage changing business needs. If our Framework is ineffective, we could suffer unexpected losses, which could materially adversely affect our results of operation or financial condition.

Read in the 10-K filed Feb 19, 2026 ↗

The regulation of AI is rapidly evolving worldwide as legislators and regulators are increasingly focused on these powerful, emerging technologies. The technologies underlying AI and its uses are subject to a variety of laws and regulations, including intellectual property, privacy, data protection and data security, consumer protection, competition and equal opportunity laws and regulations. They are expected to be subject to increased regulation and new laws or new applications of existing laws and regulations.

Read in the 10-K filed Feb 19, 2026 ↗

Various U.S. governmental and regulatory agencies continue to review AI. Several U.S. states and foreign jurisdictions are applying (or are considering applying) their platform moderation, privacy, data protection, and data security laws and regulations to AI. They are also considering general legal frameworks for AI. In particular, several states, including Colorado and California, have passed or are continuing to propose laws and regulations that govern various facets and uses of AI.

Read in the 10-K filed Feb 19, 2026 ↗

Legal frameworks governing such autonomous agents remain nascent, with limited direct guidance, and the interplay between laws and regulations relating to, among other things, fraud, payments, privacy, data protection, data security and AI may create uncertainty around compliance obligations and potential liability exposure as more participants (including sellers, fintechs, AI developers and enablers) enter the agentic commerce ecosystem.

Read in the 10-K filed Feb 19, 2026 ↗

privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such

Read in the 10-K filed Mar 2, 2026 ↗

We may incur significant costs or modify our business activities to try to protect against security incidents. Certain data privacy

Read in the 10-K filed Mar 2, 2026 ↗

security measures to protect our digital assets, sensitive information, and information technology systems, Applicable data privacy and

Read in the 10-K filed Mar 2, 2026 ↗

liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our data privacy and security

Read in the 10-K filed Mar 2, 2026 ↗

standards, policies and other obligations related to data privacy and security. Our actual or perceived failure to comply with such

Read in the 10-K filed Mar 2, 2026 ↗

The Company processes personal data and other sensitive and confidential information, which subjects it to various obligations

Read in the 10-K filed Mar 2, 2026 ↗

related to data privacy and security. In the ordinary course of business, we collect, receive, store, process, generate, use, transfer,

Read in the 10-K filed Mar 2, 2026 ↗

disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, process) personal data and other sensitive

Read in the 10-K filed Mar 2, 2026 ↗

Our data processing activities subject us to numerous data privacy and security obligations, such as various laws, regulations,

Read in the 10-K filed Mar 2, 2026 ↗

guidance, industry standards, external and internal privacy and security policies, contractual requirements, and other obligations

Read in the 10-K filed Mar 2, 2026 ↗

In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data

Read in the 10-K filed Mar 2, 2026 ↗

breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act),

Read in the 10-K filed Mar 2, 2026 ↗

and other similar laws (e.g., wiretapping laws). Numerous U.S. states have enacted comprehensive privacy laws that impose certain

Read in the 10-K filed Mar 2, 2026 ↗

obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain

Read in the 10-K filed Mar 2, 2026 ↗

rights concerning their personal data. As applicable, such rights may include the right to access, correct, or delete certain personal

Read in the 10-K filed Mar 2, 2026 ↗

for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state

Read in the 10-K filed Mar 2, 2026 ↗

laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018 (“CCPA”) applies to

Read in the 10-K filed Mar 2, 2026 ↗

personal data of consumers, business representatives, and employees who are California residents, and requires businesses to provide

Read in the 10-K filed Mar 2, 2026 ↗

specific disclosures in privacy notices and honor requests of such individuals to exercise certain privacy rights. The CCPA provides

Read in the 10-K filed Mar 2, 2026 ↗

Our use of AI/ML technologies may be subject to certain privacy obligations. Other laws governing certain data or sectors may

Read in the 10-K filed Mar 2, 2026 ↗

apply to our operations. We may be unable to transfer personal data from Europe and other jurisdictions to the United States or other

Read in the 10-K filed Mar 2, 2026 ↗

and policies related to data privacy and security, and our efforts to comply with such obligations may not be successful. We publish

Read in the 10-K filed Mar 2, 2026 ↗

privacy policies, marketing materials, whitepapers, and other statements, concerning data privacy, and security. Regulators in the

Read in the 10-K filed Mar 2, 2026 ↗

Obligations related to data privacy and security are quickly changing, becoming increasingly stringent, and creating uncertainty.

Read in the 10-K filed Mar 2, 2026 ↗

personal data on our behalf. We may at times fail (or perceived to have failed) in our efforts to comply with our data privacy and

Read in the 10-K filed Mar 2, 2026 ↗

whom we work with to comply with applicable data privacy and security obligations could subject us to litigation (including class

Read in the 10-K filed Mar 2, 2026 ↗

regulators; additional reporting requirements and/or oversight; bans or restrictions on processing personal data; and orders to destroy

Read in the 10-K filed Mar 2, 2026 ↗

We also operate in an evolving regulatory environment for cybersecurity and data privacy. New or expanded disclosure or

Read in the 10-K filed Feb 27, 2026 ↗

In the United States, California has enacted the California Consumer Privacy Act, as amended (“CCPA”) and numerous similar recently enacted laws create new data privacy rights for individuals. Other evolving legislation relating to privacy and cybersecurity at the federal, state, and local levels also may, or may be argued to, apply to us. Additionally, certain of our commercial partners, including payment card companies, have imposed data security standards or other obligations relating to privacy, data protection, or data security upon us, and others may do so in the future. We also may be, or may be argued to be, subject to industry standards or other actual or asserted obligations relating to privacy, data protection, and cybersecurity. We strive to comply with applicable laws, regulations, policies, and contractual and other legal obligations relating to privacy, data protection, and cybersecurity. These legal, contractual, and other actual and asserted obligations are, however, evolving rapidly, may be interpreted and applied in new ways and/or in manners that are inconsistent, and may conflict with other obligations or our practices.

Read in the 10-K filed Sep 29, 2026 ↗

Because the models, algorithms, and datasets these technologies rely on may be flawed, incomplete, or biased, their outputs may be inaccurate, unreliable, or otherwise harmful, including in unintended or discriminatory ways. Certain of our uses directly affect transaction outcomes for vehicle sellers and buyers, errors, defects, or malfunctions, or their misuse by our personnel, which could result in operational disruptions, flawed business decisions, degraded sale outcomes, disputes or litigation, and harm to our reputation and our relationships with insurance companies and other significant vehicle sellers. Our use of these technologies may also increase the risk that our confidential information or our customers' personal information is inadvertently disclosed, used to train third-party models, or otherwise made available to others, and intellectual property rights in the outputs may be uncertain or unenforceable, we may not own those outputs, and our use of these technologies and their training data may subject us to infringement or misappropriation claims. Any of the foregoing risks, individually or in the aggregate, could have a material adverse effect on our business, consolidated results of operations, and financial position.

Read in the 10-K filed Sep 29, 2026 ↗

We, along with many businesses in the biopharmaceutical industry, are adopting and exploring the use of artificial intelligence (AI) in our business, and as an emerging and rapidly evolving technology, our use of AI introduces potential opportunities but also presents risks that could adversely affect our operations, information security and reputation. For example, algorithms may be flawed; data sets may be insufficient, of poor quality, or contain biased information; and inappropriate or controversial data practices by data scientists, engineers, and end-users could impair results. If the analyses that artificial intelligence-based applications assist in producing are deficient or inaccurate, we could be subjected to competitive harm, potential legal liability and brand or reputational harm. Use of AI-based software may also lead to cybersecurity risks or the release of confidential proprietary information, including personal data, which may impact our ability to realize the benefit of our intellectual property or violate our internal policies, data protection laws or contractual requirements. The use of AI-based software may also result in unauthorized access of personal data or the intellectual property of third parties. The legal and regulatory landscape regarding the use of AI is rapidly evolving, including in the areas of intellectual property, cybersecurity, and privacy and data protection. Compliance may impose operational costs and limit our ability to use AI-based software, and failure to comply may result in potential government actions, litigation, fines, penalties or adverse publicity.

Read in the 10-K filed Feb 18, 2026 ↗

The EU GDPR also imposes specific restrictions on the transfer of personal data to countries outside of the EU and EEA, including the use of appropriate safeguards to enable such transfers, such as Standard Contractual Clauses (SCCs) and the EU-

Read in the 10-K filed Feb 18, 2026 ↗

We are increasingly building AI into many of our offerings, including generative and agentic AI. As with many technical innovations, AI offerings, such as Agentforce, and our Agentforce 360 Platform present additional risks and challenges that could affect customer adoption and therefore our business. For example, the development and deployment of AI offerings, including those involving information regarding our customers’ customers, raise emerging ethical, legal and operational considerations. If we enable or offer solutions that draw controversy due to their perceived or actual impact on human rights, privacy, employment or other social concerns, we may experience new or heightened governmental or regulatory scrutiny, investigations, enforcement actions, fines or penalties and reputational or competitive harm.

Read in the 10-K filed Mar 2, 2026 ↗

AI technologies may produce content that is inaccurate, misleading, biased, offensive or unsafe, and may implicate privacy, security or intellectual property rights, including through the generation of copyrighted or other protected material. If our customers or others rely on such content to their detriment, or if regulators or rights holders assert claims relating to AI-generated content, we may be exposed to litigation, regulatory investigations, enforcement actions, indemnification obligations, monetary penalties or other liabilities, or reputational harm. Developing, testing and deploying AI technologies may also increase the cost profile of our offerings due to the computing costs required. If we are unable to effectively mitigate these risks, or if our mitigation efforts result in excessive costs, our reputation, business, operating results and financial condition may be adversely affected.

Read in the 10-K filed Mar 2, 2026 ↗

These laws continue to evolve and expand, including through the adoption of new comprehensive data protection regimes such as India’s Digital Personal Data Protection Act 2023, and through the introduction of additional implementing rules and regulations in various jurisdictions. As a result, we and our customers may become subject to additional regulatory burdens. New EU laws, including the DSA, the Data Act and the AI Act, have also been adopted and, depending on how they are implemented, interpreted and enforced, may impose additional rules, restrictions or compliance requirements on the development, deployment or use of our products and services, including AI-enabled features.

Read in the 10-K filed Mar 2, 2026 ↗

jurisdictions in which we operate, such procedures and controls may not be effective in ensuring compliance or preventing unauthorized transfers of personal data.

Read in the 10-K filed Mar 5, 2026 ↗

For additional information and a further discussion of impacts and risks related to cybersecurity matters, see the risk factors under the “Item 1A. Risk Factors— Risk Related to Cybersecurity, Privacy, and Regulatory Requirements” heading.

Read in the 10-K filed Sep 2, 2026 ↗

Already, certain existing legal regimes (e.g., relating to data privacy) regulate certain aspects of AI Technologies, and new laws regulating AI Technologies have either entered into force in the United States and the EU in 2025 or are expected to enter into force in 2026.

Read in the 10-K filed Feb 26, 2026 ↗

The regulatory environment governing AI is rapidly evolving in the U.S. and internationally. Existing and new laws, regulations, industry standards and governmental guidance relating to AI, data privacy, cybersecurity, intellectual property, transparency, consumer protection, employment practices and automated decision-making may increase our compliance costs, restrict our ability to develop and deploy AI solutions, require changes to our business practices or expose us to regulatory investigations, enforcement actions, penalties or litigation.

Read in the 10-K filed Jul 29, 2026 ↗

Our use of AI technologies also may increase cybersecurity, privacy and data protection risks. AI systems may process large volumes of proprietary, personal, customer, supplier and employee-partner information, and failures in the design, implementation or oversight of such systems could result in the unauthorized disclosure, misuse, loss or corruption of data. Additionally, threat actors may utilize AI to develop increasingly sophisticated cyberattacks, phishing campaigns, malware, fraud schemes, social engineering techniques and other malicious activities targeting the Company, our customers, suppliers and employee-partners.

Read in the 10-K filed Jul 29, 2026 ↗

We increasingly develop and deploy AI technology through third party generative AI platforms and internal software, in connection with our proprietary systems and customer experiences, including automated, self-service workflows, AI-enabled customer support tools, internal work efficiencies, and enhancement of our recruiting and hiring processes. These initiatives are complex, rapidly evolving, and inherently uncertain. There is no assurance that our AI capabilities will function as intended, deliver anticipated benefits, or scale cost-effectively. The performance, quality, and impact of AI models depend on numerous factors, including the availability and integrity of training data, model design, computational resources, integration with our operations and technology stack, and ongoing monitoring and governance. If our AI systems or those third party platforms we utilize underperform, produce inaccurate, incomplete, or biased outputs, hallucinate or fail under edge cases, degrade customer experiences, inadvertently disclose or misuse intellectual property, or otherwise fail to meet expectations, we could experience decreased conversion, operational disruptions, increased costs, reduced margins, customer dissatisfaction, negative publicity, or harm to our brand and competitive position. Increased use of AI may additionally result in cybersecurity, data privacy, and labor and employment risks.

Read in the 10-K filed Feb 18, 2026 ↗

The laws, rules, standards, and guidance relating to AI are developing rapidly and vary across jurisdictions. We may be subject to evolving requirements regarding transparency, fairness, explainability, safety, data usage and provenance, content integrity, consumer protection, and algorithmic accountability. If we use AI in ways that regulators view as unfair, deceptive, discriminatory, or otherwise noncompliant, we could face heightened scrutiny, investigations, enforcement actions, private litigation, or requirements to modify, suspend, or cease certain AI-enabled practices. To the extent AI touches areas implicating privacy, information security, intellectual property, credit and financing, or other regulated activities, we may incur additional compliance obligations and associated costs.

Read in the 10-K filed Feb 18, 2026 ↗

We also rely on third‑party service providers and vendors that process information on our behalf. We have limited ability to control their security and privacy practices, and contractual protections and due diligence may not prevent all incidents. A security incident at a third party could have similar adverse effects on us as an incident on our own systems. The use of AI tools and programs by new or existing vendors may also introduce unique vulnerabilities whose existence or exploitation could have a material adverse effect on our business or operations.

Read in the 10-K filed Feb 18, 2026 ↗

The use of AI and related technology may also increase exposure to reputational, cybersecurity, data privacy, legal, regulatory and operational risks as AI technology rapidly evolves along with public opinion concerning the use of AI and the associated legal and regulatory framework. These risks include, but are not limited to, heightened exposure to cybersecurity incidents or the misuse of data during the integration of AI models and large data sets; increased potential liability and costs associated with complying with rapidly emerging regulatory frameworks; costs and competitive disadvantages associated with the failure to properly integrate AI into existing operations; and reputational harm caused by actual or perceived failures in the performance of AI or AI-related technology.

Read in the 10-K filed Feb 10, 2026 ↗

Chevron is incorporating artificial intelligence technologies into its processes and these technologies may present business, compliance, and reputational risks The company is increasingly utilizing artificial intelligence (“AI”) technologies in certain of its processes, information systems and various operations, and expects that AI will assume a more critical role in its operations over time. The use of AI technologies introduces certain risks to the company, including potential dependency on biased or incorrect AI outputs, new or enhanced regulatory requirements, litigation, privacy risks, cybersecurity risks, reputational harm, liability or other adverse consequences, any of which could adversely affect its business, financial condition and results of operations. Additionally, other unforeseen risks stemming from either the company’s or third-party service providers’ use and development of AI tools and technologies, or the company’s inability to adopt such technologies at the same pace as its competitors, may arise in the future that could adversely affect its business and results of operations.

Read in the 10-K filed Feb 24, 2026 ↗

Our reliance on third-party vendors, contractors, and SaaS providers creates additional cybersecurity risks. Many of our critical business operations depend on external providers for hosting, cloud services, data analytics, customer support, and other key functions. If these third parties experience a cybersecurity incident, fail to implement adequate security measures, misconfigure their systems, or otherwise do not comply with our security, privacy, or contractual requirements, our systems and data could be exposed to unauthorized access, loss, or misuse, resulting in significant operational disruption, regulatory scrutiny, financial losses, or reputational harm.

Read in the 10-K filed Feb 18, 2026 ↗

•actual or perceived privacy violations, security breaches, or other data-related incidents;

Read in the 10-K filed Feb 18, 2026 ↗

respect to data security and compliance with applicable data protection and privacy laws, and the provision of

Read in the 10-K filed May 22, 2026 ↗

We store and transmit sensitive information, including personal information of customers, consumers, and

Read in the 10-K filed May 22, 2026 ↗

There are a number of laws protecting the privacy and security of personal information, as well as increased

Read in the 10-K filed May 22, 2026 ↗

Such laws include the California Consumer Privacy Act and California Privacy Rights Act, the EU’s General Data

Read in the 10-K filed May 22, 2026 ↗

Protection Regulation and member state directives, Canada’s Personal Information Protection and Electronic

Read in the 10-K filed May 22, 2026 ↗

Documents Act, and China’s Personal Information Protection Law, and limit how we may collect, use, share and

Read in the 10-K filed May 22, 2026 ↗

store personal information, and they impose obligations to protect that information. We may also be subject to new

Read in the 10-K filed May 22, 2026 ↗

or evolving data privacy and security laws and regulations. If we, or any of our service providers who have access to

Read in the 10-K filed May 22, 2026 ↗

the personal data for which we are responsible, are found to be in violation of the privacy or security requirements of

Read in the 10-K filed May 22, 2026 ↗

•improper disclosure of data and violations of applicable data privacy and other laws; or

Read in the 10-K filed Mar 30, 2026 ↗

Attacks upon systems across a variety of industries, including industries related to Solana, are increasing in frequency, persistence, and sophistication, and, in many cases, are being conducted by sophisticated, well organized groups and individuals, including state actors. The techniques used to obtain unauthorized, improper or illegal access to systems and information (including personal data and digital assets), disable or degrade services, or sabotage systems are constantly evolving, may be difficult to detect quickly, and often are not recognized or detected until after they have been launched against a target. These attacks may occur on our systems or those of our third-party service providers or partners. We may experience breaches of our security measures due to human error, malfeasance, insider threats, system errors or vulnerabilities or other irregularities. In particular, we expect that unauthorized parties will attempt to gain access to our systems and facilities, as well as those of our partners and third-party service providers, through various means, such as hacking, social engineering, phishing and fraud. Threats can come from a variety of sources, including criminal hackers, hacktivists, state intrusions, industrial espionage, and insiders. In addition, certain types of attacks could harm us even if our systems are left undisturbed. For example, certain threats are designed to remain dormant or undetectable, sometimes for extended periods of time, or until launched against a target and we may not be able to implement adequate preventative measures. Further, there has been an increase in such activities due to the increase in remote work arrangements. The risk of cyberattacks could also be increased by

Read in the 10-K filed Mar 30, 2026 ↗

In addition, a significant number of countries where we operate have enacted privacy or data protection laws, rules and regulations, many of which have extraterritorial scope, with significant penalties for non-compliance. For example, failure to comply with the requirements of the GDPR and the applicable national data protection laws of the EU member states and other states subject to the GDPR may result in fines of up to €20 million or up to 4% of total worldwide annual turnover for the preceding financial year, whichever is higher, and other administrative penalties. Please see “Item 1. Business—Regulatory Matters” for additional information. Data privacy regulation and enforcement continues to evolve, with recent, increased focus on topics such as the use of AI, biometrics and surveillance technologies.

Read in the 10-K filed Feb 24, 2026 ↗

We are subject to various actual and threatened claims, litigation, investigations and other proceedings, including private individual actions, class actions and actions and investigations by governmental and other regulatory authorities, relating to a range of issues, including securities; competition and antitrust; intellectual property, including patent and copyright; employment and labor; taxes; privacy and data protection; data security; personal injury and property damage; consumer protection; contractual and commercial disputes; the production, distribution and licensing of our content; and other matters. For example, a private securities class action lawsuit was filed in federal court against the Company and certain current and former senior management on behalf of certain purchasers of securities of the Company seeking unspecified damages, plus interest and costs and fees, and an adverse final judgment or the terms of a settlement of such matter could result in the payment of substantial monetary damages. See Note 14 to the Consolidated Financial Statements for more details regarding this lawsuit and above in these risk factors regarding patent infringement litigation and other claims. In addition, from time to time, we pursue litigation against third parties seeking to vindicate our rights.

Read in the 10-K filed Nov 13, 2025 ↗

improper disclosure of data and violations of applicable data privacy and other laws; or

Read in the 10-K filed Feb 27, 2026 ↗

Attacks upon systems across a variety of industries, including industries related to digital assets, are increasing in frequency, persistence, and sophistication, and, in many cases, are being conducted by sophisticated, well-funded and organized groups and individuals, including state actors. Emerging risks, such as AI-driven cyberattacks and the potential for quantum computing, could introduce new vulnerabilities in our systems, potentially rendering traditional cryptographic techniques less effective and exposing us to more sophisticated forms of cyberattacks. The techniques used to obtain unauthorized, improper or illegal access to systems and information (including personal data and digital assets), disable or degrade services, or sabotage systems are constantly evolving, may be difficult to detect quickly, and often are not recognized or detected until after they have been launched against a target. Novel methods, such as those utilizing AI or quantum computing, may be even more difficult to detect and defend against. These attacks may occur on our systems or those of our third-party service providers or partners. We may experience breaches of our security measures due to human error, malfeasance, insider threats, system errors or vulnerabilities or other irregularities. In particular, unauthorized parties have attempted, and we expect that they will continue to attempt, to gain access to our systems and facilities, as well as those of our partners and third-party service providers, through various means, such as hacking, social engineering, phishing and fraud. Threats can come from a variety of sources, including criminal hackers, hacktivists, state-sponsored intrusions, industrial espionage, and insiders. In addition, certain types of attacks could harm us even if our systems are left undisturbed. For example, certain threats are designed to remain dormant or undetectable, sometimes for extended periods of time, or until launched against a target and we may not be able to implement adequate preventative measures. Further, there has been an increase in such activities due to the increase in work-from-home arrangements since the onset of the COVID-19 pandemic. The risk of cyberattacks could also be increased by cyberwarfare in connection with geopolitical conflicts, such as the ongoing Russia-Ukraine conflict, including potential proliferation of malware into systems unrelated to such conflicts. As of the date of this Annual Report, neither we nor any of our service providers has experienced a security breach or cyberattack that has materially impacted our digital asset holdings, financial condition or operating results; however, any future breach of our operations or those of our service providers or others in the digital asset industry could materially and adversely affect our business.

Read in the 10-K filed Feb 27, 2026 ↗

We have begun leveraging AI and machine learning capabilities for our employees to use in their day-to-day operations. Inadequate investment in or unsuccessful development of those AI capabilities may result in us lagging behind our competitors in terms of improving operational efficiencies. Implementation of these technologies may involve challenges such as potential shortages in required data to train internal AI models, scarcity of skilled talent to effectively deploy internal AI initiatives, or the possibility that AI tools we develop or utilize may not achieve their desired or intended benefits performance or cost-efficiency objectives. Use of third-party AI tools may introduce information security, data privacy and legal or regulatory risks. Failure to properly manage these risks could negatively impact our business, reputation and operating results.

Read in the 10-K filed Feb 13, 2026 ↗

information security, cyberattacks, security breaches and data privacy breaches;

Read in the 10-K filed Feb 13, 2026 ↗

One area of recent regulatory and legislative focus around the globe has been children’s online safety. In the U.K., the UK Online Safety Act requires online service providers to protect children from harmful content. Legislators in the U.S. are considering similar proposals, including to enhance protections for children online through mandated parental controls, enhanced privacy protections, age verification, and limited access to addictive features and chatbots. Several U.S. states have also adopted laws requiring application stores to provide standardized “age signals” to platforms. While regulators and legislators have been largely focused on social media platforms, these

Read in the 10-K filed Feb 19, 2026 ↗

In the U.S., numerous states have adopted generally applicable and comprehensive consumer privacy laws and we expect this trend to continue. These state laws provide privacy rights for residents of these states and impose corresponding obligations on organizations doing business in these states. These laws require us to make

Read in the 10-K filed Feb 19, 2026 ↗

•data privacy, consumer protection and artificial intelligence laws and regulations;

Read in the 10-K filed Feb 19, 2026 ↗

artificial intelligence and additional countries and U.S. states are expected to enact comprehensive artificial intelligence regulatory framework statutes. There are also pending legislative proposals to regulate business use and development of artificial intelligence and machine learning technologies which, if enacted, could impose new legal requirements addressing among other issues, privacy, discrimination and human rights.

Read in the 10-K filed Feb 19, 2026 ↗

Furthermore, we use artificial intelligence technologies in our business and there are significant information technology risks involved in maintaining and deploying these technologies. There can be no assurance that our investments in such technologies will always enhance our services or be beneficial to our business, including our efficiency or profitability. In particular, if the models underlying our artificial intelligence technologies are: incorrectly designed or implemented; trained or reliant on incomplete, inadequate, inaccurate, biased or otherwise poor quality data; used without sufficient oversight, governance or in violation of our internal guidelines, policies and procedures; and/or adversely impacted by unforeseen defects, technical challenges, cybersecurity threats, data privacy concerns, or material performance issues, the performance of our services and business, as well as our reputation, could suffer or we could incur liability resulting from the violation of laws or contracts to which we are a party or civil claims.

Read in the 10-K filed Feb 20, 2026 ↗

Recent technological advances in artificial intelligence (AI) and machine-learning technology have presented opportunities for us to drive internal efficiencies in our business operations, but they also pose risks to us. If we fail to keep pace with rapidly evolving technological developments in AI, our competitive position and business results may suffer, particularly if our competitors more effectively use AI to drive their business efficiencies or create new or enhanced products or services that we are unable to compete against on cost, quality or other attributes. However, the introduction of AI technologies, particularly generative AI, into internal processes and/or new and existing offerings may result in new or expanded risks and liabilities, including due to enhanced governmental or regulatory scrutiny, litigation, compliance issues, ethical concerns, confidentiality or security risks, as well as other factors that could adversely affect our business, reputation, and financial results. Furthermore, any confidential information that is disclosed to a third-party generative AI platform could be leaked or disclosed to others, which could result in loss or theft of intellectual property, as well as subject us to risks related to intellectual property infringement or misappropriation, data privacy and cybersecurity. Moreover, the use of AI may give rise to risks related to harmful content, accuracy, and bias, which could expose us to risks related to inaccuracies or errors in the output of such technologies. The rapidly evolving legal and regulatory environment relating to AI, in the United States and globally, could also impact Eaton’s implementation of AI technology, and increase compliance costs and the risk of non-compliance.

Read in the 10-K filed Feb 26, 2026 ↗

We use AI and other emerging technologies in various facets of our operations and our business. The legal and regulatory landscape surrounding AI technologies is rapidly evolving and uncertain. The rapid advancement of these technologies entails risks, including potential deficiencies in AI-generated information and increased regulatory, cybersecurity, privacy, intellectual property and data-related risks. Another risk may arise if we are unable to timely utilize AI for technological innovation and business operation efficiency in a manner that is faster and more effective than our competitors. In addition, compliance with new or changing laws, regulations or industry standards relating to AI may impose significant costs on us and limit our ability to effectively develop, deploy or use AI technologies. Furthermore, if we are unable to effectively manage the use of AI technologies by our employees and service providers, our confidential information, intellectual property and reputation could be put at risk. Failure to appropriately respond to this evolving landscape may result in reputational, competitive and business harm as well as litigation and regulatory action and fines, penalties and expenses related thereto.

Read in the 10-K filed Feb 25, 2026 ↗

•Failure to comply with anti-corruption, privacy, export control, import, or sanctions laws could harm our

Read in the 10-K filed Mar 11, 2026 ↗

privacy and security obligations, indemnification, dispute resolution procedures and regulatory requirements. Agreement

Read in the 10-K filed Mar 11, 2026 ↗

cybersecurity and data privacy. We could also inherit unforeseen liabilities, credit or compliance issues, or adverse

Read in the 10-K filed Mar 11, 2026 ↗

incorporate privacy-enhancing features and may from time to time support additional digital assets with similar

Read in the 10-K filed Mar 11, 2026 ↗

functionalities. These privacy-enhancing digital assets obscure the identities of sender and receiver and may prevent law

Read in the 10-K filed Mar 11, 2026 ↗

Public AI failures, inadequate AI governance, recordkeeping or auditability failures, data privacy violations, intellectual

Read in the 10-K filed Mar 11, 2026 ↗

be subject to significant additional regulation and obligations, including the handling of substantial personal information of

Read in the 10-K filed Mar 11, 2026 ↗

collection, use, retention, security and transfer of the personal data of individuals in those jurisdictions. We may become

Read in the 10-K filed Mar 11, 2026 ↗

subject to GDPR and U.K. GDPR, which impose stringent privacy and data protection requirements, and could increase the

Read in the 10-K filed Mar 11, 2026 ↗

GDPR (covering the European Economic Area), U.K. GDPR and Swiss data protection regimes impose strict rules on the

Read in the 10-K filed Mar 11, 2026 ↗

transfer of personal data out of the EU, U.K. or Switzerland to a “third country,” including to the United States. As an un-

Read in the 10-K filed Mar 11, 2026 ↗

hosted self-custody wallet provider, we do not process the personal data of our customers and therefore, compliance with

Read in the 10-K filed Mar 11, 2026 ↗

GDPR or U.K. GDPR in the future could further add to our compliance costs, limit how we process information, or lead to

Read in the 10-K filed Mar 11, 2026 ↗

the GDPR or U.K. GDPR, we may be subject to fines. We may also face civil claims, as well as associated costs, diversion

Read in the 10-K filed Mar 11, 2026 ↗

Aspects of the GDPR, U.K. GDPR, California Consumer Privacy Act, Swiss Secretariat for Economic Affairs and other

Read in the 10-K filed Mar 11, 2026 ↗

laws, regulations, industry standards and other obligations related to privacy, data protection and data security remain

Read in the 10-K filed Mar 11, 2026 ↗

Our efforts to comply with applicable laws, regulations and other obligations relating to privacy, data protection, and

Read in the 10-K filed Mar 11, 2026 ↗

standards relating to privacy and data protection in various jurisdictions, and we cannot determine the impact such laws,

Read in the 10-K filed Mar 11, 2026 ↗

Regulatory & Compliance Hurdles: Navigating complex antitrust, data privacy (GDPR, CCPA), and international regulatory approvals, potentially delaying or blocking transactions and incurring significant costs;

Read in the 10-K filed Feb 13, 2026 ↗

information; and enter into specific contractual provisions with service providers that process California resident personal information on the business’s behalf.

Read in the 10-K filed Feb 20, 2026 ↗

New laws and regulations are being adopted, and existing laws and regulations may be interpreted, in ways that could affect our business operations and the way in which we use AI. Our ongoing efforts to comply with privacy and data protection laws, as well as initiatives to comply with new legal regulations relating to privacy, data protection and AI, impose significant costs and challenges that are likely to increase over time. Additionally, this complex and rapidly evolving landscape around AI may expose us to claims, inquiries, demands and proceedings by private parties and global regulatory authorities and subject us to legal liability as well as reputational harm.

Read in the 10-K filed Feb 20, 2026 ↗

•Failure to comply with cybersecurity and data privacy laws and regulations could have a material effect on our reputation, results of operations or financial loss.

Read in the 10-K filed Feb 25, 2026 ↗

Additionally, the development, deployment and use of artificial intelligence (“AI”) and machine learning in our operations and those of our service providers and partners could introduce new risks, including increased exposure to cybersecurity threats and social engineering, inadvertent disclosure or misuse of confidential, proprietary or personal information, errors, bias or other unexpected outcomes in AI outputs used for operational decision‑making, and evolving and potentially divergent regulatory requirements that may restrict certain uses of AI or increase compliance costs. AI adoption may require significant investment, specialized talent and access to high‑quality data, and our competitors may adopt AI more effectively than we do. Failures or limitations in AI tools, misuse by employees or third parties, or disruptions or breaches involving AI‑enabled systems could adversely affect our business, reputation, financial condition and results of operations.

Read in the 10-K filed Feb 25, 2026 ↗

Failure to comply with cybersecurity and data privacy laws and regulations could have a material adverse effect on our reputation, results of operations or financial condition.

Read in the 10-K filed Feb 25, 2026 ↗

We are increasingly utilizing AI within our operations. The development and deployment of AI technologies involve significant risks and uncertainties, and our ability to successfully implement and use AI technologies depends on a variety of factors, including the reliability, accuracy, security, and effectiveness of the technologies; the availability of qualified personnel and technical infrastructure; the performance of third-party vendors and service providers; evolving regulatory requirements and industry standards; and customer and market acceptance. AI technologies are rapidly evolving and may produce inaccurate, flawed, or unintended outputs or outcomes. Our use of AI may also increase risks related to cybersecurity, data privacy, intellectual property, confidentiality, regulatory compliance, and reputational harm. In addition, evolving laws, regulations, and governmental guidance relating to AI may require us to incur additional compliance costs, change our business practices, or limit our ability to develop or use AI technologies. Our competitors may also adopt AI technologies more quickly or more effectively than we do. Further, our investments in AI technologies may not improve our services, operations, efficiency, or profitability to the extent anticipated and may divert resources from other strategic initiatives. Any failure to successfully develop, implement, manage, or use AI technologies in a timely, compliant, and responsible manner could adversely affect our business, reputation, results of operations, or financial condition.

Read in the 10-K filed Jul 20, 2026 ↗

•Failure to comply with data privacy and cybersecurity laws and regulations could expose us to government enforcement, significant penalties, civil litigation, and reputational harm.

Read in the 10-K filed May 20, 2026 ↗

We are incorporating AI solutions into aspects of our business, including our manufacturing operations, design and engineering services, and internal processes, and we also rely on AI tools used by our employees, vendors, or other third parties. AI technologies are complex and rapidly evolving, and our business may be adversely affected if we are unable to successfully integrate AI into our operations, products, and services in a timely and cost-effective manner. AI is subject to increasing regulatory, legal, and ethical scrutiny, and its use may give rise to risks related to accuracy, bias, intellectual property infringement or misappropriation, data privacy, cybersecurity, and compliance with evolving laws and regulations.

Read in the 10-K filed May 20, 2026 ↗

Changes in U.S. and foreign government policies, including those relating to trade, sanctions, information security, data privacy, national security, and foreign investment, may affect the attractiveness of our services to customers and our ability to conduct business with certain customers or suppliers. We have significant operations in China, which have been, and could continue to be, affected by evolving laws, regulations, and geopolitical developments involving China. We could be subject to reputational harm if any of our customers, former customers or vendors were subject to U.S. sanctions or did business with sanctioned entities or countries or otherwise violated applicable sanctions or export control laws. Furthermore, regional conflicts, including the conflicts in Ukraine and the Middle East, including the conflict in Israel and recent U.S. military operations in Iran, and tension between China and Taiwan, could result in sanctions, regional market instability, increased energy and transportation costs, supply chain disruptions, and other adverse regional and global financial and economic conditions, any of which can impact the demand for, or our ability to sell, our products and services in the impacted regions. Escalation of hostilities involving Iran, Israel, and the United States or regional proxy groups could adversely affect regional stability, threaten critical infrastructure such as data centers, impair access to ports and transportation routes including the Strait of Hormuz, and increase fuel, energy, freight, insurance, and security costs. In addition, expanded sanctions, export controls, or other governmental measures affecting the region could impair our ability to conduct business, collect receivables, or repatriate funds. In particular, geopolitical changes in China-Taiwan relations could disrupt the operations of several companies in Taiwan that are critical to the global supply of semiconductors and other electronic components on which many of our customers depend, and any escalation of tensions could materially affect our supply chain and operations.

Read in the 10-K filed May 20, 2026 ↗

We are, from time to time, subject to claims, lawsuits, investigations, and regulatory or administrative proceedings across the jurisdictions where we operate. These matters may involve commercial disputes, regulatory compliance, intellectual property, antitrust, product liability, employment and labor, privacy and data protection, securities laws, governance, and tax. Adverse outcomes, whether by judgment, settlement, consent decree, or otherwise, could require monetary payments, penalties, injunctive relief, operational changes, monitorships, remedial measures, or enhanced compliance controls. Even if we prevail, we may incur substantial costs, increased insurance premiums, and management distraction that disrupts our operations and harms our reputation with customers, suppliers, employees, and regulators. Outcomes are inherently unpredictable, and our accruals and insurance coverage may be insufficient or unavailable. Any of these matters could materially adversely affect our business, financial condition, results of operations, and cash flows.

Read in the 10-K filed May 20, 2026 ↗

Failure to comply with data privacy and cybersecurity laws and regulations could expose us to government enforcement, significant penalties, civil litigation, and reputational harm.

Read in the 10-K filed May 20, 2026 ↗

We regularly move data across borders to operate our global business, and are consequently subject to a broad and continuously evolving set of privacy and data protection laws and regulations both domestically and internationally, including the European Union General Data Protection Regulation ("GDPR"), the UK GDPR, China's Personal Information Protection Law ("PIPL"), India's Digital Personal Data Protection Act, and comprehensive privacy statutes in numerous U.S. states, including the California Consumer Privacy Act ("CCPA"), as amended by the California Privacy Rights Act ("CPRA"). These laws impose numerous, and oftentimes differing, obligations on data controllers and processors, and new requirements continue to be proposed and enacted across U.S. federal, state, and international jurisdictions. Compliance can be costly, and the complexity and inconsistency of these frameworks across jurisdictions poses significant compliance challenges that have resulted, and will continue to result, in increased costs and required modifications to our data processing practices and policies.

Read in the 10-K filed May 20, 2026 ↗

Any actual or perceived failure to comply with applicable data privacy or cybersecurity laws, related contractual obligations, or other data protection standards, whether by us, a third-party service provider, or another party, could result in government inquiries, regulatory investigations, significant fines and penalties, orders to cease or modify our data practices, damages for contract breach, and civil litigation, as well as harm to our reputation and market position. We may also be required to invest significant additional resources to comply with evolving cybersecurity and AI-related regulations and to modify and enhance our information systems and controls. Our liability insurance may not be sufficient in type or amount to cover us against all claims related to privacy violations or regulatory non-compliance.

Read in the 10-K filed May 20, 2026 ↗

adequately address privacy and security concerns, even if unfounded, or comply with applicable privacy and data security laws, regulations, and policies, could result in additional fines, costs, and liabilities to us, damage our reputation, inhibit sales, and adversely affect our business.

Read in the 10-K filed Feb 24, 2026 ↗

In addition to the GDPR, the EU has also enacted legislation that would regulate non-personal data and establish new cybersecurity standards, and other countries, including the U.K., may similarly do so in the future. In particular, the EU Data Act went into effect in 2024 and imposes certain data and cloud service interoperability and switching obligations to enable users to switch between cloud service providers (as well as certain requirements concerning cross-border international transfers of non-personal data outside the EEA). Additionally, the EU’s Network and Information Security Directive II, adopted in 2023, regulates resilience and incident response capabilities of entities operating in a number of sectors, including the digital infrastructure sector and provides for EU member states to have issued implementing legislation by October 2024. Further, DORA became effective in January 2025 and imposes certain requirements on entities in the financial sector and their third-party cloud service providers related to managing and mitigating information and communication technology risk. If we are unable to transfer data, including personal data, between and among countries and regions in which we operate, or are otherwise required to modify our practices, including our data privacy and security controls and procedures, it could affect the manner in which we provide our services, the geographical location or segregation of our relevant systems and operations, and could adversely affect our financial results.

Read in the 10-K filed Feb 25, 2026 ↗

improper disclosure of data and violations of applicable data privacy and other laws; or

Read in the 10-K filed Dec 11, 2025 ↗

Attacks upon systems across a variety of industries, including industries related to Solana, are increasing in frequency, persistence, and sophistication, and, in many cases, are being conducted by sophisticated, well-organized groups and individuals, including state actors. The techniques used to obtain unauthorized, improper or illegal access to systems and information (including personal data and digital assets), disable or degrade services, or sabotage systems are constantly evolving, may be difficult to detect quickly, and often are not recognized or detected until after they have been launched against a target. These attacks may occur on our systems or those of our third-party service providers or partners. We may experience breaches of our security measures due to human error, malfeasance, insider threats, system errors or vulnerabilities or other irregularities. In particular, we expect that unauthorized parties will attempt to gain access to our systems and facilities, as well as those of our partners and third-party service providers, through various means, such as hacking, social engineering, phishing and fraud. Threats can come from a variety of sources, including criminal hackers, hacktivists, state intrusions, industrial espionage, and insiders. In addition, certain types of attacks could harm us even if our systems are left undisturbed. For example, certain threats are designed to remain dormant or undetectable, sometimes for extended periods of time, or until launched against a target and we may not be able to implement adequate preventative measures. The risk of cyberattacks could also be increased by cyberwarfare in connection with the ongoing Russia and Israel conflicts, or other future conflicts, including potential proliferation of malware into systems unrelated to such conflicts. Any future breach of our operations or those of others in the Solana industry, including third-party services on which we rely, could materially and adversely affect our financial condition and results of operations.

Read in the 10-K filed Dec 11, 2025 ↗

In addition to the above, courts and regulators in certain jurisdictions have adopted, and may continue to adopt, broad or evolving interpretations of the obligations of domain name registrars and registries. Such interpretations may include, among other things, disclosure of registrant information, restrictions on the availability or promotion of certain domain names, limitations on privacy or proxy services, requirements to implement intellectual property protection or anti-fraud measures (including Know Your Customer requirements), and compliance with local court orders or enforcement requests, including in cross-border contexts. Compliance with such interpretations, or with inconsistent or conflicting legal requirements across jurisdictions, may increase our costs, require operational changes, limit certain product offerings or expose us to increased litigation, regulatory scrutiny, fines, penalties or enforcement actions, including restrictions on our ability to operate or offer services in certain markets. For more information, please refer to the Risk Factor "Our business could be affected by new laws, rules, regulations or court orders regarding the internet."

Read in the 10-K filed Feb 25, 2026 ↗

The continued adoption of new technologies across our business and by our customers and suppliers, including emerging technologies, system migrations and network transitions, also increases our exposure to cybersecurity threats. Any vulnerability or compromise in our or a third-party product (for example, open-source software) exposes our systems, networks, software or connected products to malicious actors that seek to misuse our products, steal intellectual property, misappropriate sensitive, confidential or personal data, or

Read in the 10-K filed Jan 29, 2026 ↗

In addition, operating system and platform providers increasingly incorporate native security, privacy, and financial features into their products, often at no additional cost, which may reduce demand for our offerings or diminish their differentiation. We also depend on strategic distribution and bundling relationships, and partners have in the past replaced, and may in the future replace, our solutions with competing or internally developed offerings, promote competing products more favorably, or limit interoperability. Industry consolidation, vertical integration, and the introduction of new or alternative technologies may further intensify competition.

Read in the 10-K filed May 21, 2026 ↗

Issues in the development and deployment of AI, including generative AI and emerging AI-enabled cyber threats, could expose us to regulatory, privacy, IP, cybersecurity, operational and reputational risks.

Read in the 10-K filed May 21, 2026 ↗

In the operation of our business, particularly in relation to our identity and information protection service and financial wellness offerings, we collect, use, process, store, transmit or disclose (collectively, process) an increasingly large amount of confidential information, including personal information (which includes credit card information and other critical data) from

Read in the 10-K filed May 21, 2026 ↗

employees and customers in multiple jurisdictions. This information is subject to a rapidly evolving and increasingly complex framework of federal, state and foreign privacy, data protection and data security laws, as well as contractual obligations.

Read in the 10-K filed May 21, 2026 ↗

At the federal level, the Gramm-Leach-Bliley (the GLBA) (along with its implementing regulations) requires disclosures to consumers about our handling of their nonpublic personal information and provides consumers with certain rights to restrict information sharing. Additionally, our investment adviser and broker-dealer subsidiaries are subject to SEC Regulation S-P, which mandates policies and procedures designed to safeguard customer information.

Read in the 10-K filed May 21, 2026 ↗

At the state level, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (CCPA), and similar comprehensive privacy laws enacted in multiple other U.S. states, provide consumers with rights to access, correct, delete and restrict the use, sale or sharing of their personal information and impose disclosure, governance and data protection obligations on covered businesses. These state laws provide civil penalties for violations, as well as private rights of action for certain data breaches. Additional states continue to enact comprehensive privacy legislation, creating a fragmented and evolving compliance environment that increases operational complexity and costs.

Read in the 10-K filed May 21, 2026 ↗

From time to time, we are involved in litigation, investigations, examinations and other legal or administrative proceedings initiated by governmental agencies or private parties. These matters may involve, among other things, labor and employment, discrimination and harassment, commercial disputes, class actions, general contract and tort claims, defamation, data privacy rights, antitrust, fraud, securities (including “blue sky” laws) violations, consumer protection laws, and other regulatory or

Read in the 10-K filed May 21, 2026 ↗

privacy, data protection and cybersecurity laws. Further, we expect increasingly stringent environmental and safety standards across

Read in the 10-K filed Jan 29, 2026 ↗

Risks Related to Technology, Cybersecurity, Data Privacy & Intellectual Property

Read in the 10-K filed Jan 29, 2026 ↗

Security or data privacy incidents or disruptions of our or our third parties’ information technology systems could adversely

Read in the 10-K filed Jan 29, 2026 ↗

We handle sensitive, confidential, and personal information in accordance with privacy and security requirements. Security incidents, data

Read in the 10-K filed Jan 29, 2026 ↗

safeguard personal information, could lead to significant costs, fines, litigation, operational restrictions, and reputational harm.

Read in the 10-K filed Jan 29, 2026 ↗

We access sensitive, confidential, proprietary, and personal information subject to numerous jurisdiction specific laws and regulations

Read in the 10-K filed Jan 29, 2026 ↗

In the United States, the Federal Trade Commission and various state laws may impose privacy and security obligations that may require

Read in the 10-K filed Jan 29, 2026 ↗

Internationally, many jurisdictions maintain unique privacy and cybersecurity frameworks. Violations can lead to substantial fines, regulatory

Read in the 10-K filed Jan 29, 2026 ↗

controls relating to data privacy and security, or to adequately protect personal information, could damage customer and employee

Read in the 10-K filed Jan 29, 2026 ↗

and storage of personal information about our employees, consumers, and proprietary business information. Our information

Read in the 10-K filed Jul 1, 2026 ↗

Possessing client assets and sensitive personal information exposes us to cybersecurity threats and data privacy obligations. A breach of our systems or those of our vendors could result in unauthorized access to confidential information, potentially triggering legal liabilities, regulatory investigations, remediation costs, and reputational harm. Continued investment in information security infrastructure and incident response protocols is necessary to mitigate this risk.

Read in the 10-K filed Feb 18, 2026 ↗

crypto task force dedicated to developing a comprehensive and clear regulatory framework for crypto assets.” The task force is focused on helping the SEC “draw clear regulatory lines, provide realistic paths to registration, craft sensible disclosure frameworks, and deploy enforcement resources judiciously.” The SEC formed the Crypto Task Force to provide clarity on the application of the federal securities laws to the crypto asset market and to recommend practical policy measures that aim to foster innovation and protect investors. Since formation, the Crypto Task Force has accepted written submissions on various cryptocurrency-related topics from industry participants; hosted roundtables on topics relating to security status, trading, custody, tokenization, DeFi, and financial surveillance and privacy; and has held meetings with interested stakeholders. On July 31, 2025, SEC Chairman Paul Atkins announced the launch of “Project Crypto,” described as “a Commission-wide initiative to modernize the securities rules and regulations to enable America’s financial markets to move on-chain.” In connection with this initiative, Chairman Atkins indicated that he has asked the Crypto Task Force to work on developing proposals to implement recommendations in the July 30, 2025, President’s Working Group on Digital Asset Markets Report, as well as a potential innovation exemption. While these developments are positive, the Crypto Task Force’s work remains in the early stages, and no formal rulemaking or exemptions have been proposed or adopted to date. In addition, notwithstanding recent positive developments involving the SEC, DOJ, and other federal regulators, state regulators retain independent authority to enforce their own securities laws, which may differ from or be interpreted more expansively than federal law. As a result, a state regulator could determine that a particular digital asset, product, or service constitutes a security under state law, even if the SEC has elected not to pursue enforcement action, the SEC has provided informal guidance or assurances to the contrary, or the asset, product, or service is otherwise excluded from the definition of a security at the federal level. Moreover, private litigants may assert claims under federal or state securities laws based on similar theories, regardless of the positions taken by federal regulators.

Read in the 10-K filed Feb 18, 2026 ↗

In the ordinary course of business, we store sensitive data, including intellectual property, personal data, our proprietary business information and that of our employees, contractors, customers, vendors, partners, suppliers, and other third parties with whom we do business. In addition, we store sensitive data through cloud-based services that may be hosted by third parties and in data center infrastructure maintained by third parties. We have been, and expect to be, subject to cyberattacks and other attempted intrusions into our networks and systems by a wide range of actors, including, but not limited to, nation state actors, criminal enterprises, terrorist organizations, and other organizations or individuals, as well as errors, wrongful conduct or malfeasance by employees and third-party service providers, (collectively, “malicious parties”) who have at times been able to circumvent or bypass our cyber security measures. Geopolitical tensions or conflicts may also heighten the risk of such cyberattacks or exacerbate system vulnerabilities, considering our continued hybrid work environment and our globally dispersed operations, employees, contractors, suppliers, developers, partners, and other third parties.

Read in the 10-K filed Dec 18, 2025 ↗

The cybersecurity threat landscape is rapidly evolving and becoming increasingly sophisticated, and there can be no assurance that our controls and procedures will be sufficient to address future threats or remediate future incidents. Further, there has been an increase in the frequency and sophistication of attacks, and we expect these activities to continue to increase, including malicious actors potentially leveraging AI to develop malicious code or sophisticated phishing attempts. It is possible that such incidents may embolden other malicious actors to perpetrate future attacks that may result in material misappropriation, system disruptions or shutdowns, malicious alteration, or destruction of our confidential or personal information or that of third parties. Additionally, the proliferation of generative AI models within the internal systems, processes, and tools of HPE, our suppliers, our customers, or other third parties with whom we do business may create new attack methods for threat actors. The emergence of deepfakes and advanced social engineering tactics presents new challenges in preventing deception and unauthorized access, underscoring the importance of advanced verification and detection mechanisms. Zero-day vulnerabilities may include newly discovered security flaws in software that are exploited before patches are released, requiring proactive monitoring and immediate remediation efforts. Quantum computing may in the future present a risk to our business by potentially breaking traditional cryptographic methods on which we rely, thereby necessitating the shift to quantum-resistant encryption techniques.

Read in the 10-K filed Dec 18, 2025 ↗

We are involved in various claims, suits, investigations, and legal proceedings that arise from time to time in the ordinary course of business or otherwise. Additional legal claims or regulatory matters affecting us and our subsidiaries may arise in the future and could involve stockholder, consumer, regulatory, compliance, intellectual property, antitrust, tax, trade, privacy, employment, warranty or product claims, and other issues on a global basis. In addition, we have received inquiries, and may be subject to demands, claims, lawsuits, regulatory investigations, and additional inquiries (including those from U.S. or foreign governmental authorities). Litigation is inherently unpredictable. Regardless of the merits of a claim, the expense of initiating and defending, and in some cases entering into settlements of claims, such litigation and investigations may be costly, and may cause us to suffer reputational harm, divert management’s attention from day-to-day operations of our business, and may require us to implement certain remedial measures that could disrupt our business, operations, results of operations, financial condition, or cash flows. In addition, if we fail to comply with the terms of any settlement agreement, we could face more substantial penalties. An unfavorable resolution of one or more of these matters could adversely affect our business, results of operations, financial condition, or cash flows. Even if we are not named a party to a particular suit, we may be subject to indemnification obligations to the named parties, including our directors and executive officers as well as other third parties, that could subject us to liability for damages or other amounts payable as a result of such judgments or settlements.

Read in the 10-K filed Dec 18, 2025 ↗

parties with whom it does business have experienced information security, cybersecurity, and data privacy incidents. None of these incidents have had a material impact on the Company's business strategy, results of operations, or financial condition. If the Company or third parties with whom the Company does business experience additional significant information security, cybersecurity, or data privacy incidents or fail to detect and appropriately respond to significant incidents, the Company's business operations could be severely disrupted and it could be exposed to costly government enforcement actions and private litigation. In addition, the Company's customers and consumers could delay, reduce, or cease purchases of the Company's products. Any of these outcomes could adversely affect the Company's reputation, results of operations, and financial condition.

Read in the 10-K filed Dec 5, 2025 ↗

There have been, and may continue to be, changes in the legal or regulatory environment (including as a result of executive orders) affecting many areas related to the Company's business, including raw material costs and availability, energy costs and availability, workforce availability, transport costs and capacity, information security, cybersecurity, and data privacy, supply chain requirements, food safety, environmental, social, and governance matters, and climate and emissions disclosure. The ultimate impact of any changes in the legal or regulatory environment (including as a result of executive orders) is not possible to predict and could negatively affect the Company's results of operations and financial condition, including by increasing its expenses,

Read in the 10-K filed Dec 5, 2025 ↗

In the ordinary course of our business, we and the third parties with whom we work, collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, process) proprietary, confidential, and sensitive data, including personal data (such as health-related data), intellectual property,

Read in the 10-K filed Mar 31, 2026 ↗

We rely on third parties to operate critical business systems to process sensitive information in a variety of contexts, including, without limitation, cloud-based infrastructure, data center facilities, encryption and authentication technology, employee email, content delivery to customers, and other functions. Our ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place. If the third parties with whom we work experience a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if the third parties with whom we work fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award.

Read in the 10-K filed Mar 31, 2026 ↗

improper disclosure of data and violations of applicable data privacy and other laws; or

Read in the 10-K filed Mar 31, 2026 ↗

We and the third parties with whom we work are subject to stringent and evolving U.S. and foreign laws, regulations, rules, and industry standards, as well as policies, contracts and other obligations related to data privacy and security. Our (or the third parties with whom we work) actual or perceived failure to comply with such obligations could lead to enforcement or litigation (including class claims) and mass arbitration demands, fines or penalties, a disruption of clinical trials or commercialization of products, reputational harm, or other adverse business effects.

Read in the 10-K filed Mar 31, 2026 ↗

In the ordinary course of business, we process sensitive information. Accordingly, we are, and may in the future become, subject to numerous data privacy and security obligations, such as various federal, state, local and foreign data privacy and security laws, regulations, guidance, and industry standards as well as external and internal privacy and security policies, contracts and other obligations that apply to data privacy and security and our processing of personal data and the processing of personal data on our behalf.

Read in the 10-K filed Mar 31, 2026 ↗

In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act) and other similar laws (e.g., wiretapping laws). For example, the federal Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), as amended by the Health Information Technology for Economic and Clinical Health Act (“HITECH”), and their respective implementing regulations, imposes requirements relating to the privacy, security and transmission of individually identifiable health information. Among other things, HITECH, through its implementing regulations, makes certain of HIPAA’s privacy and security standards directly applicable to business associates, defined as a person or organization, other than a member of a covered entity’s workforce, that creates, receives, maintains or transmits protected health information for or on behalf of a covered entity for a function or activity regulated by HIPAA as well as their covered subcontractors.

Read in the 10-K filed Mar 31, 2026 ↗

In the past few years, numerous U.S. states have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights may include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018 (“CCPA”), applies to personal data of consumers, business representatives, and employees who are California residents, and requires covered companies to provide specific disclosures in privacy notices and honor requests of such individuals to exercise certain privacy rights. The CCPA provides for fines and allows private litigants affected by certain data breaches to recover significant statutory damages. The CCPA and other comprehensive U.S. state privacy laws exempt some data processed in the context of clinical trials, but these developments may further complicate compliance efforts, and increase legal risk and compliance costs for us and the third parties with whom we work. Such laws, if they become applicable to us in the future, may significantly impact our business activities, exemplifying the vulnerability of our business to evolving regulatory environment related to personal data and protected health information. Similar laws are being considered in other states, as well as at the federal and local levels, and we expect more states to pass similar laws in the future.

Read in the 10-K filed Mar 31, 2026 ↗

Outside the United States, an increasing number of laws, regulations and industry standards govern privacy, data protection, information security and cross-border personal data transfers. For example, the European Union’s General Data Protection Regulation (“EU GDPR”) and the United Kingdom’s GDPR (“UK GDPR”) (collectively, “GDPR”) impose strict requirements for processing personal data. Under the GDPR, companies may face temporary or definitive bans on data processing and other corrective actions; fines of up to €20,000,000 under the EU GDPR / 17.5 million pounds sterling under the UK GDPR, or up to 4% annual total revenue, in each case, whichever is greater; or private litigation related to processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests.

Read in the 10-K filed Mar 31, 2026 ↗

In the ordinary course of business, we transfer personal data from Europe and other jurisdictions to the United States or other countries. Europe and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal data to other countries. In particular, the European Economic Area (“EEA”) and the United Kingdom (“UK”) have significantly restricted the transfer of personal data to the United States and other countries whose privacy laws it generally believes are inadequate. Some jurisdictions have adopted, and others may in the future adopt, similarly stringent data localization and cross-border data transfer laws. Although there are currently various mechanisms that may be used to transfer personal data from the EEA and UK to the United States in compliance with law, such as the EEA and UK’s standard contractual clauses, the UK’s International Data Transfer Agreement / Addendum, and the EU-U.S. Data Privacy Framework and the UK extension thereto (which allows for transfers for relevant U.S.-based organizations who self-certify compliance and participate in the Framework), these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the United States. If there is no lawful manner for us to transfer personal data from the EEA, UK, or other jurisdictions to the United States, or if the requirements for a legally-compliant transfer are too onerous, we may face significant adverse consequences, including the interruption or degradation of our operations (such as by limiting our ability to conduct clinical trial activities in Europe and elsewhere), the need to relocate part of or all of our business or data processing activities to other jurisdictions (such as Europe) at significant expense, the inability to transfer data and work with partners, vendors and other third parties, increased exposure to regulatory actions, substantial fines and penalties, and injunctions against processing or transferring personal data necessary to operate our business. Additionally, companies that transfer personal data out of the EEA and UK to other jurisdictions, particularly to the United States, are subject to increased scrutiny from regulators, individual litigants, and activist groups. Some European regulators have also ordered certain companies to suspend or permanently cease certain transfers out of Europe for allegedly violating the GDPR’s cross-border data transfer limitations.

Read in the 10-K filed Mar 31, 2026 ↗

Additionally, the U.S. Department of Justice issued a rule entitled the Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons, which places additional restriction on certain data transactions involving countries of concern (e.g., China, Russia, Iran) and covered persons (i.e., individuals and entities who are designated as such by the U.S. Attorney General or considered “foreign persons” and are majority owned by, organized under the laws of, a primary resident in, or a contractor of, a covered person or country of concern, as

Read in the 10-K filed Mar 31, 2026 ↗

In addition, privacy advocates and industry groups have proposed, and may in the future propose, standards with which we are legally or contractually bound to comply. We are also bound by contractual obligations related to data privacy and security, and our efforts to comply with such obligations may not be successful. We publish privacy notices and other statements regarding data privacy and security. Regulators in the United States are increasingly scrutinizing these statements, and if any of our privacy notices or related materials or statements are found to be deficient, lacking in transparency, deceptive, unfair, misleading, or misrepresentative of our practices, we may be subject to investigation, enforcement actions by regulators or other adverse consequences.

Read in the 10-K filed Mar 31, 2026 ↗

Furthermore, our employees and personnel may use generative artificial intelligence (“AI”) technologies to perform their work, and the disclosure and use of personal data in such technologies is subject to various privacy laws and other privacy obligations. Governments have passed and are likely to pass additional laws and regulations regulating generative AI. Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and lawsuits. If we are unable to use AI technologies, it could make our business less efficient and result in competitive disadvantages.

Read in the 10-K filed Mar 31, 2026 ↗

Obligations related to data privacy and security (including individuals’ data privacy expectations) are quickly changing, becoming increasingly stringent, and creating uncertainty. Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent or conflict among jurisdictions. As a result, preparing for and complying with these obligations requires significant resources and may necessitate changes to our information technologies, systems and practices, as well as those of any third parties that process personal data on our behalf.

Read in the 10-K filed Mar 31, 2026 ↗

Although we endeavor to comply with our applicable privacy and security obligations, we may at times fail (or be perceived to have failed) to do so. Moreover, despite our efforts, we may not be successful in achieving compliance if our employees, third-party collaborators, service providers, contractors or consultants fail to comply with such obligations, which could negatively impact our business operations and compliance posture. If we or the third parties with whom we work fail, or are perceived to have failed, to address or comply with applicable obligations related to data privacy and security, we could face significant consequences including, but not limited to, government enforcement actions (e.g., investigations, fines, penalties, audits and inspections, and similar); litigation (including class-related claims) and mass arbitration demands; additional reporting requirements and/or oversight; temporary or permanent bans or restrictions on all or some processing of personal data; orders to destroy or not use personal data; and imprisonment of company officials. In particular, plaintiffs have become increasingly more active in bringing privacy-related claims against companies, including class claims and mass arbitration demands. Some of these claims allow for the recovery of statutory damages on a per violation basis, and, if viable, carry the potential for monumental statutory damages, depending on the volume of data and the number of violations. Any of these events could have a material adverse effect on our reputation, business, or financial condition, including but not limited to: interruptions or stoppages in our business operations (including clinical trials); inability to process personal data or to operate in certain jurisdictions; limited ability to develop or commercialize our products; expenditure of time and resources to defend any claim or inquiry; adverse publicity; or substantial changes to our business model or operations.

Read in the 10-K filed Mar 31, 2026 ↗

protection, privacy, intellectual property, and other laws), regulatory actions, and reputational harm.

Read in the 10-K filed Feb 24, 2026 ↗

Additionally, under the GDPR (and equivalent laws) and U.S. state privacy laws, health data belong to the category

Read in the 10-K filed Feb 24, 2026 ↗

In addition, Hubbell is increasingly evaluating, developing, or utilizing artificial intelligence (“AI”), including machine learning, automation, and data‑driven analytics technologies, whether internally, embedded in third‑party software products, or integrated into customer‑facing solutions. The use of AI technologies introduces additional risks related to system reliability, data integrity, transparency, governance, and security. AI‑enabled systems may also increase the Company’s exposure to cybersecurity, data privacy, and intellectual property risks.

Read in the 10-K filed Feb 12, 2026 ↗

or the security of our third-party service providers, could materially affect us due to the theft, destruction, loss, misappropriation or release of sensitive personal information, confidential information or proprietary information (including intellectual property), operational or business delays resulting from the disruption of our IT systems, extortion attempts, or negative publicity resulting in reputation or brand damage with our members, customers, providers, and other stakeholders.

Read in the 10-K filed Feb 19, 2026 ↗

impact our business. Unauthorized use or misuse of AI by the Company's employees, vendors or others may result in the disclosure of confidential Company or customer data, reputational harm, privacy law violations, cybersecurity risks, and legal liability. Additionally, while the use of AI can be beneficial to the Company, AI algorithms are currently known to sometimes produce unexpected results or behave in unpredictable ways that can generate, among other things, irrelevant, nonsensical, inaccurate, harmful, discriminatory or infringing results, which could harm the Company’s business, reputation, or result in legal or regulatory actions.

Read in the 10-K filed Feb 12, 2026 ↗

The Hyperliquid blockchain, exchange and related products launched in early 2023, and the HYPE token launched in November 2024. When we refer to HYPE, we are referring to HYPE tokens and liquid staking tokens derived from HYPE tokens (“LSTs”). We also hold other digital assets. Hyperliquid is an early-stage project with a limited operating history. Developers, validators, traders and market makers may not adopt Hyperliquid’s technology, and we believe that Hyperliquid’s adoption will likely depend on significant platform and product development and differentiation in a highly competitive market. A failure to scale, unexpected technical flaws, privacy issues or the lack of engagement could materially reduce demand for HYPE and adversely affect its value.

Read in the 10-K filed Mar 30, 2026 ↗

The secure processing, storage, maintenance and transmission of this critical information is vital to our operations and business strategy, and we devote significant resources to protecting such information. Although we take measures to protect sensitive information from unauthorized access or disclosure, our information technology and infrastructure may be vulnerable to attacks by hackers or viruses, breaches, interruptions due to employee error, malfeasance, faulty password management, lapses in compliance with privacy and

Read in the 10-K filed Mar 30, 2026 ↗

A significant IT disruption or breach of our systems or those of our third party providers could result in loss of confidential data, operational downtime, litigation, regulatory penalties, damages, reputational harm, and substantial remediation costs. Increased reliance on cloud computing, AI, and hybrid work arrangements adds complexity and risk, including through unauthorized access or disclosure of personal and proprietary information. Integration of acquired systems and divestitures also create transitional vulnerabilities. Privacy laws such as GDPR and CCPA that allow private actions increase our litigation exposure related to potential cyber incidents.

Read in the 10-K filed Feb 27, 2026 ↗

and employment, data privacy, tax, trade, competition and corruption and health care. There can be no assurance

Read in the 10-K filed Feb 27, 2026 ↗

Our global operations are subject to complex and evolving domestic and international data privacy laws and

Read in the 10-K filed Feb 27, 2026 ↗

China’s Personal Information Protection Law and comprehensive privacy laws in many U.S. states. These laws

Read in the 10-K filed Feb 27, 2026 ↗

impose a range of compliance obligations regarding the handling of personal data. There are significant penalties

Read in the 10-K filed Feb 27, 2026 ↗

This increasingly restrictive and evolving global regulatory environment related to data privacy and data protection

Read in the 10-K filed Feb 27, 2026 ↗

Additionally, regulatory bodies and others tasked with enforcing privacy and data protection laws have been actively

Read in the 10-K filed Feb 27, 2026 ↗

modify data processing practices and policies to comply with evolving privacy laws. Nevertheless, relevant

Read in the 10-K filed Feb 27, 2026 ↗

controls over personal data, the training of employees and vendors on data privacy and data security, and policies,

Read in the 10-K filed Feb 27, 2026 ↗

procedures and practices will prevent the improper handling of, disclosure of or access to personal data. Any such

Read in the 10-K filed Feb 27, 2026 ↗

unauthorized access, use or disclosure in violation of applicable privacy and data protection laws could cause

Read in the 10-K filed Feb 27, 2026 ↗

privacy. Changes in regulatory regimes, or the adoption of new or more restrictive requirements, could make it more

Read in the 10-K filed Feb 27, 2026 ↗

sophisticated. Additionally, the global regulatory environment surrounding information security, data privacy and data

Read in the 10-K filed Feb 27, 2026 ↗

The confidentiality, collection, use, retention, security, transfer and disclosure of personal information is subject to governmental regulation in the countries where the personal information was collected or processed.

Read in the 10-K filed Feb 17, 2026 ↗

Under most laws and regulations around the world, any information that relates to an identifiable natural person is considered “personal information”. In general, health information related to an identifiable person is considered “sensitive personal information” and is highly regulated. Processing health information carries additional obligations under these laws and regulations, often including the need to obtain the explicit consent of the individual for collection, use or disclosure of the information.

Read in the 10-K filed Feb 17, 2026 ↗

In many countries, there are restrictions related to the cross-border transfer of personal information to other countries, including the need to put measures in place to allow the data transfer to occur. For example, registration with the EU-US Data Protection Framework (DPF) allows the transfer of data from the EU to US. For companies not registering with the DPF, another means of legalizing the transfer is the use of standard contractual clauses. In addition, in several countries around the world there are requirements to maintain personal information or sensitive personal information within that particular country under their data localization laws.

Read in the 10-K filed Feb 17, 2026 ↗

The use of AI in our product initiatives and offerings or services, or in our internal business operations, may give rise to risks related to accuracy, bias, discrimination, intellectual property infringement, misappropriation or leakage of proprietary, confidential and personal information, defamation, data privacy, and cybersecurity. Any error, defect, or vulnerability in our AI-powered products or business processes could undermine the quality of our products and services, adversely impact our clients’ businesses, subject us or our clients to regulatory scrutiny, fines or litigation and cause reputational harm. We are exposed to similar risks in connection with the use of AI technology by our third-party vendors and clients.

Read in the 10-K filed Feb 12, 2026 ↗

Further, in the U.S., when HIPAA does not apply, according to the Federal Trade Commission (the “FTC”), violating consumers’ privacy rights or failing to take appropriate steps to keep consumers’ personal information secure may constitute

Read in the 10-K filed Feb 3, 2026 ↗

We operate in a rapidly evolving, technology-driven environment, and if we do not timely identify, prioritize, develop, and successfully integrate new or enhanced technologies into our operations, our service quality, efficiency, and competitiveness could suffer. Technology initiatives can be complex and costly, with risks of delays, defects, and training hurdles. Anticipated benefits from these initiatives may not be realized on the expected timeline or at all. In addition, competitors may introduce and scale new technologies more quickly or effectively than we do, which could diminish our competitive position, compress margins, and result in lost business opportunities. The rapid evolution and adoption of artificial intelligence(AI) and any efforts we may make to incorporate it into our business may amplify cyber, legal, and operational risks. AI adoption may introduce or amplify risks, including inaccurate or biased outputs that are difficult to detect, governance and model-risk challenges, privacy and intellectual property concerns, and evolving legal disclosure obligations. AI can also increase cybersecurity exposure as threat actors leverage AI to enhance social-engineering and intrusion techniques. Implementing and maintaining AI capabilities can be complex and costly, anticipated benefits may not be realized and expected timelines or at all, and failures could harm our operations, reputation, results of operations, and financial condition.

Read in the 10-K filed Feb 24, 2026 ↗

or other legal obligations or privacy and information security policies regarding such data, could result in litigation and/or regulatory activity and associated fines, damages, costs, awards, or settlements.

Read in the 10-K filed Nov 14, 2025 ↗

JPMorganChase’s businesses and operations are subject to applicable law globally related to the collection, use, sharing, storage and protection of personal information of individuals. Complying with these applicable laws could:

Read in the 10-K filed Feb 13, 2026 ↗

JPMorganChase could face legal proceedings, including governmental investigations or enforcement actions, if personal information is mishandled, including if unauthorized parties receive, intercept, or compromise it, if JPMorganChase fails or is perceived

Read in the 10-K filed Feb 13, 2026 ↗

•AI system failures, inappropriate use of AI systems, lack of transparency in AI systems, or inaccurate or biased output from AI systems resulting from rapid deployment, insufficient testing, erroneous data, ineffective model design or insufficient controls, which could disrupt operations, cause erroneous transactions, compromise data privacy, infringe on intellectual property, harm clients and customers, or impair JPMorganChase’s ability to make sound business decisions

Read in the 10-K filed Feb 13, 2026 ↗

We continue to evaluate and, where appropriate, integrate AI technologies into our product offerings and internal operations to enhance innovation, efficiency, and customer value. While AI presents opportunities for advancement, its adoption also introduces a range of risks that could adversely impact our business, financial condition, and results of operations. These risks include, but are not limited to, competitive disadvantages if peers more effectively leverage AI to accelerate innovation, product development, or operational performance. The use of AI may also expose us to legal, regulatory, and reputational risks, particularly in jurisdictions with evolving or inconsistent regulatory frameworks governing AI, data privacy, and cybersecurity. Additionally, the deployment of AI tools, whether by us or by customers using our AI-enabled solutions may result in unintended consequences such as biased or inaccurate outputs, loss or compromise of confidential information or intellectual property, and challenges in asserting or defending intellectual property rights. These risks may be amplified by increasing regulatory scrutiny and potential compliance obligations, which could result in increased costs or limitations on our ability to deploy AI technologies. There can be no assurance that our use of AI will yield the anticipated benefits or that we will be able to effectively mitigate the associated risks.

Read in the 10-K filed Dec 17, 2025 ↗

intelligence. See also “—Risks Related to Regulatory Matters—Privacy, data protection, cybersecurity and artificial intelligence

Read in the 10-K filed Feb 27, 2026 ↗

proprietary, sensitive and otherwise confidential information, including personal information of our investors, insurance

Read in the 10-K filed Feb 27, 2026 ↗

perceived inability, by us to adequately address privacy concerns, or comply with applicable privacy laws, regulations, policies,

Read in the 10-K filed Feb 27, 2026 ↗

industry standards and guidance, related contractual obligations, or other privacy legal obligations, even if unfounded, could

Read in the 10-K filed Feb 27, 2026 ↗

Privacy, data protection, cybersecurity and artificial intelligence laws may increase compliance costs

Read in the 10-K filed Feb 27, 2026 ↗

Data privacy, data protection and cybersecurity have become priorities for regulators around the world, and rapidly

Read in the 10-K filed Feb 27, 2026 ↗

federal and state privacy and data protection laws and regulations. For example, the California Consumer Privacy Act provides

Read in the 10-K filed Feb 27, 2026 ↗

violations. Other U.S. states have passed their own consumer privacy laws and other states are considering doing so. At the

Read in the 10-K filed Feb 27, 2026 ↗

S-P, which governs privacy notices and the safeguarding and disposal of customer information and establishes certain incident

Read in the 10-K filed Feb 27, 2026 ↗

Our insurance business processes sensitive personal information of policyholders, which exposes it to heightened privacy

Read in the 10-K filed Feb 27, 2026 ↗

We are also subject to non-U.S. privacy and data protection laws, including the European General Data Protection

Read in the 10-K filed Feb 27, 2026 ↗

Regulation, the Personal Information Protection Law of the People’s Republic of China, the India Digital Personal Data

Read in the 10-K filed Feb 27, 2026 ↗

us, our portfolio companies, or third-party service providers. In addition, we are often subject to privacy and data security

Read in the 10-K filed Feb 27, 2026 ↗

Failure to comply with applicable data privacy, data protection, cybersecurity, or artificial intelligence laws or related

Read in the 10-K filed Feb 27, 2026 ↗

relating to data privacy and cybersecurity matters have increased in recent years, and any significant enforcement action,

Read in the 10-K filed Feb 27, 2026 ↗

jurisdictions in which we operate, and privacy enforcement by governmental authorities globally, particularly on data localization requirements and international data flows, has increased in recent years.

Read in the 10-K filed Feb 20, 2026 ↗

In addition, access, disclosure or other loss of information or other consequences could result in legal claims or proceedings, liability under laws that protect the privacy of personal information or personally identifiable information, regulatory penalties for divulging or failing to adequately protect such information, disruption of Boardwalk Pipelines’ operations, incident response and remediation costs, damage to its reputation, and loss of confidence in its services.

Read in the 10-K filed Feb 10, 2026 ↗

As a government contractor and a provider of information technology services operating in multiple regulated industries and geographies, we and our service providers, suppliers and subcontractors collect, store, transmit, and otherwise process personal, confidential, proprietary, and sensitive information, including protected health information, personnel information, personal information, classified information, controlled unclassified information, intellectual property and financial information, concerning our business, employees, and customers. Therefore, we are continuously exposed to unauthorized attempts to compromise access, release or otherwise compromise such information through cyber-attacks and other

Read in the 10-K filed Feb 17, 2026 ↗

competitive position and business. Further, any output created by us using AI tools may not be subject to copyright protection, which may adversely affect our intellectual property rights in, or ability to commercialize or use, any such content. In the U.S., a number of civil lawsuits have been initiated related to the foregoing and other concerns, any one of which may, among other things, require us to limit the ways in which our AI systems are trained and may affect our ability to develop our AI-powered products and solutions. If we do not have sufficient rights to use the data or other material or content on which the AI tools we use rely, we also may incur liability through the violation of applicable laws and regulations, third-party intellectual property, data privacy, or other rights, or contracts to which we are a party.

Read in the 10-K filed Feb 17, 2026 ↗

The Company’s operations rely on the continued performance and security of its information technology systems. System failures, cybersecurity incidents, disruptions, or other issues affecting information technology systems could impair data processing, service delivery, billing, and customer communications. The Company also relies on third parties for critical services, including transportation, supplies, and data processing and expects them to comply with applicable laws and regulations, including environmental, health and safety, and privacy and data security laws. Failures by these providers, whether operational, legal, or cybersecurity-related, and issues affecting their information technology systems, could disrupt services, compromise personal or other confidential information, expose the Company to liability and could materially impact its business, even if the Company is not responsible for the underlying cause of any such failure or issue. In addition, the Company may be subject to regulatory, contractual, or other obligations arising from any such failure or issues. Despite contingency plans, risks remain, and a significant information technology system disruption could adversely affect the Company’s reputation, operations, financial condition, and profitability.

Read in the 10-K filed Feb 24, 2026 ↗

In the U.S., HIPAA imposes detailed requirements on the use, disclosure, and safeguarding of PHI. HIPAA violations can lead to significant civil and criminal penalties. HIPAA also provides individuals with certain privacy rights regarding their PHI

Read in the 10-K filed Feb 24, 2026 ↗

and requires the Company to notify individuals about its privacy practices. The Company has implemented policies to comply with HIPAA, but evolving regulations—including a proposed rule to clarify the HIPAA Security Rule—may increase compliance obligations. State laws, such as the CCPA and the Washington My Health My Data Act, impose additional requirements that may exceed requirements under HIPAA and other federal standards. The Company must also comply with restrictions on international data transfers imposed through standards such as the DOJ’s Data Security Program, and emerging laws regulating AI, algorithms, and automated processing, which may increase compliance costs.

Read in the 10-K filed Feb 24, 2026 ↗

Internationally, the Company is subject to data protection laws, such as the EU GDPR and the U.K. GDPR, which impose strict requirements and significant penalties for noncompliance. Similar laws have been enacted in other regions where the Company operates, including Asia, Latin America, and other parts of Europe.

Read in the 10-K filed Feb 24, 2026 ↗

Compliance with these complex and evolving regulations may require changes to the Company’s business practices and result in increased operational costs. Failure to comply could materially and adversely affect the Company’s business and reputation, result in the imposition of fines, penalties, or orders to stop certain activities, and potentially expose the Company to actions for the wrongful use or disclosure of personal information.

Read in the 10-K filed Feb 24, 2026 ↗

Our reputation and ability to do business may be impacted by the improper conduct of our employees, agents or business partners. We have implemented compliance controls, training, policies and procedures designed to ensure compliance with, and prevent and detect reckless or criminal acts from being committed by our employees, agents or business partners that would violate the laws of the jurisdictions in which we operate. Such laws include laws governing payments to government officials, the FCPA, export controls, such as ITAR and the EAR, false claims, procurement integrity, cost accounting and billing, competition, information security and data privacy and the terms of our contracts.

Read in the 10-K filed Feb 12, 2026 ↗

We cannot ensure, however, that our controls, training, policies and procedures will prevent or detect all such reckless or criminal acts, and we have been adversely impacted by such acts in the past. If not prevented, such acts could subject us to civil or criminal investigations, monetary and non-monetary penalties and suspension and debarment by the U.S. Government and could have a material adverse effect on our business, results of operations and reputation. In addition, misconduct involving data security lapses resulting in the compromise of personal information or the improper use of our customers’ sensitive or classified information could result in remediation costs, regulatory sanctions against us and serious harm to our reputation and could adversely impact our ability to continue to contract with the U.S. Government.

Read in the 10-K filed Feb 12, 2026 ↗

We may incorporate the use of AI into our business, operations and offerings in ways which present opportunities as well as challenges and risks, particularly as AI can produce hallucinations and AI agents may take undesired actions, if used.AI systems or input data issues could present inaccurate information, privacy, reputational and other issues and liability. A number of jurisdictions have implemented (or will implement) AI-related laws which may adversely effect our business. For example, the EU AI Act, which has extra-territorial effect like the GDPR, imposes penalties up to the greater of: (i) €35 million; or (ii) 7% of an entire group's total annual worldwide turnover.

Read in the 10-K filed Sep 28, 2026 ↗

Our use or future adoption of artificial intelligence in our business, which may include tools developed by third parties, could expose us to breach of a data or software license, website terms of service claims, claimed violations of privacy rights or other tort claims. Further, although we have taken measures to prohibit such use, our employees’ use of third-party or publicly available artificial intelligence or other software tools may inadvertently result in the disclosure of our intellectual property, proprietary information or other sensitive or confidential data into the public domain, which could expose us to legal liability, diminish the value of our intellectual property, weaken our competitive position and harm our reputation.

Read in the 10-K filed Aug 7, 2026 ↗

We are subject to an evolving cybersecurity, privacy, and AI regulatory environment, and failure to comply with new or existing requirements, including federal cybersecurity incident disclosure obligations, could result in regulatory enforcement and further financial or reputational harm. Emerging laws and regulations governing AI, including the European Union AI Act, China's generative AI regulations, and potential U.S. federal and state AI legislation, may impose new compliance obligations, restrict certain uses of AI technology, or require transparency regarding AI-driven decision-making. Data localization and sovereignty requirements in certain jurisdictions may require us to store and process data locally, increasing operational complexity and costs. Sovereign AI initiatives, under which governments require AI systems to be developed, trained, or operated within national borders using local data, could limit our ability to deploy centralized AI tools globally and may require significant investment in region-specific infrastructure. Our cybersecurity insurance may not cover all losses or liabilities related to cyberattacks. Furthermore, a sophisticated attack could persist undetected within our systems for an extended period before being discovered, potentially amplifying its impact.

Read in the 10-K filed Mar 17, 2026 ↗

resulting from legal proceedings or investigations) related to the Data Security Incident, and certain expenses by their nature (such as, for example, expenses related to enhancing our data privacy and information security programs) are not covered by our insurance program.

Read in the 10-K filed Feb 10, 2026 ↗

•impact of evolving risks related to artificial intelligence, cybersecurity and data privacy across our products, operations, regulatory compliance, intellectual property, talent, and transactions;

Read in the 10-K filed May 21, 2026 ↗

We face significant and evolving risks related to AI across our products, operations, cybersecurity, regulatory compliance, intellectual property, confidential information, privacy, workforce, customer transactions, and customer demand, any of which could adversely affect our business, results of operations, financial condition and reputation.

Read in the 10-K filed May 21, 2026 ↗

In recent years, there has been an increased focus on corporate responsibility matters, including greenhouse gas emissions and climate-related risks, renewable energy, water stewardship, waste management, data privacy, cybersecurity, trade controls, responsible sourcing and supply chain, use of products for illegal or unethical purposes, human rights, and

Read in the 10-K filed May 21, 2026 ↗

There also is the threat of consumer class actions related to these laws and the overall protection of personal data. Even if we are not determined to have violated these laws, government investigations into these issues typically require the expenditure of significant resources and generate negative publicity, which could harm our reputation and our business.

Read in the 10-K filed Jan 22, 2026 ↗

•delays or defects in information technology integration, cybersecurity controls, or data privacy compliance can disrupt operations, increase costs, or expose us to cyber incidents;

Read in the 10-K filed Feb 19, 2026 ↗

Artificial intelligence (AI) technologies support a range of the Company’s activities, including research and development, operational processes, customer facing tools, and other business functions. The use of AI introduces risks that could adversely affect the Company’s business, results of operations, or financial condition. AI systems may produce inaccurate, biased, or incomplete outputs, which could lead to operational errors, reduced product or service quality, or unintentional impacts on business decisions. External vendors and third party AI tools may expose the Company to additional risks, including insufficient transparency into model performance, vulnerabilities in underlying technologies, or disruptions in service availability. AI development and deployment also require security, and proper governance of the data used. Use of AI tools, including third party platforms, increases the risk of unauthorized disclosure, loss, or misuse of confidential, personal, or commercially sensitive information. In addition, there is a risk that employees or contractors could inadvertently input confidential company information or third party proprietary data into AI systems, including systems not designed for secure handling of such information. These actions could result in violations of contractual obligations, data protection requirements, or intellectual property rights, and could expose the Company to legal, regulatory, or reputational harm. Emerging and evolving regulations related to AI use, transparency, safety, and accountability may require additional investment, changes to existing processes, or limitations on the development and application of these technologies. Rapid advances in AI may also create competitive pressures or require ongoing investment to maintain effectiveness, and failures to manage, govern, or deploy AI responsibly could impair the Company’s ability to achieve expected efficiencies or strategic objectives. While the Company will seek to develop and use artificial intelligence responsibly, and will attempt to identify and mitigate ethical, privacy, legal or other issues presented by its use, there can be no assurance that the Company will be fully successful in doing so, and may be subject to data breaches, allegations of unauthorized access to, or use of, third party data, information, or intellectual property rights, or other risks, which may lead to financial losses, legal liability, regulatory scrutiny and reputational damage.

Read in the 10-K filed Feb 3, 2026 ↗

We rely on artificial intelligence (“AI”) technologies to support and enhance various aspects of our products, services, and internal operations. These systems may not perform as intended and expose us to risks. In particular, AI models can generate inaccurate, biased, or unpredictable outputs, and failures in data quality, system design, or oversight could result in operational disruptions, security or privacy incidents, reputational challenges, and other harms. Because AI systems can be complex and difficult to fully evaluate or

Read in the 10-K filed Feb 27, 2026 ↗

are being considered by various U.S. states. These laws and regulations impose operational requirements, including disclosures to consumers about personal data practices, opt-out and consent choices and required contractual terms with certain third parties, as well as obligations to provide notice to individuals, third parties, and/or regulators in the event of certain cybersecurity incidents involving personal data. In China, for instance, the Personal Information Protection Law also imposes requirements on the collection, use, and cross-border transfer of personal information, and noncompliance may result in penalties and operational restrictions.

Read in the 10-K filed Feb 27, 2026 ↗

In the United States, at the federal level, failing to take appropriate steps to keep consumers’ personal information secure may constitute unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act. In addition, numerous states have introduced comprehensive laws which govern the privacy and security of personal information. For example, California has passed the CCPA and more than a dozen other states have passed their own similar comprehensive consumer privacy laws. Other states proposed or passed laws that target particular aspects of privacy, including health, genetic and biometric information, which could have particular impact for our business. For example, Washington passed a law that protects the privacy of consumer health-related information that is not covered by HIPAA and includes a private right of action. In addition, state laws such as the Texas Genomic Privacy Act and others focus specifically on genetic information and could materially impact our business.

Read in the 10-K filed Feb 20, 2026 ↗

Regulators and legislators are also increasingly scrutinizing and restricting certain personal data transfers and transactions involving foreign countries. For example, the Department of Justice’s January 8, 2025, rule on “Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons,” prohibits data brokerage transactions involving certain sensitive personal data categories, including health data, genetic data, and biospecimens, to countries of concern, including China. The regulations also restrict certain investment agreements, employment agreements and vendor agreements involving such data and countries of concern, absent specified cybersecurity controls. Actual or alleged violations of these rules may be punishable by criminal and/or civil sanctions, result in exclusion from participation in federal and state programs or restrict our ability to use certain vendors, sites, investigators, or service providers in global clinical trials.

Read in the 10-K filed Feb 20, 2026 ↗

The integration of AI Technologies into our and our vendors’ systems (potentially without the vendor disclosing such use to us) subjects us to the risk that the providers of AI Technologies may not meet existing or evolving legal, regulatory or industry standards relating to privacy, data protection, cybersecurity, intellectual property, product safety, human oversight, or algorithmic accountability. Compliance with these requirements may require substantial investments in governance, documentation, monitoring, testing, or operational controls, and may limit our ability to deploy or scale certain AI-enabled tools or features.

Read in the 10-K filed Feb 20, 2026 ↗

In addition, bad actors globally use increasingly sophisticated methods, including AI Technologies, to engage in illegal activities involving the theft and misuse of personal information, confidential information and intellectual property. The use of GenAI models in our internal or third-party systems may create new attack surfaces or methods for adversaries, which could impact us and our vendors. These factors may lead to breaches of security or privacy, reduced system performance or availability, loss of intellectual property, unauthorized disclosure of confidential or proprietary information. Sophisticated cyber-attacks, including those leveraging AI, could exacerbate these risks.

Read in the 10-K filed Feb 20, 2026 ↗

manner inconsistent with our responsible AI policies and practices. These outcomes may give rise to public controversy, societal concerns, or regulatory actions relating to human rights, privacy, employment, or other social, economic, or political issues, and could adversely affect our reputation, competitive position, business, financial condition, and results of operations.

Read in the 10-K filed Jul 29, 2026 ↗

In addition to the provisions in certain international laws restricting the transfer of personal information to the United States, a new U.S. law also restricts the transfer of certain kinds of personal data in certain situations outside of the United States to “countries of concern,” including but not limited to China. On April 8, 2025, the U.S. Department of Justice’s National Security Division implemented the Data Security Program Rule under Executive Order 14117 and the International Emergency Economic Powers Act. This rule establishes restrictions on certain data-related transactions involving U.S. persons and entities, particularly those that may result in access to U.S. government-related data or bulk sensitive personal data of U.S. persons by foreign adversaries or entities under their control. The rule effectively imposes export control-like restrictions on the transfer, sale, or sharing of sensitive data-including genomic, geolocation, biometric, health, financial, and other personal data-to or with entities in countries of concern, as well as entities and persons associated with those countries. It also imposes additional due diligence obligations on U.S. companies concerning personal data they collect, store, or transmit. Failure to comply with the Data Security Program Rule could result in civil or criminal penalties, reputational harm, and restrictions on our ability to engage in certain business activities. Compliance may require us to modify our data handling practices, implement new controls, or terminate existing relationships with certain foreign vendors, customers, or partners. These changes could increase our operational costs, limit our market opportunities, and adversely affect our financial performance. Additionally, the scope and interpretation of the rule may evolve, and future guidance or enforcement actions could impose further obligations or restrictions.

Read in the 10-K filed Feb 19, 2026 ↗

Additionally, AI algorithms or training methodologies may be flawed, and datasets may contain irrelevant, insufficient, or biased information, which can cause errors in outputs. Failures to develop, deploy, or use AI technologies in a safe, responsible, and effective manner, whether by us, our customers, suppliers, partners, or third-party AI providers, could result in product quality issues, operational disruptions, legal liability, regulatory scrutiny, or reputational harm. We manage AI-related risks through our existing cybersecurity, privacy, legal, compliance, information governance, and enterprise risk management processes. However, these processes may not identify or mitigate all risks associated with evolving AI technologies, regulations, and industry practices.

Read in the 10-K filed Oct 9, 2026 ↗

We provide sponsors with data that identifies which institutional players are researching Bitcoin infrastructure. Stricter enforcement of GDPR or the UK Data Protection Act specifically regarding financial/crypto interest data could limit our ability to monetize our audience. If generative AI models can effectively aggregate and synthesize specialist Bitcoin technical knowledge, the scarcity value of our intellectual property may be impaired.

Read in the 10-K filed Mar 30, 2026 ↗

BTC Inc publishes news, opinions, analysis, and commentary about individuals, companies, projects, and developments in the Bitcoin and digital asset industry. This industry is characterized by intense competition, disputed claims, controversial personalities, and significant financial stakes, which increases the likelihood that subjects of our coverage may take issue with our reporting. We may face claims of defamation, libel, invasion of privacy, misappropriation, or other content-related torts from individuals or entities who believe they have been harmed by our coverage. Even if such claims are without merit, defending against them can be expensive, time-consuming, and distracting to management. Adverse judgments or settlements could result in significant monetary damages and injunctive relief that restricts our ability to report on certain topics or individuals. Additionally, the threat of litigation may cause us to exercise excessive caution in our reporting, which could diminish the value and relevance of our editorial content. Our media liability insurance may not cover all claims or may be insufficient to cover the full extent of any damages awarded. Any of these outcomes could have a material adverse effect on our business, financial condition, and reputation.

Read in the 10-K filed Mar 30, 2026 ↗

Security Incidents or loss of private keys could result in partial or total loss of our Bitcoin or loss, unavailability, destruction, alteration, prevention of access to, disclosure, or dissemination of, or damage or unauthorized access to, our data (including trade secrets or other confidential information, intellectual property, proprietary business information, and personal information) or data that is processed or maintained on our behalf, or other assets, which could result in financial, legal, business, and reputational harm to us.

Read in the 10-K filed Mar 30, 2026 ↗

Substantially all of our Bitcoin is held in custody accounts at institutional-grade digital asset custodians. Bitcoin and blockchain-based cryptocurrencies have been, and may continue to be, subject to Security Incidents and other malicious activities. While we have implemented security measures designed to protect against actual or reasonably suspected unauthorized access to, or use, acquisition, exfiltration, disclosure, alteration, loss, destruction, encryption, or other compromise of personal data, confidential information, or the confidentiality, integrity, or availability of our information technology systems, whether by external actors, insiders, or accidental events (collectively, “Security Incident(s)”), there can be no assurance that these measures will be effective in all circumstances. A successful Security Incident could result in: partial or total loss of our Bitcoin that may not be covered by insurance or custodial liability provisions; harm to our reputation and brand; improper disclosure of our and our customers’ data and violations of applicable data privacy laws; and significant regulatory scrutiny, investigations, fines, penalties, and other legal and financial exposure.

Read in the 10-K filed Mar 30, 2026 ↗

We are subject to HIPAA and other federal, state, and foreign data privacy and security laws, and failure to comply could result in significant liability and reputational harm.

Read in the 10-K filed Mar 30, 2026 ↗

We collect substantial amounts of personal health information subject to HIPAA and numerous other federal, state, and foreign data privacy and security laws. HIPAA establishes national privacy and security standards for the protection of protected health information (PHI) by covered entities and business associates. As a business associate under HIPAA, we are required to develop and maintain policies and procedures with respect to PHI, including administrative, physical, and technical safeguards. Violations of HIPAA may result in significant civil and criminal penalties, and state attorneys general may file suit on behalf of their residents. We are also subject to breach notification requirements under HIPAA, which require notification to affected individuals, HHS, and potentially the media depending on the scope of the breach.

Read in the 10-K filed Mar 30, 2026 ↗

There is also a risk that the third-party vendors that provide our data sets may fail to properly de-identify PHI under HIPAA or applicable state laws, some of which impose different standards for de-identification than those imposed by HIPAA. There is also a risk that clients and third-party vendors who are subject to HIPAA and interface with us may misunderstand the limits of our ability to conform to HIPAA, given our posture that we remain outside of the HIPAA regulation by virtue of de-identifying our data, and may inadvertently expose us to PHI that we need to then make efforts to excise from our systems. We are also required to ensure that such information remains de-identified, and our failure to do so could result in non-compliance with privacy laws and contractual obligations.

Read in the 10-K filed Mar 30, 2026 ↗

In addition to HIPAA, we are subject to the Federal Substance Abuse Confidentiality Regulations (42 C.F.R. Part 2), which impose confidentiality requirements on substance use disorder treatment records. Numerous other federal, state, and foreign laws protect the privacy, security, and integrity of health-related and personal information, many of which are more restrictive than HIPAA. These laws are subject to evolving interpretations and new regulations, and failure to comply could result in significant liabilities, government enforcement actions, and reputational harm. State attorneys general and the FTC actively enforce privacy requirements, and healthcare providers are also subject to information blocking prohibitions under the 21st Century Cures Act, with penalties up to $1,000,000 per violation.

Read in the 10-K filed Mar 30, 2026 ↗

We are subject to stringent and evolving U.S. and foreign data privacy and security laws, and failure to comply could result in regulatory investigations or actions; litigation (including class actions and mass arbitrations); fines and penalties; operational disruptions; reputational harm; loss of revenue or profits; and other significant adverse consequences.

Read in the 10-K filed Mar 30, 2026 ↗

In the ordinary course of business, we collect, receive, store, process, generate, use, transfer, disclose, and otherwise handle personal data and other sensitive information, including PHI in connection with aspects of our healthcare operations. Our privacy and data security obligations include numerous federal, state, and foreign data privacy and security laws, including data breach notification laws, consumer protection laws, and comprehensive state privacy laws. These laws impose obligations including specific privacy notice disclosures, data subject rights (such as access, correction, and deletion rights), opt-out mechanisms for targeted advertising and profiling, and requirements for data privacy impact assessments. Complying with these obligations requires us to devote significant resources, which may necessitate changes to our services, information technologies, systems, and practices and to those of any third parties that process sensitive data on our behalf.

Read in the 10-K filed Mar 30, 2026 ↗

The regulatory landscape is constantly evolving and may be interpreted or applied in ways that harm our business. New or emerging regulatory frameworks addressing technologies such as AI, biometric data, or advanced analytics may further increase compliance complexity or restrict certain business practices. In addition, these laws, regulations, and other obligations may also be interpreted and applied inconsistently from jurisdiction to jurisdiction. Evolving enforcement priorities increase our risk profile. Federal and state regulators, including the FTC and state attorneys general, have pursued enforcement actions related to privacy disclosures, tracking technologies, sensitive data uses, security practices, breach response, and health-related data handled outside traditional HIPAA contexts. Adverse enforcement or private litigation outcomes could be material.

Read in the 10-K filed Mar 30, 2026 ↗

Certain of our websites and digital properties use advertising and analytics technologies (for example, cookies, pixels, tags, software development kits, and similar tools) that enable interest-based advertising and measurement. The deployment of these technologies has been the subject of increasing private litigation, including putative class actions and mass arbitrations alleging unauthorized disclosures or interception of communications, as well as claims under common-law privacy, wiretap, video privacy, and private nuisance theories. If our use of such technologies, or that of our service providers or partners, is found to be inconsistent with applicable laws, consents, or public statements, we could face injunctive relief, statutory damages, significant defense costs, and requirements to modify or discontinue certain practices.

Read in the 10-K filed Mar 30, 2026 ↗

Despite the security measures we implement, we have experienced, and expect to continue to experience, attempts to compromise our systems and those of our third parties. A Security Incident could result in unauthorized access to or loss of personal data, PHI, confidential information, or digital assets; service interruptions; theft or fraud; and other harm. We could incur substantial investigation, notification, remediation, and litigation costs; face regulatory inquiries and enforcement; suffer reputational damage; and experience revenue or client losses. The occurrence, frequency, and impact of these incidents are difficult to predict, and our insurance coverage may be inadequate to compensate for all losses.

Read in the 10-K filed Mar 30, 2026 ↗

We may at times fail (or be perceived to have failed) in our efforts to comply with our data privacy and security obligations. Moreover, despite our efforts, our personnel or third parties upon which we rely may fail to comply with such obligations, which could negatively impact our business operations. If we or the third parties with whom we work fail, or are perceived to have failed, to address or comply with applicable data privacy and security obligations, we could face significant consequences, including but not limited to: government enforcement actions (e.g., investigations, fines (including regulatory fines and sanctions), penalties, audits, inspections, and similar); litigation (including class-action claims and mass arbitration demands); additional reporting requirements and/or oversight; bans on processing personal data; and orders to destroy or not use personal data. Any of these events could have a material adverse effect on our reputation, business, or financial condition.

Read in the 10-K filed Mar 30, 2026 ↗

The introduction of artificial intelligence ("AI") and machine-learning technologies, particularly generative AI, into internal processes, third-party services and/or new and existing offerings may result in new or expanded risks and liabilities, including due to enhanced governmental or regulatory scrutiny, litigation, compliance issues, ethical concerns, confidentiality or security risks, as well as other factors that could adversely affect our business, reputation and financial results. In addition, our personnel could, unbeknownst to us, improperly utilize AI and machine learning-technology while carrying out their responsibilities. The use of AI in third-party services and the development of our products and services could also cause loss of intellectual property, as well as subject us to risks related to intellectual property infringement or misappropriation, data privacy and cybersecurity. The use of artificial intelligence can lead to unintended consequences, including generating content that appears correct but is factually inaccurate, misleading or otherwise flawed, or that results in unintended biases and discriminatory outcomes, which could harm our reputation and business and expose us to risks related to inaccuracies or errors in the output of such technologies.

Read in the 10-K filed Dec 17, 2025 ↗

NEE and FPL use AI technologies in various aspects of their operations, including, without limitation, financial analysis, strategic planning, field work intelligence, work scheduling, grid optimization, energy forecasting, customer service and operations management. The use of and reliance on AI may present certain risks such as, but not limited to, AI tools may malfunction, produce inaccurate or biased outputs, or behave unpredictably, and introduce NEE and FPL to additional cybersecurity threats and data privacy risks. In addition, as NEE and FPL rely on third-party vendors for certain AI tools, platforms and collaborations, NEE and FPL could experience third-party vendor issues such as disruptions in vendor relationships, performance issues, cybersecurity threats or disputes over intellectual property rights. Further, the regulatory environment governing AI is also evolving, and future legislation or agency rulemaking may impose new compliance obligations or restrict certain AI applications, increasing costs to comply with such requirements and failure to do so could result in regulatory enforcement, penalties or reputational harm. While AI technologies offer the potential to enhance operational efficiency, accelerate growth and lower costs, these benefits may not be realized and the use of and reliance on AI may present certain risks, both of which could materially adversely affect NEE’s and FPL’s business, financial condition, results of operations and prospects.

Read in the 10-K filed Feb 13, 2026 ↗

require ongoing monitoring and updating as technologies change and efforts to overcome security measures become more sophisticated, and may limit the functionality of or otherwise negatively impact our service offering and systems. Any significant disruption to our service or access to our systems could result in a loss of members, damage our reputation, and adversely affect our business and results of operations. Further, a penetration of our systems or a third-party’s systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition and results of operations.

Read in the 10-K filed Jan 23, 2026 ↗

Moreover, as we develop, deploy and integrate AI, including internally developed and third-party AI tools, into our operations, digital platforms and business processes, we may face increased cybersecurity, privacy, data governance, operational and compliance risks, including risks related to unauthorized use or misuse of AI tools, data loss or unauthorized access to or disclosure of personal, confidential or proprietary information, inaccurate, biased or unintended outputs, including in certain employment-related uses, system vulnerabilities and rapidly evolving laws, regulations and standards relating to AI, privacy, cybersecurity and data use. In addition, threat actors may use AI to increase the speed, scale and sophistication of cyberattacks, including phishing, impersonation, credential theft, exploitation of known or previously unknown software vulnerabilities and other automated, targeted or coordinated attacks against our systems or those of our vendors and other third parties.

Read in the 10-K filed Jul 15, 2026 ↗

cybersecurity threats and also may suffer cybersecurity incidents or other security breaches. Our ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place. In addition, supply-chain attacks have increased in frequency and severity, and third parties’ infrastructure in our supply chain or our third-party partners’ supply chains may become compromised. A cybersecurity incident at a third-party service provider could result in unauthorized access to or disclosure of personal data for which NetApp has protection obligations, potentially triggering breach notification requirements across multiple jurisdictions and exposing NetApp to regulatory enforcement actions, fines, and litigation.

Read in the 10-K filed Jun 5, 2026 ↗

Further, we also rely on innovation in our IT and our use of or inability to adopt and deliver new technological capabilities and enhancements in line with strategic objectives, including artificial intelligence and machine learning, may put us at a competitive disadvantage (including delayed implementation and utilization that causes us to lag behind our competitors); cause us to miss opportunities to innovate or achieve efficiencies; or adversely impact our business, reputation, results of operations, and financial condition. The use of emerging technologies, including artificial intelligence, entails risks including risks relating to the possibility of intellectual property infringement or misappropriation; data privacy; potential for inaccuracy; bias; new or enhanced governmental or regulatory scrutiny, requirements, litigation, or other liability; ethical concerns; negative perceptions as to automation and artificial intelligence; cybersecurity concerns; or other complications or liabilities that could adversely affect our business, reputation, results of operations, or financial results.

Read in the 10-K filed Feb 25, 2026 ↗

If we fail to keep pace with technological developments, or if competitors or new market entrants adopt new technologies more quickly or effectively, or if our clients develop their own AI-related capabilities, our services could become less attractive to clients, our competitive position could be harmed, and our revenues and profitability could decline. In addition, the use of emerging technologies presents risks related to intellectual property, ethics, data privacy, cybersecurity and regulatory compliance. Any failure to address these risks effectively could adversely affect our reputation, client relationships, business results of operations and financial condition.

Read in the 10-K filed Feb 20, 2026 ↗

Regulators and legislators in the European Union, the United Kingdom, and the United States have increasingly focused on the use of online tracking technologies and the sharing of personal information with third parties for targeted or behavioral advertising. This has resulted in new or updated requirements under the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other U.S. state privacy laws. If these laws or regulations are adopted, interpreted, or enforced in a manner that restricts our current practices, or if private market participants impose limitations on tracking technologies in response to privacy concerns, our digital services could become less effective, more costly to deliver, or subject to additional legal and operational constraints.

Read in the 10-K filed Feb 20, 2026 ↗

We are increasingly incorporating AI tools and capabilities into our business operations where we believe appropriate, which may subject us to significant competitive, legal, regulatory and other risks. There can be no assurance that our use of AI tools will enhance our business operations or result in a benefit to us. Our competitors may be more successful in their use of AI tools, including by developing superior products or improving their operations with the assistance of AI. Additionally, there could be adverse impacts from inaccurate or flawed algorithms. Our use of AI tools could also result in the loss of confidential information or intellectual property or an inability to claim or enforce intellectual property rights, as well as subject us to risks related to intellectual property infringement or misappropriation, data privacy, cybersecurity, and the unauthorized use of Company data. The jurisdictions in which we conduct business have and may adopt laws and regulations related to AI, which could cause us to incur greater compliance costs, limit our use of AI tools, or subject us to legal liabilities.

Read in the 10-K filed Feb 9, 2026 ↗

•introduction of additional compliance obligations or new risks, including with respect to increased privacy and data collection concerns, content moderation and censorship, and system outages;

Read in the 10-K filed Jun 22, 2026 ↗

Vulnerabilities within our AI systems may be identified by researchers or malicious actors before we detect or remediate them, which could result in security incidents, data privacy issues, reputational damage, or loss of customer confidence. Advances in AI have also increased the speed, scale, and sophistication of cybersecurity threat activity, including reducing the time between vulnerability discovery and exploitation. To the extent customers, investors, or other market participants perceive that AI can automate or commoditize aspects of cybersecurity functions, the perceived value of certain cybersecurity solutions could diminish, and customer buying patterns, competitive dynamics, and demand for our products, subscriptions, and support offerings could be adversely affected. Investor and market perceptions regarding AI-related disruption to the cybersecurity industry could adversely affect our business and operating results, or the trading price of our common stock, even if these perceptions do not reflect actual changes in our business, customer demand, competitive positions, or financial performance.

Read in the 10-K filed Sep 10, 2026 ↗

We are also subject to federal, state, provincial, and foreign laws regarding cybersecurity and the protection of our systems and confidential information. Many jurisdictions have enacted laws, such as the GDPR and the E.U. Network and Information Systems Directive II, requiring companies to adopt cybersecurity risk management measures and notify regulators (and individuals) of data breaches or cybersecurity incidents. If our data security measures fail to adequately protect our systems or confidential information, we could be liable to both our customers and their users for

Read in the 10-K filed Sep 10, 2026 ↗

Additional legislative or regulatory action in the United States and globally could further regulate our collection, use, sharing and other processing of personal data. Evolving privacy laws may raise compliance costs and increase reputational and regulatory risks.

Read in the 10-K filed Feb 18, 2026 ↗

networks and systems and the integrity, availability, security, or privacy of PMI data processed by or through such systems. The emergence of AI and other technologies may also exacerbate other risks, including those related to regulation, litigation, compliance issues, ethical concerns, confidentiality, intellectual property ownership and infringement, and data privacy or security. Separately, AI presents a new attack surface that cybercriminals will attempt to exploit as well as providing means to scale and automate targeted attacks. Ineffective or inadequate artificial intelligence development, adoption, or deployment practices, including any use, reliance, or dependence on AI generated outputs, could result in unintended, unexpected, or otherwise unforeseen adverse consequences. These risks could have a material adverse effect on our business, reputation, financial condition, or operating results.

Read in the 10-K filed Feb 6, 2026 ↗

Artificial intelligence (“AI”) and machine-learning technology continue to advance rapidly, presenting both opportunities and risks. If we cannot incorporate these rapidly advancing technologies as quickly or effectively as other companies, our competitive position and business results may suffer. Incorporation of these new technologies into our processes may result in new or expanded risks, including risks related to regulatory compliance, litigation, ethical concerns, confidentiality or cybersecurity, among other factors that could potentially adversely impact our business, reputation and financial results. The use of AI in the development of our products and services could increase the risk of loss or theft of our intellectual property and could subject us to incremental risks related to data privacy and cybersecurity. The use of AI can lead to unintended consequences, including generating content that appears correct but is factually inaccurate, misleading or otherwise flawed, or that results in unintended biases and discriminatory outcomes, which could harm our stakeholders, our reputation and our business. Additionally, we face risks of competitive disadvantage if our competitors are able to more effectively use AI to create products or services at a lower cost or higher quality compared to PPG’s competing products or services.

Read in the 10-K filed Feb 19, 2026 ↗

Furthermore, there has been increased scrutiny as well as enacted and proposed additional laws and regulations, including from state regulators, regarding the use of personal and confidential information. These laws and regulations are increasing in complexity and number, change frequently, and may be subject to interpretation by different regulators and courts. See “Business—Regulation—Privacy and Cybersecurity Regulation” for a discussion of the applicable laws and regulations (including those requiring notice, disclosure or remediation) relating to cybersecurity events.

Read in the 10-K filed Feb 12, 2026 ↗

AI technologies also may expose us to legal, regulatory, cybersecurity, privacy, intellectual property, operational and reputational risks. AI algorithms, models or training methodologies may be flawed, and datasets or outputs may be inaccurate, insufficient, biased, misleading or otherwise controversial. Our use of AI tools in our internal operations, or the use of AI-enabled products, tools or technologies by our customers, developers, vendors or other third parties, may result in inadvertent disclosure or misuse of confidential, proprietary, personal or competitively sensitive information, reliance on inaccurate or flawed outputs, cybersecurity or privacy incidents, claims of infringement or misuse of data, regulatory scrutiny, litigation or use that is inconsistent with our expectations, policies, controls or applicable laws and regulations.

Read in the 10-K filed Nov 4, 2026 ↗

evolving, both in the U.S. and internationally, and includes regulatory schemes targeted specifically at AI as well as new and existing provisions in intellectual property, privacy, cybersecurity, consumer protection, employment and other laws applicable to the use of AI and changes in interpretation of the foregoing. These evolving laws and regulations could require changes in our implementation of AI technology and increase our compliance costs and the risk of non-compliance. AI models, particularly generative AI models, may, and often do, produce output or take action that is incorrect, that result in the release of personal, confidential or proprietary information, that reflect or introduce discrimination, errors or biases included in the data on which they are trained or prompts or algorithms on which they rely, that infringe on the intellectual property rights of others or that is otherwise harmful. In addition, the complexity of many AI models makes it challenging to understand why they are generating particular outputs. This limited transparency increases the challenges associated with assessing the proper operation of AI models, understanding and monitoring the capabilities of the AI models, reducing erroneous output, eliminating bias and complying with applicable laws and regulations, including those that require documentation or explanation of the basis on which decisions are made. Additionally, if we do not have sufficient rights to use AI models, the data on which they are trained or prompts or algorithms on which they rely or the output thereof, we could also incur liability through the violation of applicable laws and regulations, third-party intellectual property, privacy or other rights or contracts to which we are a party.

Read in the 10-K filed Feb 24, 2026 ↗

We are increasingly evaluating and deploying AI technologies, including generative AI and machine learning, across various aspects of our business. AI presents evolving risks that may be difficult to predict or mitigate. These risks include heightened data privacy, cybersecurity, and data protection risks, as the use of AI may involve processing sensitive data and, in some cases, sharing data with third-party providers. Such use may increase the risk of unauthorized access to, misuse, or disclosure of confidential information or personal data, introduce system vulnerabilities, and enable more sophisticated fraud and cyber-attacks. Any such event could result in operational disruptions, remediation costs, litigation, regulatory scrutiny, and reputational damage.

Read in the 10-K filed May 21, 2026 ↗

As global standards and regulations relating to AI increase and change, it could result in additional costs, reputational harm, legal liability, and regulatory scrutiny related to our use of AI. Additionally, misuse of sensitive data used in AI models may lead to privacy violations or non-compliance with data protection laws.

Read in the 10-K filed Nov 12, 2025 ↗

We rely on third-party AI platforms and services, including proprietary and open-source large language models and other AI technologies provided by companies such as OpenAI, Anthropic, Google, and Microsoft. These providers may change their terms of service, increase pricing, discontinue services, experience outages, decline to provide certain indemnities, or make changes to their AI models that adversely affect our products or operations. As AI becomes more central to our offerings, our exposure to pricing changes from these providers increases, and we may not be able to pass such cost increases on to our customers. We have limited control over these third-party AI systems and their updates, and any disruption in access to these services could have a significant impact on our business. The use of AI applications may result in cybersecurity incidents that implicate the personal data of end users of such applications. Any such cybersecurity incidents related to our use of AI applications could adversely affect our reputation and results of operations. AI also presents emerging ethical issues, and if our use of AI becomes controversial, we may experience brand, reputational, or competitive harm, or legal liability.

Read in the 10-K filed Feb 24, 2026 ↗

We are advancing AI across our product and service offerings, and we are in the initial phases of expanding AI into the core functions of our business. The development and deployment of AI presents both risks and opportunities, and the implementation process could adversely impact the operations of our business as a whole. AI algorithms utilized in the deployment may be flawed or based on datasets that are biased or insufficient, and do not adequately take into account the underlying nature of our business. Failure to adequately train our employees during the deployment of AI could adversely impact our business or result in delays or errors in our offerings. Our competitiveness could also be negatively impacted by our failure to timely develop or deploy AI in our products and services, particularly if our competitors are successful in AI advancements in their products and services. The development of AI technology will require significant investment in resources and human capital and could increase our costs. There is uncertainty related to the legal and regulatory landscape surrounding rapidly evolving AI technologies, particularly in the areas of cybersecurity, intellectual property, and privacy and data protection. Failure to comply or appropriately respond to this developing landscape may result in increased legal liability, adverse regulatory action, or reputational damage.

Read in the 10-K filed Feb 24, 2026 ↗

a partial or total loss of our ETH and ETH-related digital assets in a manner that may not be covered by insurance or the liability provisions of the custody agreements with the custodians who hold our ETH and ETH-related digital assets; harm to our reputation and brand; improper disclosure of data and violations of applicable data privacy and other laws; or significant regulatory scrutiny, investigations, fines, penalties, and other legal, regulatory, contractual and financial exposure.

Read in the 10-K filed Mar 9, 2026 ↗

Attacks upon systems across a variety of industries, including industries related to ETH, are increasing in frequency, persistence, and sophistication, and, in many cases, are being conducted by sophisticated, well-funded and organized groups and individuals, including state actors. The techniques used to obtain unauthorized, improper or illegal access to systems and information (including personal data and digital assets), disable or degrade services, or sabotage systems are constantly evolving, may be difficult to detect quickly, and often are not recognized or detected until after they have been launched against a target. These attacks may occur on our systems or those of our third-party service providers or partners. We may experience breaches of our security measures due to human error, malfeasance, insider threats, system errors or vulnerabilities or other irregularities. Threats can come from a variety of sources, including criminal hackers, hacktivists, state-sponsored intrusions, industrial espionage, and insiders. In addition, certain types of attacks could harm us even if our systems are left undisturbed. For example, certain threats are designed to remain dormant or undetectable, sometimes for extended periods of time, or until launched against a target and we may not be able to implement adequate preventative measures. The risk of cyberattacks could also be increased by cyberwarfare in connection with the ongoing Russia-Ukraine and Israel-Hamas conflicts, or other future conflicts, including potential proliferation of malware into systems unrelated to such conflicts. Any future breach of our operations or those of others in the ETH industry, including third-party services on which we rely, could materially and adversely affect our business.

Read in the 10-K filed Mar 9, 2026 ↗

To the extent the operation of our systems relies on our third-party service providers, through either a connection to, or an integration with, third parties’ systems, the risk of cybersecurity attacks and loss, corruption, or unauthorized access to or publication of our information or the confidential information and personal data of customers and employees may increase. Third-party risks may include insufficient security measures, data location uncertainty, and the possibility of data storage in inappropriate jurisdictions where laws, security measures or other controls may be inadequate or in which there are uncertainties regarding governmental intervention and use of such data, and our ability to monitor our third-party service providers’ data security practices are limited. Although we generally have agreements relating to cybersecurity and data privacy in place with our third-party service providers, they are limited in nature and we cannot guarantee that such agreements will prevent the accidental or unauthorized access to or disclosure, loss, destruction, disablement or encryption of, use or misuse of or modification of data (including personal data) or enable us to obtain adequate or any reimbursement from our third-party service providers in the event we should suffer any such incidents. Due to applicable laws and regulations or contractual obligations, we may be held responsible for any information security failure or cybersecurity attack attributed to our vendors as they relate to the information we share with them. A vulnerability in or related to a third-party service provider’s software or systems, a failure of our third-party service providers’ safeguards, policies or procedures, or a breach of a third-party service provider’s software or systems could result in the compromise of the confidentiality, integrity or availability of our systems or the data housed in our third-party solutions.

Read in the 10-K filed Mar 9, 2026 ↗

The security of the information and technology systems used by us and our service providers may continue to be subjected to cybersecurity threats that could result in material failures or disruptions in our business. If these systems are compromised, become inoperable for extended periods of time or cease to function properly, we or a service provider may have to make a significant investment to fix or replace them. The failure of these systems or of disaster recovery plans for any reason could cause significant interruptions in operations and result in a failure to maintain the security, confidentiality or privacy of sensitive data, including personal information relating to stockholders (and the beneficial owners of stockholders). Such a failure could harm our reputation, subject us to legal claims and otherwise materially and adversely affect our investment and trading strategies and our value.

Read in the 10-K filed Mar 9, 2026 ↗

We are, and may continue to be, subject to litigation and legal proceedings that could adversely affect our business. These may involve claims from employees, customers, regulators, suppliers, shareholders, or others, including class or collective actions. Allegations have included claims related to employment practices, food safety and product defects, data privacy, discrimination, personal injury, advertising, intellectual property disputes, securities violations, and other matters. A judgment significantly in excess of any applicable insurance coverage or third-party indemnity could materially adversely affect our financial condition or results of operations. Even unfounded claims can result in substantial legal costs, management distraction, and potential settlements or penalties. Litigation may also generate negative publicity, harming our reputation, customer relationships, and financial performance. See Note 16, Commitments and Contingencies, to the consolidated financial statements included in Item 8 of Part II of this 10-K for information regarding certain legal proceedings in which we are involved.

Read in the 10-K filed Nov 14, 2025 ↗

We are subject to a complex and rapidly evolving landscape of local, national, and international laws and regulations governing the collection, use, retention, protection, disclosure, transfer, and other processing of personal data. These laws and regulations are frequently amended, reinterpreted, and increasingly enforced, often resulting in heightened compliance obligations, litigation risk, and operational costs. Regulatory scrutiny is intensifying, with agencies such as the Federal Trade Commission and state attorneys general applying consumer protection laws to online data practices. The legal landscape remains fluid, with privacy and data protection laws potentially limiting data use, requiring changes to processing practices, exposing us to fines, litigation, or other penalties, or impacting our ability to develop new services. Regulatory changes may include new legislation, invalidation of existing rules, or increased penalties, all of which can impact our ability to develop and offer new products and services. For example, the EU’s GDPR and the U.K. equivalent impose strict data protection requirements and significant penalties for noncompliance. China’s Personal Information Protection Law (PIPL) and Data Security Law similarly regulate personal and non-personal data processing activities and establish data subject rights and obligations for personal information processors, with civil and criminal liabilities for violations. Other jurisdictions served by Starbucks and its licensees are enacting or proposing comparable laws, including restrictions on cross-border data transfers and enhanced data safeguards, which may increase compliance costs and affect business operations.

Read in the 10-K filed Nov 14, 2025 ↗

The increasing adoption of artificial intelligence technologies has led data protection authorities around the world to consider and adopt new and evolving interpretations of privacy and data protection laws, with specific obligations regarding processing of personal data, including required notices, consents, and opt-outs.

Read in the 10-K filed Nov 14, 2025 ↗

Claims we have failed to comply with applicable privacy and data protection laws or to adequately safeguard personal data, even if unfounded, may result in regulatory investigations, enforcement actions, litigation (including class actions), reputational harm, and financial penalties, any of which could materially affect our operations and financial performance.

Read in the 10-K filed Nov 14, 2025 ↗

Emerging technologies, including artificial intelligence and machine learning, may not deliver expected efficiencies and could introduce new risks, such as those related to cybersecurity, data privacy, inaccuracies, hallucinations, bias or discrimination and intellectual property infringement, which may become more pronounced as the Company’s reliance on such technologies increases.

Read in the 10-K filed Nov 14, 2025 ↗

AI or machine learning technologies usage by our service providers in their business activities, whether or not known to us, could also expose us to risks. The failure of one or more such service providers to meet our expectations, including by use of AI tools in contravention of agreements with us, inputting our confidential or proprietary information into AI tools, or roll-out of new AI tools without our approval, may have an adverse effect on our operations or financial condition, result in legal or regulatory violations, jeopardize our intellectual property rights or give rise to issues pertaining to data privacy and data protection.

Read in the 10-K filed Aug 31, 2026 ↗

We have been, are currently, and may in the future be subject to various lawsuits, stockholder derivative actions, class action lawsuits, individual or mass arbitration proceedings, and other types of legal proceedings, as well as other disputes, claims, and regulatory or governmental inquiries and investigations, including with regard to contract or commercial disputes, consumer protection, privacy, data protection, intellectual property, tax, employment, and corporate governance, among other matters.

Read in the 10-K filed Aug 31, 2026 ↗

Solventum has begun to deploy AI in its products and services, including as part of its research and development efforts, and Solventum expects to continue to explore additional uses as AI continues to develop. In addition, Solventum intends to devote significant resources to develop and deploy cloud, edge and software solutions in its healthcare solutions. For example, Solventum has incorporated AI into certain products in the Health Information Systems business segment and certain of its digital offerings and expects to continue to build AI into additional products. Any disruption or failure in the AI, machine learning, or other emerging technologies Solventum deploys or uses in its products and services, including as part of its research and development efforts, could adversely impact Solventum’s business, including as a result of flawed AI algorithms, insufficient or biased datasets, malfunctions or manipulations, unintentional release of confidential information, or product or service delays or recalls. In addition, any failure to successfully deploy or use such technologies in Solventum’s products and services, or to adapt to medical technology industry trends and developments related to such technologies in a timely manner (or at all), particularly as competitors incorporate such technologies into new and existing products and services, could adversely affect customer demand for Solventum’s products and its competitiveness. The deployment of AI, machine learning or other emerging technologies into Solventum’s products and services will require additional investment and increase its costs. Furthermore, the rapid advancement of technology, including AI, creates additional risks as Solventum includes such technology into its products and services, including from confidentiality, privacy, data protection, cybersecurity and compliance perspectives, and raises intellectual property issues and operational, technological and other concerns. Any of the above factors could adversely affect Solventum’s business, financial condition, results of operations and cash flows.

Read in the 10-K filed Feb 27, 2026 ↗

•unforeseen risks and liabilities associated with businesses acquired, including any unknown vulnerabilities in acquired technology, compromises of acquired data or noncompliance with data privacy requirements; and/or

Read in the 10-K filed Feb 27, 2026 ↗

•These laws and regulations are wide-ranging in scope and impose numerous requirements on entities that process certain data, including personal data, such as requirements relating to processing sensitive data, obtaining consent of the individuals to whom the personal data relates in certain circumstances, providing information to individuals regarding data processing activities, implementing safeguards to protect the security and confidentiality of personal data, providing notification of data breaches and taking certain measures when engaging third-party processes that will have access to personal data. These laws and regulations are increasing in complexity and number, sometimes change, and can conflict among the various jurisdictions in which we operate. It is possible that we could be prohibited or constrained from collecting or disseminating certain types of data or from providing certain products or services as a result of such laws and regulations. For example, we may not be able, or we may fail, to obtain appropriate third-party consent where consent is required to collect or use certain types of data for certain purposes in our business. Moreover, if our business fails to comply with these laws or regulations, we could be subject to significant litigation and civil or criminal penalties (including monetary damages, regulatory enforcement actions or fines) in one or more jurisdictions, as well as reputational damage that could result in the loss of data, brand equity and business. For example, a failure to comply with the GDPR or U.K. GDPR could result in fines up to the greater of €20 million (or £17.5 million under the U.K. GDPR) or 4% of annual global revenues. Additionally, in the case of a DPPA violation, U.S. courts may award liquidated damages of $2,500 per individual’s personal information. Furthermore, any inquiries or investigations, or any other governmental actions, regarding our data processing practices could require significant management time and attention, and may result in negative publicity and subject us to increased costs, as well as demands or orders that we modify our existing business practices. Enforcement of these laws and regulations may increase as enforcement programs mature and better tooling enhances identification of compliance issues.

Read in the 10-K filed Feb 11, 2026 ↗

In addition to security and privacy risks related to data, we face challenges related to data governance, including the need to manage our data with the aim to meet regulatory requirements and create a foundation for the use of artificial intelligence tools. Our current and potential future uses of such tools (and use by our vendors and agents) may expose us to heightened security and privacy risks as well as operational, legal, and reputational risks. Data produced by or contained in artificial intelligence tools may contain inaccuracies, and our investments in such technologies and related organizational changes may not deliver the expected benefits, which could result in operational disruptions, inefficiencies, unexpected costs and regulatory disallowances. Beginning in January 2027, our businesses that are subject to the California Consumer Privacy Act will also be subject to new regulations related to, among other things, the use of artificial intelligence tools to automate certain decisions. These regulations may limit some potential applications of such technologies, particularly with respect to previously collected personal data. The regulations require companies to disclose any covered use of such technologies and how the relevant decisions will be made and to allow consumers to opt out of such use, subject to limited exceptions. The regulations also require companies to conduct risk assessments before initiating certain data processing activities, disclose information about these assessments to the California Privacy Protection Agency, conduct an annual cybersecurity audit and submit a written compliance certification to the agency.

Read in the 10-K filed Feb 26, 2026 ↗

Likewise, governments and regulatory bodies worldwide are actively developing new laws, regulations and ethical guidelines governing AI use, including the European Union’s Artificial Intelligence Act. Compliance with evolving and potentially inconsistent AI regulations across jurisdictions may be costly and complex. Failure to comply could result in significant penalties, restrictions on our use of AI, or reputational harm. The use of AI may also raise data privacy concerns, particularly if AI systems process sensitive health information subject to GDPR, HIPAA or other privacy regulations. If our competitors deploy AI technologies more effectively than we do, we may lose market share or be unable to maintain our competitive position. Failure to adequately manage AI-related risks could have a material adverse effect on our business, reputation, financial condition, and results of operations.

Read in the 10-K filed May 29, 2026 ↗

financial liabilities are exacerbated, particularly under data protection regulations such as the GDPR.

Read in the 10-K filed Feb 19, 2026 ↗

We have implemented security measures designed to prevent, detect, and respond to cybersecurity threats, but these measures may not be effective against all threats or prevent every incident. We cannot guarantee that our or our third party providers’ products, systems, components, software, or infrastructure are free of exploitable defects, bugs, or vulnerabilities, and use of AI technologies by us or our customers, suppliers, or other third parties may increase the complexity and effectiveness of cybersecurity threats and introduce new vulnerabilities into systems, software, products, and business processes. A cybersecurity incident or other compromise of our products, systems, or AI technologies used in our business, or those of our customers or third party providers, could result in unauthorized access to, disclosure, loss, misuse, or corruption of proprietary, confidential, or personal information, including intellectual property or information about our manufacturing, financials, customers, or employees. Cybersecurity incidents, as well as efforts to prevent, detect, or respond to such incidents, also may impair the functionality of our products, information technology systems, manufacturing operations, supply chain activities, product development efforts, or other critical business functions, or result in increased costs associated with investigation, containment, remediation and recovery, product updates, customer support, customer claims, contractual disputes, litigation, indemnification obligations, regulatory investigations, fines or penalties, damage to our reputation, and reduced sales or profitability. Any of these events, whether affecting our systems directly, the products and services we provide, or the systems of third parties on which we depend, could have a material adverse effect on our business, financial condition, and results of operations.

Read in the 10-K filed Aug 4, 2026 ↗

improper disclosure of data and violations of applicable data privacy and other laws; or

Read in the 10-K filed Feb 27, 2026 ↗

Attacks upon systems across a variety of industries, including industries related to SUI, are increasing in frequency, persistence, and sophistication, and, in many cases, are being conducted by sophisticated, well-funded and organized groups and individuals, including state actors. The techniques used to obtain unauthorized, improper or illegal access to systems and information (including personal data and digital assets), disable or degrade services, or sabotage systems are constantly evolving, may be difficult to detect quickly, and often are not recognized or detected until after they have been launched against a target. These attacks may occur on our systems or those of our third-party service providers or partners. We may experience breaches of our security measures due to human error, malfeasance, insider threats, system errors or vulnerabilities or other irregularities. In particular, we expect that unauthorized parties will attempt to gain access to our systems and facilities, as well as those of our partners and third-party service providers, through various means, such as hacking, social engineering, phishing and fraud. Threats can come from a variety of sources, including criminal hackers, hacktivists, state-sponsored intrusions, industrial espionage, and insiders. In addition, certain types of attacks could harm us even if our systems are left undisturbed. For example, certain threats are designed to remain dormant or undetectable, sometimes for extended periods of time, or until launched against a target and we may not be able to implement adequate preventative measures. Further, there has been an increase in such activities due to the increase in work-from-home arrangements. The risk of cyberattacks could also be increased by cyberwarfare in connection with the ongoing Russia-Ukraine and Israel-Hamas conflicts, or other future conflicts, including potential proliferation of malware into systems unrelated to such conflicts. Any future breach of our operations or those of others in the Sui industry, including third-party services on which we rely, could materially adversely affect our financial condition and results of operations.

Read in the 10-K filed Feb 27, 2026 ↗

We may use generative artificial intelligence and/or machine learning (collectively, “AI”) tools in our operations. If our peers use AI tools to optimize operations and we fail to utilize AI tools in a comparable manner, we may be competitively disadvantaged. However, while AI tools may facilitate optimization and operational efficiencies, they also have the potential for inaccuracy, bias, infringement or misappropriation of intellectual property, and risks related to data privacy and cybersecurity. The use of AI tools may introduce errors or inadequacies that are not easily detectable, including deficiencies, inaccuracies or biases in the data used for AI training, or in the content, analyses or recommendations generated by AI applications. The results of such errors or inadequacies may adversely affect our business, financial condition and results of operations. The legal requirements relating to AI continue to evolve and remain uncertain, including how legal developments could impact our business and ability to enforce our proprietary rights or protect against infringement of those rights. Cybersecurity threat actors may utilize AI tools to automate and enhance cybersecurity attacks against us. The integration of AI tools in the digital asset industry may present significant opportunities and risks for our vendors, investors or contract counterparties, similar to those risks described above.

Read in the 10-K filed Feb 27, 2026 ↗

reputational implications if use becomes controversial, system security concerns, or the protection of privacy could impair the

Read in the 10-K filed Feb 27, 2026 ↗

The regulatory landscape surrounding artificial intelligence is rapidly evolving and the Company’s use of artificial intelligence may be subject to new legal or regulatory requirements, which may impose prohibitions or additional compliance burdens on the Company. For example, the Company’s artificial intelligence efforts may subject it to heightened compliance and legal as well as other risks related to technology integration, accuracy, program bias, data sourcing, intellectual property infringement or misappropriation, data privacy, and cybersecurity, among others. Moreover, the Company may experience brand or reputational harm if it fails to appropriately manage its use of artificial intelligence in compliance with applicable laws and regulations or successfully execute on strategies leveraging artificial intelligence.

Read in the 10-K filed Feb 24, 2026 ↗

Outside of the U.S., countries continue to adopt data privacy laws, with many placing stringent requirements on companies when handling and sharing personal data. There also continues to be a growing trend of countries outside of the U.S., where privacy laws are in place, amending those existing data privacy laws, to further enhance and extend an individual’s rights over their personal data and the obligations placed on companies that handle this data. For instance, Canada has proposed a new data privacy law, Bill C-36, which, if passed, would introduce new obligations regarding the collection, processing and disclosure of personal data on private companies. For each affected jurisdiction, we will need to assess and understand each new piece of legislation, in order to plan for and implement required changes.

Read in the 10-K filed Aug 21, 2026 ↗

One area of increasing risk is the rapid use of artificial intelligence and the evolving legal and regulatory landscape governing its use. The cross-jurisdictional nature of artificial intelligence introduces additional compliance complexity, particularly where emerging artificial intelligence-specific regulation overlaps with existing data privacy requirements when

Read in the 10-K filed Aug 21, 2026 ↗

processing and transforming personal data. The pace of regulatory change requires continual monitoring and adaptation of governance, risk management, and compliance frameworks.

Read in the 10-K filed Aug 21, 2026 ↗

legislation at state, federal and foreign government levels to change or increase regulation on our operations, which could result in additional costs of compliance or litigation. Enactment of new privacy laws and regulations could, among other things, adversely affect our ability to collect data and offer targeted advertisements or result in additional costs of compliance or litigation. Should customers decide that our competitors offer a more customer-friendly environment, our competitive position, results of operations or financial condition could be materially adversely affected.

Read in the 10-K filed Feb 9, 2026 ↗

our operations or the operations of our customers and partners, delay production and shipments, result in theft of our and our customers’ intellectual property and trade secrets, result in disclosure of personally identifiable information, damage customer, patient, business partner and employee relationships and our reputation and result in defective products or services, legal claims and proceedings, liability and penalties under privacy laws and increased costs for security and remediation, in each case resulting in an adverse effect on our business and financial results.

Read in the 10-K filed Aug 24, 2026 ↗

•compliance with anti-corruption laws, cybersecurity, data privacy regulations, customs and trade regulations;

Read in the 10-K filed Feb 19, 2026 ↗

Regulatory and other legal frameworks surrounding AI continue to evolve and remain uncertain. If we do not have sufficient rights to use models, prompts, algorithms, and datasets on which our AI technologies rely or the related decisions, predictions, analysis, or other output, we could incur significant damages, substantial fees, deprivation of access, or considerable expense through a violation of applicable law, third-party intellectual property, privacy, or other rights, or other violations. New or changing statutes, regulations, or industry standards and practices may increase costs, restrict use cases, or require significant changes to our deployment or our existing systems and controls. If we fail to appropriately respond to changes within the AI landscape, including changing public sentiment, we could face legal, regulatory, or brand and stakeholder risk that may negatively impact our business, operations, financial results, financial condition, or reputation. In addition, the use of AI by companies has resulted in, and may in the future result in, cybersecurity breaches, attacks, and other similar incidents as well as data privacy violations.

Read in the 10-K filed Feb 24, 2026 ↗

In addition, changes in data privacy laws and regulations (as discussed elsewhere in this Item 1A, Risk Factors), as well as new or modified policies of third-party platforms through which Roundel’s offerings are delivered, could negatively affect Roundel’s business model. Increased competition, including from new or enhanced technology offerings such as artificial intelligence-enabled advertising solutions, may further pressure demand for our services. If advertisers reduce or discontinue their use of Roundel’s offerings, our competitive position and results of operations could be adversely affected.

Read in the 10-K filed Mar 11, 2026 ↗

Outside of the United States, as a result of our business acquisitions, we are subject to an expanding set of privacy, data protection, and related regulatory requirements in jurisdictions where we conduct operations or process personal data. These laws may apply based on factors such as our establishment or operations in a jurisdiction or data processing activities conducted there. Certain international data protection regimes, including those in the European Union and the United Kingdom, impose specific obligations on the collection, use, sharing, and transfer of personal data. Compliance with these obligations may increase operational complexity and costs, limit our ability to use or transfer data across jurisdictions, or require changes to our products, services, or business practices. Enforcement approaches and penalties vary by jurisdiction and may include significant fines or other sanctions, as well as reputational harm.

Read in the 10-K filed Feb 11, 2026 ↗

Use of AI by our employees or third-party service providers could increase the risk of exposure of our proprietary, confidential, sensitive or personal information. The use of AI or machine learning technologies by our third-party service providers in their business activities, whether or not known to us, could also expose us to risks, including use of AI tools in violation of agreements with us, use of unauthorized third-party data, inputting our valuable information into AI tools, or deployment of new AI tools without our approval, any of which may give rise to legal or regulatory violations, loss of IP rights, reputational harm, or issues relating to data privacy and data protection.

Read in the 10-K filed Aug 13, 2026 ↗

As a global company, our business is subject to a complex and evolving set of international and U.S. laws and regulations, including export control laws, import and trade restrictions or sanctions, anti-bribery laws, anti-competition regulations, data privacy requirements, labor relations laws, and tax laws.

Read in the 10-K filed Feb 25, 2026 ↗

In addition, our use of AI and machine learning relies on access to large datasets, which creates novel data privacy challenges. Evolving laws and regulations governing AI may impose new restrictions on how we collect and use data to train our models, potentially limiting our ability to innovate.

Read in the 10-K filed Feb 25, 2026 ↗

Amendments and revisions to existing data privacy legislation, and other developments impacting data privacy and data protection may require us to modify our data processing practices and policies, increase the complexity of providing our products and services and cause us to incur substantial costs in an effort to comply. Failure to comply with these data privacy

Read in the 10-K filed Feb 25, 2026 ↗

a partial or total loss of our TRX tokens; harm to our reputation and brand; improper disclosure of data and violations of applicable data privacy and other laws; or significant regulatory scrutiny, investigations, fines, penalties, and other legal, regulatory, contractual and financial exposure.

Read in the 10-K filed Mar 25, 2026 ↗

Attacks upon systems across a variety of industries are increasing in frequency, persistence, and sophistication, and, in many cases, are being conducted by sophisticated, well-funded and organized groups and individuals, including state actors. The techniques used to obtain unauthorized, improper or illegal access to systems and information (including personal data and digital assets), disable or degrade services, or sabotage systems are constantly evolving, may be difficult to detect quickly, and often are not recognized or detected until after they have been launched against a target. These attacks may occur on our systems or those of our third-party service providers or partners. We may experience breaches of our security measures due to human error, malfeasance, insider threats, system errors or vulnerabilities or other irregularities. In particular, unauthorized parties have attempted, and we expect that they will continue to attempt, to gain access to our systems and facilities, as well as those of our partners and third-party service providers, through various means, such as hacking, social engineering, phishing and fraud. In the past, hackers have successfully employed a social engineering attack against one of our service providers and misappropriated our digital assets, although, to date, such events have not been material to our financial condition or operating results. Threats can come from a variety of sources, including criminal hackers, hacktivists, state-sponsored intrusions, industrial espionage, and insiders. In addition, certain types of attacks could harm us even if our systems are left undisturbed. For example, certain threats are designed to remain dormant or undetectable, sometimes for extended periods of time, or until launched against a target and we may not be able to implement adequate preventative measures. Further, there has been an increase in such activities due to the increase in work-from-home arrangements since the onset of the COVID-19 pandemic. The risk of cyberattacks could also be increased by cyberwarfare in connection with the ongoing Russia-Ukraine and Israel-Hamas conflicts, or other future conflicts, including potential proliferation of malware into systems unrelated to such conflicts. Any future breach of our operations or those of others in the digital asset industry, including third-party services on which we rely, could materially and adversely affect our business.

Read in the 10-K filed Mar 25, 2026 ↗

Furthermore, on July 10, 2021, the CAC issued a revised draft of the Measures for Cybersecurity Review for public comment, which required that, among others, in addition to any “operator of critical information infrastructure”, any “data processor” controlling personal information of no less than one million users which seeks to list in a foreign stock exchange should also be subject to cybersecurity review, and further elaborated the factors to be considered when assessing the national security risks of the relevant activities. On December 28, 2021, the CAC, the National Development and Reform Commission (“NDRC”), and several other administrations jointly issued the revised Measures for Cybersecurity Review, which became effective and replaced the existing Measures for Cybersecurity Review on February 15, 2022. According to the Revised Review Measures, if an “online platform operator” that is in possession of personal data of more than one million users intends to list in a foreign country, it must apply for a cybersecurity review. Based on a set of Q&A published on the official website of the State Cipher Code Administration in connection with the issuance of the Revised Review Measures, an official of the said administration indicated that an online platform operator should apply for a cybersecurity review prior to the submission of its listing application with non-PRC securities regulators. Moreover, the CAC released the draft of the Regulations on Network Data Security Management in November 2021 for public consultation, which among other things, stipulates that a data processor listed overseas must conduct an annual data security review by itself or by engaging a data security service provider and submit the annual data security review report for a given year to the municipal cybersecurity department before January 31 of the following year. Given the recency of the issuance of the Revised Review Measures and their pending effectiveness, there is a general lack of guidance and substantial uncertainties exist with respect to their interpretation and implementation. It remains unclear whether a Hong Kong company which collects personal information from PRC individuals shall be subject to the Revised Review Measures. We do not currently expect the Revised Review Measures to have an impact on our business, our operations or our offerings as we do not believe that our subsidiary would be deemed to be an “operator of critical information infrastructure” or a “data processor” controlling personal information of no less than one million users, that would be required to file for cybersecurity review before listing in the U.S.. However, there remains uncertainty in the interpretation and enforcement of relevant PRC cybersecurity laws and regulations. If the Revised Review Measures are adopted into law in the future and if our subsidiary is deemed to be an “operator of critical information infrastructure” or a “data processor” controlling personal information of no less than one million users, our operation and the listing of our Common Stock or other securities in the U.S. could be subject to CAC’s cybersecurity review.

Read in the 10-K filed Mar 25, 2026 ↗

We use internally developed and third-party artificial intelligence and machine learning technology systems to operate our retail business more efficiently and to enhance the experiences of our customers and team members. Our integrated use of these technology systems is intended to support more personalized customer experiences and improve forecasting, sourcing, inventory planning, labor planning, and fulfillment for seasonal and weather-sensitive demand. We are investing, and expect to continue to invest, in expanding our artificial intelligence capabilities and to consider the adoption of other emerging technologies. There can be no assurance, however, that our development or use of these technologies will achieve their intended benefits, operate as expected, be cost-effective, or not result in unintended consequences. Further, the rapidly evolving legal and regulatory environment relating to artificial intelligence and privacy could impact our implementation of these and other emerging technologies and increase compliance costs and the risk of non-compliance. Flaws, breaches, or malfunctions in these systems could lead to operational disruptions, data loss, erroneous decision-making, regulatory scrutiny, reputational harm, or legal liability that could adversely affect our business, reputation, and financial condition. In addition, we face risk of competitive disadvantage if our competitors more effectively use emerging technologies to better serve customers, drive internal efficiencies, and create new or enhanced products or services.

Read in the 10-K filed Feb 19, 2026 ↗

The AI regulatory landscape is evolving, and we may be required to dedicate additional operational and financial resources to ensure compliance with new legal requirements. For instance, the European Union ("E.U.") Artificial Intelligence Act entered into force in August 2024, with some provisions becoming enforceable between February 2025 and August 2027, subject to a likely delay of the Act's high-risk enforcement until December 2027. In the U.S., some states have enacted general purpose AI laws, while others have enacted use-case specific AI laws; other states may enact similar laws in the future, which will add complexity to our compliance efforts. This uncertainty may require additional investments in oversight and the development of protections and safeguards to ensure compliance, including to the extent any personal information is processed by such technologies.

Read in the 10-K filed May 22, 2026 ↗

or when. Any such new or amended privacy laws may add complexity to our compliance efforts and require us to expend additional financial or other resources as a result.

Read in the 10-K filed May 22, 2026 ↗

In the normal course of business, we experience, and have experienced, cyberattacks and other security incidents, which have in the past and may in the future cause harm to our business. For example, in 2022, one such incident resulted in threat actors obtaining employee credentials and accessing customer data, and required us to notify affected customers and regulators and take steps to remediate the incident. While to date the security events we have experienced have not had a material financial impact, we may experience significant and material future incidents. Any security incident can result in loss, corruption, unavailability, or other unauthorized processing of confidential information or sensitive personal information. Any such event, or the perception that it has occurred, may also result in damage to our reputation, erosion of customer trust, loss of customers, litigation, regulatory investigation, fines, penalties, and other consequences and liabilities that could adversely affect our business, results of operation and financial condition. Laws and regulations require us to maintain security measures, and we may have contractual or other legal obligations to notify customers, government agencies, impacted individuals or other relevant stakeholders of security breaches or other incidents, which disclosures are costly and may cause widespread negative publicity and resulting harm, among other adverse consequences. Further, the detection, prevention, and remediation of known and potential security incidents, including determining whether an incident is notifiable or reportable, may not be straightforward and result in additional direct or indirect costs to respond or alleviate the consequences of the actual or perceived incident, such as additional infrastructure capacity spending to mitigate system degradation or reallocation of resources from development activities. We maintain errors, omissions and cyber liability insurance policies covering certain security and privacy damages, but such insurance may not be sufficient to cover the potentially significant losses resulting from a security breach or other incident, may be denied with respect to a particular claim, or may not remain available in the future on acceptable terms or at all.

Read in the 10-K filed Feb 24, 2026 ↗

We are subject to increasing legal, regulatory, and contractual obligations relating to privacy, data protection and cybersecurity that affect how we process personal data in the jurisdictions where we and our customers operate. Our obligations change frequently due to new or modified laws and regulations, as well as court rulings interpreting or invalidating them. These evolving obligations involve significant compliance costs and operational challenges, and increasingly expose us to enforcement actions and other proceedings or actions, sanctions, and litigation, as well as regulatory and public scrutiny of our practices relating to personal information. We expect the increasing breadth and depth, and changing nature of, these obligations to continue to require significant resources, including to review our technology, systems and processes against changing requirements. They may also limit our ability to use personal data for new products, including those relying on AI-related technologies.

Read in the 10-K filed Feb 24, 2026 ↗

In the United States, for example, the California Consumer Privacy Act (as amended by the California Privacy Rights Act of 2020, the “CCPA”) provides our customers, employees, and other individuals certain rights related to their personal information. The federal government has also proposed, and numerous other states are considering or have proposed and/or enacted, laws and regulations addressing privacy and cybersecurity. Internationally, the regulatory landscape is increasingly complex and fragmented and compliance increasingly financially burdensome. For example, in the European Union (“EU”), the General Data Protection Regulation (“GDPR”) imposes significant requirements regarding the processing of personal information, including related to transparency, individuals’ privacy rights, compliance contracting, data minimization, data breach notification, data retention, security, and international data transfers. Other international privacy and data protection laws also impose strict requirements, such as related to marketing communications and deployment of cookies. Together, this patchwork of global requirements presents significant compliance challenges, and subjects us to possible fines, sanctions, litigation, and other adverse consequences. For example, under the GDPR, regulators may impose temporary or definitive bans on data transfers or other processing, require deletion, and impose significant fines, potentially ranging up to 4% of our worldwide revenue.

Read in the 10-K filed Feb 24, 2026 ↗

Additionally, as a provider of interconnected VoIP service, we must also comply with certain U.S. federal privacy laws and regulations, including Section 222 of the Communications Act of 1934, as amended, and the FCC’s customer proprietary network information rules. We are also subject to state rules and obligations that have been proposed or adopted, or may be in the future. We are also subject to other rapidly changing technology- and industry-specific laws, regulations and obligations. For example, we expect increased global regulation in the use of AI and ML such as the recent AI Act in Europe, which imposes onerous obligations related to the development, placement on the market and use of AI systems. Various countries and a growing number of U.S. states are also enacting legislation regulating aspects of AI or AI generally. We may need to change our business practices to comply with obligations under these or other new and evolving regimes, and face significant compliance challenges, liability, or other risks.

Read in the 10-K filed Feb 24, 2026 ↗

As a provider of communications products and a licensed telecommunications provider, we are required to comply with many changing federal, state and international regulations, including relating to privacy, security, telecommunications, consumer protection, fraud and scam prevention, Know Your Customer and Know Your Traffic and other requirements and obligations, which often vary across the numerous jurisdictions in which we operate. Compliance with these requirements involves significant management attention and compliance costs, and can present operational challenges, onboarding delays and friction for our customers, require us to raise prices, restructure or discontinue our products, or limit our ability to expand into certain jurisdictions. If we do not comply with such requirements, we could face enforcement actions, significant fines, remedial directions to implement audits or new processes, loss of licenses, restrictions or prohibitions on our ability to operate or offer certain of our products, eroded customer trust, and damage to our brand and reputation, and other consequences. Any of the foregoing could adversely affect our business, results of operations and financial condition.

Read in the 10-K filed Feb 24, 2026 ↗

In the United States, at the federal level, we and/or our customers are required to comply with laws and regulations limiting telemarketing and certain technologies that enable automatic calling and/or messaging and establishing quiet hours for solicitations, such as the Telephone Consumer Protection Act of 1991 (“TCPA”), laws requiring assistance to law enforcement in electronic surveillance, requirements to pay regulatory fees and contributions to various federally administered funds, requirements to safeguard the privacy of certain customer information, and requirements aimed at mitigating illegal robocalls and robotexts, such as the implementation of call authentication technologies, and other compliance requirements. At the state level, some states have adopted, proposed or may propose, regulations that may subject us to additional registration, reporting, resiliency and/or compliance obligations, including laws similar to the TCPA.

Read in the 10-K filed Feb 24, 2026 ↗

Failure to adapt to a rapidly changing technological environment or failure to adopt emerging technologies, including advances relating to AI and agentic commerce, in a timely manner could negatively affect our business. For example, if we are unable to match or surpass the advances in technologies and capabilities of our competitors for either external (guest)-facing or internal use cases, our competitive position could be adversely affected. In addition, if we adopt new technologies such as AI and fail to deploy them effectively or if we, our associates, or third parties acting at our direction use them incorrectly, unethically, or illegally, it could have a negative impact on our business, reputation, and financial results. The development of AI technologies is complex, and there are technical and other challenges associated with achieving the desired level of accuracy, efficiency, and reliability. The algorithms and models utilized in generative AI systems may have limitations, including biases, errors, or the inability to handle certain data types or scenarios. Additionally, there is a risk of system failures, disruptions, or vulnerabilities that could compromise the integrity, security, or privacy of data inputs or generated content. These limitations or failures could result in reputational harm, legal liabilities, or loss of guest, employee, or business partner confidence. Uncertainty regarding the regulation of AI and other burgeoning technologies may require significant resources to modify and maintain business practices to comply with U.S. and non-U.S. laws, the nature of which cannot be determined at this time. An increasing number of jurisdictions around the globe, including several U.S. states, have already proposed or enacted laws governing AI. Other jurisdictions may decide to adopt similar or more restrictive legislation that may render the use of such technologies challenging. These obligations may make it harder for us to conduct our business using AI, lead to regulatory fines or

Read in the 10-K filed Mar 26, 2026 ↗

In addition, our international operations are subject to a number of unique risks, including those relating to local economic and political conditions; government regulation; restrictive trade policies; restrictions on the sale or distribution of certain products or services; uncertainty regarding liability for products, services, and content, including uncertainty as a result of unfamiliar local laws and legal systems; business licensing or certification requirements; limited fulfillment and technology infrastructure; laws and regulations regarding privacy, data use, data protection, data security, data localization, network security, consumer protection, payments, advertising, and restrictions on pricing or discounts; compliance with the U.S. Foreign Corrupt Practices Act and other applicable U.S. and foreign laws prohibiting corrupt payments to government officials and other third parties; laws and policies of the U.S. and other jurisdictions affecting trade, foreign investment, loans, and taxes; and geopolitical events, including war and terrorism.

Read in the 10-K filed Mar 26, 2026 ↗

We collect, use, process, and store proprietary information and personal, sensitive, or confidential data relating to our business, customers, and employees. Privacy laws and similar regulations in many jurisdictions where we do business require that we take significant steps to safeguard that information, and these laws and regulations continue to evolve. New laws may add a broad array of requirements on how we handle or use information, increase our compliance obligations and impose new

Read in the 10-K filed Jan 28, 2026 ↗

In recent years, our industry and end-markets have been characterized by rapid changes in technology and customer demands. Our ability to continually improve our current processes and customer-facing tools in response to changes in technology or in customer expectations is essential in maintaining our competitive position and maintaining current levels of customer satisfaction. Failure to correctly identify and predict customer needs and preferences, to deliver high quality, innovative and competitive products to the market, to adequately protect our intellectual property rights or to acquire rights to third-party technologies, to provide adequate data security and privacy protections, and to stimulate customer demand for, and convince customers to adopt, new products, digital solutions and support services, could adversely affect our consolidated results of operations, financial condition and cash flows. In addition, we may experience technical or other difficulties that could delay or prevent the development or implementation of new products, digital solutions and support services. We also may not achieve the benefits that we anticipate from new technologies we develop or implement. The effects of these risks may, individually or in the aggregate, materially adversely affect our results of operations, financial condition and cash flows.

Read in the 10-K filed Jan 28, 2026 ↗

We incorporate AI solutions into our products, services and features, and we leverage AI in our product development and our operations. If we are unable to effectively integrate AI into our business processes or keep pace with rapidly evolving AI technological developments, we may face a competitive disadvantage. At the same time, the use or offering of AI technologies may result in new or expanded risks and liabilities, including enhanced government or regulatory scrutiny, litigation, privacy and compliance issues, ethical concerns, confidentiality, reputational harm, and security risks. It is difficult to predict all the risks related to the use of AI. Changes in laws, rules, directives, and regulations governing the use of AI may adversely affect our ability to develop and use AI or subject us to legal liability. The cost of complying with laws and regulations governing AI could be significant and would increase our operating expenses, which could adversely affect our business, financial condition, results of operations and cash flows. Further, market demand and acceptance of AI technologies are uncertain, and our efforts to further incorporate AI into our processes may not succeed.

Read in the 10-K filed Jan 28, 2026 ↗

Legislators and regulators worldwide are increasingly adopting or revising privacy, data protection, data transfer, cybersecurity and AI laws, creating a complex, fragmented, evolving and often inconsistent global compliance landscape. Privacy laws in numerous jurisdictions, impose specific requirements for cross-border data transfers, transparency, automated decision making, data localization and substantial compliance and audit obligations. In Europe, data protection authorities continue to enforce the General Data Protection Regulation with record-setting fines. Similarly, new cybersecurity laws and regulations continue to come into force globally, and Visa continues to enter new markets where certain services are subject to new cybersecurity legal requirements. These laws and regulations often impose both specific cybersecurity control and governance requirements as well as incident reporting obligations. As we develop more integrated and personalized products and services, acquire new companies and expand our data profile across additional data types, sources, channels and partners, the impact of these laws on our business will continue to grow. Noncompliance with any of these regimes could result in regulatory penalties, significant legal liability and enforcement actions.

Read in the 10-K filed Nov 5, 2026 ↗

Our and our partners’ use of AI across data platforms, data storage, data transfer, products, services, and operational processes depends in part on third-party tools, models and infrastructure that we do not fully control. These technologies may process confidential, proprietary, sensitive or personal information and may introduce or amplify cybersecurity, data governance, privacy, data residency, sovereignty, licensing and operational risks. We are subject to an increasingly fragmented and expanding set of laws governing the development, procurement, deployment and use of AI technologies. Risks associated with the development and procurement of AI include intellectual property, data collection, third-party and training data risks, as well as risks relating to the security, integrity and performance of third-party AI models, including open-source models. Our reliance on third-party AI tools, models, infrastructure and data processing environments may further limit our ability to monitor, control or remediate how confidential or personal information is accessed, retained, used, transferred or secured.

Read in the 10-K filed Nov 5, 2026 ↗

The deployment and use of AI may also present technical, operational and compliance challenges. The EU AI Act established harmonized rules across Europe, with key provisions for most high-risk AI systems taking effect in 2027. In the U.S., several states have adopted AI-specific frameworks or are applying existing consumer and data protection laws to regulate AI. Depending on how these regulations are interpreted and enforced, they may limit our ability to develop and deploy AI systems or significantly increase compliance costs. The introduction of new or modified data use cases involving confidential or personal information, including through AI-enabled technologies, may result in sensitive data being exposed to unauthorized access, exfiltration or retention by third-party providers, replicated into weakly governed derivative stores, or transferred across jurisdictions in ways that raise data

Read in the 10-K filed Nov 5, 2026 ↗

residency, sovereignty and licensing concerns. The risk of inadvertent disclosure of confidential information or personal data through AI utilization may also attract stronger regulatory scrutiny and enforcement.

Read in the 10-K filed Nov 5, 2026 ↗

The emergence of agentic commerce, in which autonomous AI agents initiate and execute transactions on behalf of users, presents novel regulatory, privacy, cybersecurity and fraud risks. Legal frameworks governing autonomous agents remain nascent, and the interplay between payments regulations, data privacy laws and evolving AI rules creates uncertainty around compliance obligations and liability exposure. As agentic commerce scales, there could be increased instances of unauthorized, erroneous or disputed payments, or fraud. Agentic commerce may also introduce challenges in monitoring cross-border, prohibited or high-risk transactions subject to conflicting regulatory requirements.

Read in the 10-K filed Nov 5, 2026 ↗

The global proliferation of privacy, cybersecurity and AI regulation requires us to continuously monitor and adapt our privacy, cybersecurity, data use and AI management, governance and compliance practices. Our development and implementation of governance frameworks aimed at complying with fragmented and emerging laws and regulations applicable to these areas may not be successful to mitigate all of these emerging risks. If our AI-enabled data practices are, or are perceived to be, inadequately governed, inaccurate or non-compliant, we could face reputational harm, regulatory scrutiny, enforcement actions or legal claims. Failure to adapt our data governance practices to keep pace with evolving AI technologies, data processing practices, cybersecurity threats, and regulatory requirements could harm our ability to compete, decrease the value of our products and services to clients, and adversely affect our future growth.

Read in the 10-K filed Nov 5, 2026 ↗

We process personal data on behalf of our customers, who use our solutions to manage personal data of their employees, healthcare professionals, patients, and related individuals. We also process personal data as part of the Veeva Data Cloud offerings, which provide our customers with professionally relevant data related to healthcare providers and other industry professionals and stakeholders. In addition, we process personal data to provide services that allow healthcare marketers to reach their target audiences and to measure the impact of their media campaigns. In some cases, the personal data that we process includes sensitive personal data, such as health data.

Read in the 10-K filed Mar 20, 2026 ↗

Many countries and governmental bodies have adopted or may adopt laws and regulations governing our processing of personal and other data, making compliance an increasingly complex task. For example, we are regulated under the European General Data Protection Regulation (“EU GDPR”) and the United Kingdom’s General Data Protection Regulation (“UK GDPR”), as amended by the Data (Use and Access) Act of 2025, where we act as a data controller for our data products and a data processor with respect to our software products. In China, we are regulated under China’s Personal Information Protection Law (“PIPL”), where we process data as an entrusted party on behalf of our customers who operate as data handlers. In certain cases, we are regulated under the U.S. Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) that covers protected health information collected or maintained by covered entities and their business associates. Additionally, many states in the U.S. have passed comprehensive privacy legislation, such as the California Consumer Privacy Act (amended by the California Privacy Rights Act). Some states in the U.S. also have passed legislation governing the processing of particular types of data, such as biometric data and certain other health-related data.

Read in the 10-K filed Mar 20, 2026 ↗

These laws and regulations impose data subject notice or transparency requirements, mandated privacy and security standards, and registration obligations. They also grant rights to data subjects, such as allowing them to access, correct, delete, or opt out of the sale or sharing of their information. Some of these laws and regulations target certain types of marketing and advertising based on the use of personal information. For example, in response to the State of Washington’s My Health My Data Act, which placed significant restrictions on how businesses can collect, use, and disclose consumer health data, we added limitations to the audience segments on our Veeva Crossix data platform. Other states have considered, and in certain cases, enacted, similar laws.

Read in the 10-K filed Mar 20, 2026 ↗

In 2025, the U.S. Department of Justice issued a final rule that places limitations, and in some cases prohibitions, on certain transfers of and access to certain personal data of U.S. persons by persons and entities located in China (and other designated countries) or controlled by a person or entity located in China (and other designated

Read in the 10-K filed Mar 20, 2026 ↗

As we expand our data product offerings into new jurisdictions, we are required to assess, monitor, and comply with additional laws and regulations related to our collection and processing of data, which may include new registration, consent, and notification obligations. In addition to our own processing of personal data, our customers expect that our solutions can be used to enable their compliance with applicable data protection, data privacy, and cybersecurity laws and regulations.

Read in the 10-K filed Mar 20, 2026 ↗

The legal and regulatory landscape surrounding AI technologies is rapidly evolving and uncertain, including in the areas of intellectual property, cybersecurity and privacy and data protection. Compliance with new or changing laws, regulations or industry standards relating to AI may impose significant costs and may limit our ability to develop, deploy or use AI technologies. Failure to appropriately respond to this evolving landscape may result in legal liability, regulatory action, or brand and reputational harm.

Read in the 10-K filed Feb 20, 2026 ↗

manufacturing of pharmaceutical products, enhanced data security and privacy measures, sustainability, importation

Read in the 10-K filed Feb 13, 2026 ↗

jurisdictions related to the collection, storage, use, sharing, and security of personal data, including health information.

Read in the 10-K filed Feb 13, 2026 ↗

Regulators globally are imposing data privacy and security requirements, such as the E.U.’s GDPR and other domestic data

Read in the 10-K filed Feb 13, 2026 ↗

privacy and security laws, such as the California Consumer Privacy Act and the California Privacy Rights Act. These and

Read in the 10-K filed Feb 13, 2026 ↗

personal information. Compliance with privacy laws and regulations is a rigorous and time-intensive process that may

Read in the 10-K filed Feb 13, 2026 ↗

genetic therapies involves processing more personal data than traditional therapies, increasing our risk exposure.

Read in the 10-K filed Feb 13, 2026 ↗

incidents and privacy violations, particularly focused on online data sharing, continue to increase. Government investigations

Read in the 10-K filed Feb 13, 2026 ↗

laws or regulations, including anti-corruption or anti-bribery regulations, the GDPR, or other laws and regulations, during the

Read in the 10-K filed Feb 13, 2026 ↗

personal information, financial information and intellectual property. Disruption, infiltration, or failure of our information

Read in the 10-K filed Feb 13, 2026 ↗

candidates, or lead to data privacy or security breach. We use cloud technologies and any failure by cloud or other technology

Read in the 10-K filed Feb 13, 2026 ↗

service providers to adequately safeguard their systems and prevent cyber-attacks or data privacy incidents could disrupt our

Read in the 10-K filed Feb 13, 2026 ↗

loss of critical or sensitive information, including personal information, and could give rise to legal liability and regulatory

Read in the 10-K filed Feb 13, 2026 ↗

with legal or regulatory requirements, inappropriate disclosure of confidential information or personal information, and loss

Read in the 10-K filed Feb 13, 2026 ↗

not limited to: (i) foreign currency fluctuations and challenges with respect to the repatriation of foreign earnings and cash; (ii) treatment of international currency gains or losses under certain tests required for us to maintain our status as a REIT; (iii) impact from international trade disputes and the associated impact on our managers’, tenants’ and borrowers’ supply chain and consumer spending levels; (iv) changes in foreign political, regulatory and economic conditions; (v) challenges in staffing and labor and managing international operations, including negotiating with foreign labor unions; (vi) challenges of complying with a wide variety of foreign laws and regulations, including those relating to real estate, corporate governance, operations, licensing, taxes, data privacy (including U.K. GDPR), cybersecurity, employment and legal proceedings; (vii) changes in regulatory and environmental requirements, taxes, tariffs, trade wars and laws; (viii) foreign ownership restrictions with respect to operations in foreign countries; (ix) local businesses and cultural factors that differ from our usual standards and practices; (x) differences in lending practices and the willingness of domestic or foreign lenders to provide financing; (xi) regional or country-specific business cycles and political and economic instability; and (xii) failure to comply with applicable laws and regulations in the United States that affect foreign operations, such as the U.S. Foreign Corrupt Practices Act.

Read in the 10-K filed Feb 6, 2026 ↗

New laws and regulations are being adopted, and existing laws and regulations may be interpreted, in ways that could affect our business operations and the way in which we use AI. Our ongoing efforts to comply with privacy and data protection laws, as well as initiatives to comply with new legal regulations relating to privacy, data protection and AI, impose significant costs and challenges that are likely to increase over time. Additionally, this complex and rapidly evolving landscape around AI may expose us to claims, inquiries, demands and proceedings by private parties and global regulatory authorities and subject us to legal liability as well as reputational harm.

Read in the 10-K filed Feb 6, 2026 ↗

Additionally, AI-enabled solutions and features may become more important to our managers, tenants, borrowers and business partners over time. They may also incorporate AI into their products and services without disclosing such use to us or fail to disclose risks presented by their use of AI. If our managers, tenants, borrowers or business partners use AI tools that do not meet existing or rapidly evolving regulatory or industry standards with respect to privacy and data protection, compliance and transparency, among others, it could inhibit our and their ability to maintain an adequate level of functionality or service.

Read in the 10-K filed Feb 6, 2026 ↗

In India, the DPDP Act forms the personal information protection and regulatory requirements for organizations who process any personal information within the country. The DPDP Act is currently in the initial phase of implementation with a 12-18 month phased compliance timeline for organizations although there are current discussions regarding shortening this timeline. The DPDP Act focuses on data minimization, purpose limitation, and user consent and includes a requirement for a Data Protection Officer. While similar to other data protection laws such as the GDPR, several requirements are unique to the DPDP Act such as registered consent managers and a lack of available legal bases for processing personal information without consent. These requirements, along with other requirements unique to the DPDP Act, will require us to enhance our data privacy processes and practices accordingly.

Read in the 10-K filed Feb 26, 2026 ↗

Regulatory developments in the U.S. present additional risks. For example, the California Consumer Privacy Act (“CCPA”) took effect on January 1, 2020, and the California Privacy Rights Act (“CPRA”), which expands upon the CCPA, came into effect on January 1, 2023. The CCPA and CPRA give California consumers, including employees, certain rights similar to those provided by the GDPR, and also provide for statutory damages or fines on a per violation basis that could be very large depending on the severity of the violation. In addition, numerous states have enacted, or are considering, comprehensive privacy laws and other laws that touch on the processing of personal data in specific contexts, including in connection with artificial intelligence and automated systems, further contributing to a fragmented and evolving regulatory landscape that has and may continue to create compliance challenges.

Read in the 10-K filed Mar 6, 2026 ↗

Additionally, a final rule issued by the U.S. Department of Justice establishing a “Data Security Program” came into effect on April 8, 2025. The rule prohibits or restricts certain transactions that could result in access to bulk U.S. sensitive personal data or U.S. government-related data by countries of concern, including China (which includes Hong Kong and Macau). The rule imposes certain diligence, security, audit and record-keeping requirements, and may adversely impact certain of our global business operations, including by restricting or conditioning certain data access or transfers involving subsidiaries, affiliates, and vendors.

Read in the 10-K filed Mar 6, 2026 ↗

In addition, as AI technologies are increasingly used across the industry, including in connection with data analytics, automation, customer service, and decision-support features, the speed, scale, and complexity of data processing may increase, which may heighten data privacy risks. AI-enabled or agentic AI features may be targeted, misused, or produce outputs or inferences that implicate personal data in ways that are difficult to anticipate or control, potentially resulting in regulatory scrutiny, litigation, or reputational harm, even in the absence of a data breach.

Read in the 10-K filed Mar 6, 2026 ↗

In addition, the use of AI in the development of our products could potentially lead to ambiguities in intellectual property ownership, infringement or misappropriation risks, which could impact our competitive position and expose us to litigation, monetary penalties, or operational disruptions. The unauthorized or unapproved use of generative AI tools by our employees, contractors, or other third parties, as well as overreliance on AI automation or agentic AI without appropriate human oversight, may lead to the inadvertent disclosure of confidential, proprietary, or personal information, flawed or unauthorized actions, or other adverse consequences, including disruptions to business operations, exposing us to data security, privacy, legal, regulatory, and reputational risks.

Read in the 10-K filed Aug 14, 2026 ↗

controversy due to their perceived or actual impact on society, including concerns relating to human rights, privacy, employment, or other social, economic, or political issues, we may experience reputational harm, competitive harm, or legal liability, even if we do not directly control the end-use applications.

Read in the 10-K filed Aug 14, 2026 ↗

As a result of the privacy laws to which we are subject, our facilities are generally restricted from sharing personal information with any other person, including the owner of a facility, unless certain requirements are met. However, for facilities regulated under HIPAA, service providers are permitted to aggregate data across facilities for analytics and benchmarking for the benefit of the facilities. Accordingly, we perform data analytics services for seniors housing facilities that we own and/or manage, including, for HIPAA-regulated facilities, aggregating data across facilities for benchmarking analytics. While we have compliance programs in place designed to ensure compliance with HIPAA and other data privacy laws, there is a risk that we could incur liability if we fail to adequately protect personal data.

Read in the 10-K filed Feb 12, 2026 ↗

Consumer and societal attitudes toward AI are evolving and there is a risk that customers, regulators or the public may perceive AI technologies negatively. Concerns about automation, privacy, security, bias, transparency, flawed datasets, or other ethical considerations could reduce trust in our products and services or deter customer adoption of AI-enabled features in our products or services. Our customers and sellers may become increasingly reliant on AI outputs in our products and services when making financial or operational decisions. AI-enabled features in our products may generate outputs that could be interpreted as regulated advice, even if unintended or automated. If such AI outputs are, or are perceived to be, inaccurate, biased, flawed, or otherwise determined as providing regulated advice without appropriate authorization, we could face reputational harm, regulatory scrutiny, enforcement actions or liability claims, any of which could materially and adversely affect our business, financial condition, and results of operations.

Read in the 10-K filed Feb 26, 2026 ↗

The Company, and our Concepts and their franchisees, are subject to numerous laws and regulations around the world which change regularly and are increasingly complex, including: the Americans with Disabilities Act in the U.S. and similar laws; laws related to employment, including the U.S. Fair Labor Standards Act, the U.S. Family and Medical Leave Act, laws related to workplace health and safety, meal and rest breaks, exempt classification, non-discrimination, non-harassment, and whistleblower protections, and laws related to union organizing rights and activities; laws and regulations in government-mandated health care benefits such as the Patient Protection and Affordable Care Act in the U.S.; laws and regulations relating to nutritional content, nutritional labeling, product safety, product marketing and menu labeling; laws relating to state and local licensing; laws relating to the relationship between franchisors and franchisees; laws and regulations relating to health, sanitation, food, workplace safety, child labor, including laws regulating the use of certain “hazardous equipment”, building and zoning, and fire safety and prevention; laws relating to information and data security, privacy, cashless payments, consumer protection, and the use of AI and other emerging technologies; laws relating to our use of third party aggregators; laws relating to international trade and sanctions, tariffs, and currency conversion or exchange; anti-bribery and anti-corruption laws, including the U.S. Foreign Corrupt Practices Act; environmental laws and regulations, including with respect to climate change and greenhouse gas emissions; federal and state immigration laws and regulations; and laws related to public company compliance, disclosure and governance matters.

Read in the 10-K filed Feb 20, 2026 ↗

Further, our use of artificial intelligence and machine learning in our infrastructure and products exposes us to a variety of threats, risks and uncertainties, including with respect to changing laws and regulations regarding the use of such technologies; the risks of inaccuracies, errors and interruptions affecting business processes supported by artificial intelligence; the risks of inaccuracies, errors and interruptions to our products and services using artificial intelligence, which could result in harm to patients or other adverse outcomes; and the variety of risks associated with any other use of information technology, including risks relating to data privacy and access, interruption, compliance, implementation and other factors.

Read in the 10-K filed Feb 20, 2026 ↗