AUTOMATIC DATA PROCESSING INC

Previous wording

withheld or allowing less time to remit taxes to government authorities would adversely impact average client balances and, thereby, adversely impact interest income from investing client funds before such funds are remitted to the applicable tax authorities. Changes in U.S. or foreign tax laws, regulations or rulings or the interpretation thereof could adversely affect our effective tax rate and our net income. In addition, changes in federal, state or local tax laws and regulations allowing for tax credits (including the non-renewal of such laws) could adversely impact our Tax Credit Services business, which helps clients in the United States realize tax credit opportunities in connection with the hiring of new employees and certain other activities. Changes in laws or regulations could also cause us to modify our client funds investment strategy, which may reduce the interest income earned on such funds. Changes in laws, or interpretations thereof, that govern the co-employment arrangement between a professional employer organization and its worksite employees may require us to change the manner in which we conduct some aspects of our PEO business. In addition, changes in the manner in which health and welfare plans sponsored by PEOs or the TotalSource Health and Welfare Plan, in particular, are regulated could adversely impact the demand for our PEO offering.

Current wording

In addition, changes in laws or regulations, or changes in the interpretation of laws or regulations by a regulatory authority, may decrease our revenues and earnings and may require us to change the manner in which we conduct some aspects of our business. For example, a change in regulations either decreasing the amount of taxes to be withheld or allowing less time to remit taxes to government authorities would adversely impact average client balances and, thereby, adversely impact interest income from investing client funds before such funds are remitted to the applicable tax authorities. Changes in U.S. or foreign tax laws, regulations or rulings or the interpretation thereof could adversely affect our effective tax rate and our net income. In addition, changes in federal, state or local tax laws and regulations allowing for tax credits (including the non-renewal of such laws) could adversely impact our Tax Credit Services business, which helps clients in the United States realize tax credit opportunities in connection with the hiring of new employees and certain other activities. Changes in laws or regulations have caused, and could in the future cause, us to modify our client funds investment strategy, which may reduce the interest income earned on such funds. Changes in laws, or interpretations thereof, that govern the co-employment arrangement between a professional employer organization and its worksite employees may require us to change the manner in which we conduct some aspects of our PEO business. In addition, changes in the manner in which health and welfare plans sponsored by PEOs or the TotalSource Health and Welfare Plan, in particular, are regulated could adversely impact the demand for our PEO offering.

Previous wording

Because our PEO is a co-employer with our PEO clients and a Certified PEO by the Internal Revenue Service, we may be subject to certain obligations, responsibilities and liabilities of an employer with respect to Worksite Employees (“WSE”), including with respect to their wages and the payment thereof, tax credits for employers, the payment of certain taxes with respect to WSE wages and employee benefits provided to the WSEs. Even though PEO clients are contractually responsible for the timely remittance of such costs, it is possible that our clients will not remit such payments despite their contractual obligations. The risk of failing to receive such payments from PEO clients could be magnified during significant financial or other disruptions or catastrophic events, such as the failure of a bank with whom a significant number of PEO clients may bank at the time, or more widespread stress or failure within the U.S. banking system. Any such event could prevent or materially delay the recovery of any payments not timely remitted and could have an adverse impact on our financial results and liquidity.

Current wording

Because our PEO is a co-employer with our PEO clients and a Certified PEO by the Internal Revenue Service, we may be subject to certain obligations, responsibilities and liabilities of an employer with respect to Worksite Employees (“WSE”), including with respect to their wages and the payment thereof, tax credits for employers, the payment of certain taxes with respect to WSE wages and employee benefits provided to the WSEs. Even though PEO clients are contractually responsible for the timely remittance of such costs, it is possible that our clients will not remit such payments despite their contractual obligations. The risk of failing to receive such payments from PEO clients is magnified during significant financial or other disruptions or catastrophic events, such as the failure of a bank with whom a significant number of PEO clients may bank at the time, or more widespread stress or failure within the U.S. banking system. Any such event could prevent or materially delay the recovery of any payments not timely remitted and could have an adverse impact on our financial results and liquidity.

Previous wording

Failure to comply with anti-corruption laws and regulations, economic and trade sanctions, anti-money laundering laws and regulations, and similar laws could have a materially adverse effect on our reputation, results of operations or financial condition, or have other adverse consequences

Current wording

Failure to comply with anti-corruption laws and regulations, antitrust and competition laws and regulations, economic and trade sanctions, anti-money laundering laws and regulations, and similar laws could have a materially adverse effect on our reputation, results of operations or financial condition, or have other adverse consequences

Previous wording

Regulators worldwide continue to exercise a high level of scrutiny with respect to anti-corruption, economic and trade sanctions, and anti-money laundering laws and regulations. Such scrutiny has resulted in aggressive investigations and enforcement of such laws and regulations, any of which could materially adversely impact our business. We operate our business around the world, including in numerous developing economies where companies and government officials are more likely to engage in business practices that are prohibited by domestic and foreign laws and regulations, including the United States Foreign Corrupt Practices Act and the U.K. Bribery Act 2010. Such laws generally prohibit improper payments or offers of payments to foreign government officials and leaders of political parties and, in some cases, to other persons, for the purpose of obtaining or retaining business. We are also subject to economic and trade sanctions programs, including those administered by the U.S. Treasury Department’s Office of Foreign Assets Control, which prohibit or restrict transactions or dealings with specified countries, their governments and, in certain circumstances, their nationals, and with individuals and entities that are specially designated, including narcotics traffickers and terrorists or terrorist organizations, among others. In addition, some of our businesses and entities in the U.S. and a number of other countries in which we operate are subject to anti-money laundering laws and regulations, including, for example, The Bank Secrecy Act of 1970, as amended by the USA PATRIOT Act of 2001 (the “BSA”). Among other things, the BSA requires certain financial institutions, including banks and money services businesses (such as national trust banks and providers of prepaid access like us), to develop and implement risk-based anti-money laundering programs, report large cash transactions and suspicious activity, and maintain transaction records. We have registered our prepaid card business as a provider of prepaid access, and registered ADP Trust Bank and ADP Retirement Trust Services with the Treasury Department’s Financial Crimes Enforcement Network. ADP Canada Co. is a registered entity with FINTRAC as a Money Service Business. In November 2024, ADP Canada Co. filed its application for registration with the Bank of Canada as a Payment Services Provider as defined and required under the Retail Payment Activities Act.

Current wording

Regulators worldwide continue to exercise a high level of scrutiny with respect to anti-corruption, antitrust and competition, economic and trade sanctions, and anti-money laundering laws and regulations. Such scrutiny has resulted in aggressive investigations and enforcement of such laws and regulations, any of which could materially adversely impact our business. We operate our business around the world and continue to expand globally, including in numerous developing economies where companies and government officials are more likely to engage in business practices that are prohibited by domestic and foreign laws and regulations, including the United States Foreign Corrupt Practices Act and the U.K. Bribery Act 2010. Such laws generally prohibit improper payments or offers of payments to foreign government officials and leaders of political parties and, in some cases, to other persons, for the purpose of obtaining or retaining business. We are also subject to economic and trade sanctions programs, including those administered by the U.S. Treasury Department’s Office of Foreign Assets Control, which prohibit or restrict transactions or dealings with specified countries, their governments and, in certain circumstances, their nationals, and with individuals and entities that are specially designated, including narcotics traffickers and terrorists or terrorist organizations, among others. In addition, some of our businesses and entities in the U.S. and a number of other countries in which we operate are subject to anti-money laundering laws and regulations, including, for example, The Bank Secrecy Act of 1970, as amended (the “BSA”). Among other things, anti-money laundering laws and regulations require certain financial institutions, including banks and money services businesses (such as national trust banks and providers of prepaid access like us), to develop and implement risk-based anti-money laundering programs, report large cash transactions and suspicious activity, and maintain transaction records. We have registered our prepaid card business as a provider of prepaid access, and registered ADP Trust Bank and ADP Retirement Trust Services with the Treasury Department’s Financial Crimes Enforcement Network. ADP Canada Co. is registered as a Money Services Business with FINTRAC and a Payment Service Provider with the Bank of Canada.

Previous wording

procedures will be adequate or will be determined to be adequate by regulators. Any violations of applicable anti-corruption, economic and trade sanctions or anti-money laundering laws or regulations could limit certain of our business activities until they are satisfactorily remediated and could result in civil and criminal penalties, including fines, which could damage our reputation and have a materially adverse effect on our results of operations or financial condition. Further, bank regulators continue to impose additional and stricter requirements on banks to ensure they are meeting their BSA obligations, and banks are increasingly viewing money services businesses and third-party senders to be higher risk customers for money laundering. As a result, our banking partners that assist in processing our money movement transactions may limit the scope of services they provide to us or may impose additional material requirements on us. These regulatory restrictions on banks and changes to banks’ internal risk-based policies and procedures may result in a decrease in the number of banks that may do business with us, may require us to materially change the manner in which we conduct some aspects of our business, may decrease our revenues and earnings and could have a materially adverse effect on our results of operations or financial condition.

Current wording

We have implemented policies and procedures to monitor and address compliance with applicable anti-corruption, antitrust and competition, economic and trade sanctions and anti-money laundering laws and regulations, and we regularly review, upgrade and enhance our policies and procedures. However, there can be no assurance that our employees, consultants or agents will not take actions in violation of our policies for which we may be ultimately responsible, or that our policies and procedures will be adequate or will be determined to be adequate by regulators. Any violations of applicable anti-corruption, antitrust and competition, economic and trade sanctions or anti-money laundering laws or regulations could limit certain of our business activities until they are satisfactorily remediated and could result in civil and criminal penalties, including fines, which could damage our reputation and have a materially adverse effect on our results of operations or financial condition. Further, bank regulators continue to impose additional and stricter requirements on banks to ensure they are meeting their anti-money laundering obligations, and banks are increasingly viewing money services businesses and third-party senders to be higher risk customers for money laundering. As a result, our banking partners that assist us in processing our money movement transactions may limit the scope of services they provide to us or may impose additional material requirements on us. These regulatory restrictions on banks and changes to banks’ internal risk-based policies and procedures may result in a decrease in the number of banks that may do business with us, may require us to materially change the manner in which we conduct some aspects of our business, may decrease our revenues and earnings and could have a materially adverse effect on our results of operations or financial condition.

Previous wording

The collection, storage, hosting, transfer, processing, disclosure, use, security and retention and destruction of personal information required to provide our services is subject to federal, state and foreign privacy, data protection and cyber security laws. These laws, which are not uniform, generally do one or more of the following: regulate the collection, storage, hosting, transfer (including in some cases, the transfer outside the country of collection), processing, disclosure, use, security and retention and destruction of personal information; require notice to individuals of privacy practices; give individuals certain access and correction rights with respect to their personal information; and regulate the use or disclosure of personal information for secondary purposes such as marketing. Under certain circumstances, some of these laws require us to provide notification to affected individuals, clients, data protection authorities and/or other regulators in the event of a data breach. In many cases, these laws apply not only to third-party transactions, but also to transfers of information among the Company and its subsidiaries. The European Union (the “EU”) General Data Protection Regulation (the “GDPR”), and state consumer privacy laws like the California Privacy Rights Act of 2020 (the “CPRA”), are among the most comprehensive of these laws, and more and more jurisdictions are adopting similarly comprehensive laws that impose new data privacy protection requirements and restrictions. As part of our overall data protection compliance program in connection with the GDPR, we implemented Binding

Current wording

The collection, storage, hosting, transfer, processing, disclosure, use, security and retention and destruction of personal information required to provide our services is subject to federal, state and foreign privacy, data protection and cyber security laws. These laws, which are not uniform, generally do one or more of the following: regulate the collection, storage, hosting, transfer (including in some cases, the transfer outside the country of collection), processing, disclosure, use, security and retention and destruction of personal information; require notice to individuals of privacy practices; give individuals certain access and correction rights with respect to their personal information; and regulate the use or disclosure of personal information for secondary purposes such as marketing. Under certain circumstances, some of these laws require us to provide notification to affected individuals, clients, data protection authorities and/or other regulators in the event of a data breach. In many cases, these laws apply not only to third-party transactions, but also to transfers of information among the Company and its subsidiaries. The European Union (the “EU”) General Data Protection Regulation (the “GDPR”), and state consumer privacy laws like the California Privacy Rights Act of 2020 (the “CPRA”), are among the most comprehensive of these laws, and more and more jurisdictions are adopting similarly comprehensive laws that impose new data privacy protection requirements and restrictions. As part of our overall data protection compliance program in connection with the GDPR, we implemented Binding Corporate Rules (“BCRs”) as both a data processor and data controller, which permits us to process and transfer personal data across borders in compliance with EU data protection laws. In addition, the Department of Justice implemented a Data Security Program under Executive Order 14117 restricting certain transfers of U.S. persons’ sensitive data to “countries of concern” and we have taken appropriate steps to comply.

Previous wording

We believe that providing insights and content from data, including via AI and ML, will become increasingly important to thevalue that our solutions and services deliver to our clients. We are increasingly leveraging AI and ML in our solutions and service delivery and are exploring how best to integrate generative AI technologies and develop and deploy capabilities that are beneficial to our clients and their employees. However, legislation that governs the development and/or use of AI has been adopted or is under consideration in the U.S. at the state and local level, as well as abroad, most notably the European Union’s Artificial Intelligence Act. Inaddition, self-regulatory frameworks like the National Institute of Standards and Technology AI Risk Management Framework are being promulgated and adherence to these may become an industry standard or a client expectation. As a result, the ability to provide data-driven insights and otherwise leverage AI and ML may be constrained by current or future laws (including product liability regimes), regulatory or self-regulatory requirements or ethical considerations, including our own published, guiding ethical principles regarding AI and ML, that could restrict or impose burdensome and costly requirements on our ability to leverage data and/or these technologies in innovative ways. Our use of generative AI in our products and operations also introduces additional risks, including risks related to accuracy, bias, transparency, security, and privacy. For example, if the data used to train a model or the model’s output is inaccurate or biased, or alleged to be inaccurate or biased, we could be subject to reputational damage or litigation.

Current wording

We believe that providing insights and content from data, including via AI and ML, will become increasingly important to thevalue that our solutions and services deliver to our clients. We are increasingly leveraging AI and ML in our solutions and service delivery and are continuing to integrate AI technologies, including generative and agentic AI, to develop and deploy capabilities that are beneficial to our clients and their employees. However, legislation that governs the development and/or use of AI has been adopted or is under consideration in the U.S. at the state and local level, as well as abroad, most notably the European Union’s Artificial Intelligence Act. Inaddition, self-regulatory frameworks like the National Institute of Standards and Technology AI Risk Management Framework are being promulgated and adherence to these may become an industry standard or a client expectation. As a result, the ability to provide data-driven insights and otherwise leverage AI and ML may be constrained by current or future laws (including product liability regimes), regulatory or self-regulatory requirements or ethical considerations, including our own published, guiding ethical principles regarding AI and ML, that could restrict or impose burdensome and costly requirements on our ability to leverage data and/or these technologies in innovative ways. Our use of AI, including generative and agentic AI, in our products and operations also introduces additional risks, including risks related to accuracy, bias, discrimination, transparency, security, and privacy, that could expose us to regulatory investigations, enforcement actions, litigation and reputational damage. For example, if the data used to train a model or the model’s output is inaccurate or biased, or alleged to be inaccurate or biased, we could be subject to reputational damage or litigation.

Previous wording

Complying with privacy, data protection, AI and cyber security laws and requirements, including the enhanced obligations imposed by the GDPR, our BCRs, U.S. state privacy laws, including the CPRA, and the EU Artificial Intelligence Act, may result in significant costs to our business and require us to amend certain of our business practices. Further, enforcement actions and investigations by regulatory authorities related to data security incidents and privacy violations continue to increase. The future enactment of more restrictive laws, rules or regulations and/or future enforcement actions or investigations could have a materially adverse impact on us through increased costs or restrictions on our businesses and noncompliance could result in significant regulatory penalties and legal liability and damage our reputation. In addition, data security events, concerns about privacy abuses by other companies and increased awareness of the potential (positive and negative) of AI are changing client, consumer and social expectations for enhanced protections (including with respect to bias and potential discrimination). As a

Current wording

Complying with privacy, data protection, AI and cyber security laws and requirements, including the enhanced obligations imposed by the GDPR, our BCRs, U.S. state privacy laws, including the CPRA, and the EU Artificial Intelligence Act, may result in significant costs to our business and require us to amend certain of our business practices. Further, enforcement actions and investigations by regulatory authorities related to data security incidents and privacy violations continue to increase. The future enactment of more restrictive laws, rules or regulations and/or future enforcement actions or investigations could have a materially adverse impact on us through increased costs or restrictions on our businesses and noncompliance could result in significant regulatory penalties and legal liability and damage our reputation. In addition, data security events, concerns about privacy abuses by other companies and increased awareness of the potential (positive and negative) of AI are changing client, consumer and social expectations for enhanced protections (including with respect to bias and potential discrimination). As a result, noncompliance, the failure to meet such expectations or the perception of noncompliance or such failure, whether or not valid, may damage our reputation.

Previous wording

Our ability to compete and our success depend, in part, upon our intellectual property. We rely on patent, copyright, trade secret and trademark laws, and confidentiality or license agreements with our employees, clients, vendors, partners and others to protect our intellectual property rights. We may need to devote significant resources, including cybersecurity resources, to monitoring our intellectual property rights. In addition, the steps we take to protect our intellectual property rights may be inadequate or ineffective, or may not provide us with a significant competitive advantage. Our intellectual property (including source code) could be wrongfully acquired as a result of a cyber-attack or other wrongful conduct by third parties or our personnel, or as a result of increased use of generative AI tools by us or our vendors. Litigation brought to protect and enforce our intellectual property rights could be costly and time-consuming. Furthermore, our efforts to enforce our intellectual property rights may be met with defenses, counterclaims, and countersuits attacking the validity and enforceability of our intellectual property rights, which may be successful. In addition, use of AI tools may result in the release of confidential or proprietary information which could limit our ability to protect, or prevent us from protecting, our intellectual property rights.

Current wording

Our ability to compete and our success depend, in part, upon our intellectual property. We rely on patent, copyright, trade secret and trademark laws, and confidentiality or license agreements with our employees, clients, vendors, partners and others to protect our intellectual property rights. We may need to devote significant resources, including cybersecurity resources, to monitoring our intellectual property rights. In addition, the steps we take to protect our intellectual property rights may be inadequate or ineffective, or may not provide us with a significant competitive advantage. Our intellectual property (including source code) could be wrongfully acquired as a result of a cyber-attack or other wrongful conduct by third parties or our personnel, or as a result of increased use of AI tools, including generative and agentic AI, by us or our vendors. Litigation brought to protect and enforce our intellectual property rights could be costly and time-consuming. Furthermore, our efforts to enforce our intellectual property rights may be met with defenses, counterclaims, and countersuits attacking the validity and enforceability of our intellectual property rights, which may be successful. In addition, use of AI tools may result in the release of confidential or proprietary information which could limit our ability to protect, or prevent us from protecting, our intellectual property rights.

Previous wording

We are focused on safeguarding and protecting personal and business information and client funds, and we devote significant resources to maintain and regularly update our systems and processes. Nonetheless, the global environment continues to grow increasingly hostile as attacks on information technology systems continue to grow in frequency, complexity and sophistication (including due to the use of AI), and we are regularly targeted by unauthorized parties using malicious tactics, code and viruses. Certain of these unauthorized parties may be state-sponsored and/or supported by significant financial and technological resources. Although this is a global problem, it may affect our businesses more than other businesses because unauthorized parties (which could include our personnel) may focus on the amount and type of personal and business information that our businesses collect, host, store, transfer, process, disclose, use, secure, retain and dispose of, and the client funds that we collect and transmit.

Current wording

We are focused on safeguarding and protecting personal and business information and client funds, and we devote significant resources to maintain and regularly update our systems and processes. Nonetheless, the global environment continues to grow increasingly hostile as attacks on information technology systems continue to grow in frequency, speed, complexity, sophistication and effectiveness (including due to the use of AI), and we are regularly targeted by unauthorized parties using malicious tactics, code and viruses. Certain of these unauthorized parties may be state-sponsored and/or supported by significant financial and technological resources. Although this is a global problem, it may affect our businesses more than other businesses because unauthorized parties (which could include our personnel) may focus on the amount and type of personal and business information that our businesses collect, host, store, transfer, process, disclose, use, secure, retain and dispose of, and the client funds that we collect and transmit.

Previous wording

increasingly more complex and sophisticated (including due to the use of AI). In addition, new computing technologies, including quantum computing, new discoveries in the field of cryptography or other developments could result in a compromise or breach of the algorithms we or our authorized third parties use or have used to encrypt and protect data. We may fail to anticipate or detect these techniques and/or incidents for long periods of time and, even when we do so, we may be unable or fail to implement adequate or timely preventive or responsive measures. Our ability to address data or cybersecurity incidents may also depend on the timing and nature of assistance that may be provided from relevant governmental or law enforcement agencies. Hardware, software, applications or services that we develop or procure from authorized third parties, or are required by governmental or law enforcement agencies to install on our systems, may contain defects in design or manufacture or other problems that could (or in respect of third party software, may be designed to) compromise the confidentiality, integrity or availability of data or our systems. Unauthorized parties have also attempted to gain (and in certain cases have gained), and will continue to attempt to gain, access to our systems and facilities, and those of our authorized third parties, through fraud, trickery, and other methods of deceit, including using stolen identities to obtain employment with us or our authorized third parties as well as phishing and other social engineering techniques whereby attackers use end-user behaviors to distribute computer viruses and malware into our systems, our authorized third parties’ systems or otherwise compromise the confidentiality, integrity or availability of data or our systems. As these threats continue to evolve and increase (including due to the use of AI), we continue to invest significant resources, and may be required to invest significant additional resources, to modify and enhance our cybersecurity controls and to investigate and remediate any security vulnerabilities. In addition, as we become increasingly interconnected with our authorized third parties, the security risk of our networks and the larger ecosystem in which we operate is heightened. While our operating environments are designed to safeguard and protect confidential personal and business information, we do not have the ability to monitor the systems, personnel or physical facilities of, or the implementation or effectiveness of any safeguards by, our clients or our authorized third parties and, in any event, unauthorized parties have circumvented in the past, and may in the future be able to circumvent, those security measures. Information or system access obtained by unauthorized parties (which could include our personnel) resulting from successful attacks against our clients or our authorized third parties may, in turn, be used to attack and compromise our information technol…

Excerpt shortened here; the source contains the full paragraph.

Current wording

We have programs and processes in place designed to prevent, detect and respond to data or cybersecurity incidents. However, as a result of the complexity of our operating environment, the period over which hardware and software has been acquired or other reasons, our programs and processes may not be sufficient or adequate or may fail to prevent, detect or respond to a cybersecurity incident or identify and/or remediate a security vulnerability in our operating environment. The techniques used to obtain unauthorized access, disable or degrade service, or sabotage systems change frequently and are increasingly more complex, sophisticated and effective (including due to the use of AI). As AI technologies, including generative and agentic AI, continue to evolve, threat actors are increasingly leveraging these technologies to enhance the sophistication, scale, speed and effectiveness of cyberattacks making them more difficult to detect and defend against. The adoption and deployment of AI technologies within our and our authorized third parties’ solutions, services, and systems may also introduce novel security, data governance and operational risks. In addition, new computing technologies, including quantum computing, new discoveries in the field of cryptography or other developments could result in a compromise or breach of the algorithms we or our authorized third parties use or have used to encrypt and protect data. We may fail to anticipate or detect these techniques and/or incidents for long periods of time and, even when we do so, we may be unable or fail to implement adequate or timely preventive or responsive measures. Our ability to address data or cybersecurity incidents may also depend on the timing and nature of assistance that may be provided from relevant governmental or law enforcement agencies. Hardware, software, applications or services that we develop or procure from authorized third parties, or are required by governmental or law enforcement agencies to install on our systems, may contain defects in design or manufacture or other problems that could (or in respect of third party software, may be designed to) compromise the confidentiality, integrity or availability of data or our systems. Unauthorized parties have also attempted to gain (and in certain cases have gained), and will continue to attempt to gain, access to our systems and facilities, and those of our authorized third parties, through fraud, trickery, and other methods of deceit, including using stolen identities to obtain employment with us or our authorized third parties as well as phishing and other social engineering techniques whereby attackers use end-user behaviors to distribute computer viruses and malware into our systems, our authorized third parties’ systems or otherwise compromise the confidentiality, integrity or availability of data or our systems. As these threats continue to evolve and increase (including due to the use of AI), we continue to invest s…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

We have been, and expect we will continue to be, the subject of cybersecurity attacks, including unauthorized intrusion, malicious software infiltration, network disruption, denial of service, corruption of data, ransomware attack, insider threats, and theft of sensitive information (including our intellectual property). Although none of the cybersecurity incidents that we have identified to date have materially affected us, including our business strategy, operations, results of operations, or financial condition, we continue to face significant known and unknown cybersecurity threats. In the future, a cybersecurity attack, unauthorized intrusion, malicious software infiltration, network disruption, denial of service, corruption of data, ransomware attack, theft of non-public or other sensitive information, or similar act by an unauthorized party (which could include our personnel) with respect to our businesses or our authorized third parties’ businesses, or inadvertent acts or inactions by our authorized third parties or personnel, could result in the loss, disclosure or misuse of confidential personal or business information or our intellectual property or the theft of client or ADP funds, which could have a materially adverse effect on our business or results of operations or that of our clients, result in liability, litigation, regulatory investigations and sanctions or a loss of confidence in our ability to serve clients, or cause current or potential clients to choose another service provider. As the global environment continues to grow increasingly hostile, the security of our operating environment is ever more important to our clients and potential clients. As a result, the breach or perceived breach of our security systems or the security systems of our authorized third parties could result in a loss of confidence by our clients or potential clients and cause them to choose another service provider, which could have a materially adverse effect on our business, financial condition or results of operations.

Current wording

We have been, and expect we will continue to be, the subject of cybersecurity attacks, including unauthorized intrusion, malicious software infiltration, network disruption, denial of service, corruption of data, ransomware attack, insider threats, and theft of sensitive information (including our intellectual property). Although none of the cybersecurity incidents that we have identified to date have materially affected us, including our business strategy, operations, results of operations, or financial condition, we continue to face significant known and unknown cybersecurity threats. In the future, a cybersecurity attack, unauthorized intrusion, malicious software infiltration, network disruption, denial of service, corruption of data, ransomware attack, theft of non-public or other sensitive information, exploitation of previously unknown "zero-day" vulnerabilities, or similar act by an unauthorized party (which could include our personnel) with respect to our businesses or our authorized third parties’ businesses, or inadvertent acts or inactions by our authorized third parties or personnel, could result in the loss, disclosure or misuse of confidential personal or business information or our intellectual property or the theft of client or ADP funds, which could have a materially adverse effect on our business or results of operations or that of our clients, result in liability, litigation, regulatory investigations and sanctions or a loss of confidence in our ability to serve clients, or cause current or potential clients to choose another service provider. As the global environment continues to grow increasingly hostile, the security of our operating environment is ever more important to our clients and potential clients. As a result, the breach or perceived breach of our security systems or the security systems of our authorized third parties could result in a loss of confidence by our clients or potential clients and cause them to choose another service provider, which could have a materially adverse effect on our business, financial condition or results of operations.

Previous wording

past, these systems, applications or solutions have failed to operate properly or become disabled, and they may do so in the future. Any such failure or disablement, even for a brief period of time, whether due to malevolent acts, errors, defects or any other factor(s), could result in financial loss, a disruption of our businesses or operations, liability to clients, loss of clients, regulatory intervention or damage to our reputation, any of which could have a materially adverse effect on our business, results of operations or financial condition. We have a global business resiliency program that includes disaster recovery, business continuity, and crisis management plans and procedures designed to protect our businesses against a multitude of events, including natural disasters, military or terrorist actions, power or communication failures, or similar events. Despite our preparations, our plans and procedures may not be successful in preventing or mitigating the loss of client data or funds, service interruptions, disruptions to our operations, or damage to our important facilities. In addition, the severity of the failure or disablement may require us to replace or rebuild the affected system(s), application(s) or solution(s) and we may be unable to do so before it materially adversely affects our business or operations.

Current wording

Many of our businesses are highly dependent on our ability to process, on a daily basis, a large number of complicated transactions. We rely heavily on our payroll, financial, accounting, and other data processing systems. We need to properly manage our systems, applications and solutions, and any upgrades, enhancements and expansions we may undertake from time to time, in order to ensure they properly support our businesses. From time to time in the past, these systems, applications or solutions have failed to operate properly or become disabled, and they may do so in the future. Any such failure or disablement, even for a brief period of time, whether due to malevolent acts, errors, defects or any other factor(s), could result in financial loss, a disruption of our businesses or operations, liability to clients, loss of clients, regulatory intervention or damage to our reputation, any of which could have a materially adverse effect on our business, results of operations or financial condition. We have a global business resiliency program that includes disaster recovery, business continuity, and crisis management plans and procedures designed to protect our businesses against a multitude of events, including natural disasters, military or terrorist actions, power or communication failures, or similar events. Despite our preparations, our plans and procedures may not be successful in preventing or mitigating the loss of client data or funds, service interruptions, disruptions to our operations, or damage to our important facilities. In addition, the severity of the failure or disablement may require us to replace or rebuild the affected system(s), application(s) or solution(s) and we may be unable to do so before it materially adversely affects our business or operations.

Previous wording

We host our applications and serve our clients with data centers that we operate, and with data centers that are operated, and cloud-computing and other technology services and systems that are provided, by third-party vendors. These data centers or cloud-computing and other technology services and systems have failed, become disabled or been disrupted, and may do so in the future. Any failure, disablement or disruption, even for a limited period of time, could disrupt our businesses or operations and we could suffer financial loss, liability to clients, loss of clients, regulatory intervention or damage to our reputation, any of which could have a material adverse effect on our business, results of operations or financial condition. In addition, our third-party vendors may cease providing data center facilities or cloud-computing or other technology services or systems (including those on which our products or services are based), elect to not renew their agreements or licenses with us on commercially reasonable terms or at all, breach their agreements or licenses with us or fail to satisfy our expectations, which could disrupt our operations and require us to incur costs which could materially adversely affect our results of operations or financial condition.

Current wording

We host our applications and serve our clients with data centers that we operate, and with data centers that are operated, and cloud-computing and other technology services and systems that are provided, by third-party vendors. These data centers or cloud-computing and other technology services and systems have failed, become disabled or been disrupted, and may do so in the future. As our reliance on these third-party services and systems increases, particularly on third-party cloud computing platforms, our exposure to service interruptions and performance or quality issues could be impacted. Any failure, disablement or disruption, even for a limited period of time, could disrupt our businesses or operations and we could suffer financial loss, liability to clients, loss of clients, regulatory intervention or damage to our reputation, any of which could have a material adverse effect on our business, results of operations or financial condition. In addition, our third-party vendors may cease providing data center facilities or cloud-computing or other technology services or systems (including those on which our products or services are based), elect to not renew their agreements or licenses with us on commercially reasonable terms or at all, breach their agreements or licenses with us or fail to satisfy our expectations, which could disrupt our operations and require us to incur costs which could materially adversely affect our results of operations or financial condition.

Previous wording

Our businesses operate in industries that are subject to rapid technological advances (such as AI) and changing client needs and preferences. In order to remain competitive and responsive to client demands, we continually upgrade, enhance, and expand our technology, solutions and services, including by leveraging AI in our solutions. If we fail to respond successfully to technology challenges and client needs and preferences or our competitors or other third parties respond to such challenges more quickly or successfully than us, the demand for our solutions and services may diminish. As new technologies (such as AI) continue to emerge, they may be disruptive to the HCM industry. These technologies could result in new and innovative HCM products and solutions that could increase competition, place us at a competitive disadvantage or even render obsolete our technology, products and solutions. In addition, investment in product development and new technologies often involves a long return on investment cycle. We have made and expect to continue to make significant investments in product development and new technologies. We must continue to dedicate a significant amount of resources to our development efforts before knowing to what extent our investments will result in products the market will accept. In addition, our business could be adversely affected in periods surrounding our new product introductions if clients delay purchasing decisions to evaluate the new product offerings. Furthermore, we may not execute successfully on our product development strategy, including because of challenges with regard to product planning and timing and technical hurdles that we fail to overcome in a timely fashion. We may fail to realize all the economic benefit of our investment in the development of a product which could cause an impairment of goodwill or intangibles and result in a significant charge to earnings.

Current wording

Our businesses operate in industries that are subject to rapid technological advances (such as generative and agentic AI) and changing client needs and preferences. In order to remain competitive and responsive to client demands, we continually upgrade, enhance, and expand our technology, solutions and services, including by leveraging AI in our solutions. If we fail to respond successfully to technology challenges and client needs and preferences or our competitors or other third parties respond to such challenges more quickly or successfully than us, the demand for our solutions and services may diminish. As new technologies (such as generative and agentic AI) continue to emerge, they may be disruptive to the HCM industry. These technologies could result in new and innovative HCM products and solutions that could increase competition, place us at a competitive disadvantage or even render obsolete our technology, products and solutions. In addition, investment in product development and new technologies often involves a long return on investment cycle. We have made and expect to continue to make significant investments in product development and new technologies. We must continue to dedicate a significant amount of resources to our development efforts before knowing to what extent our investments will result in products the market will accept. In addition, our business could be adversely affected in periods surrounding our new product introductions if clients delay purchasing decisions to evaluate the new product offerings. Furthermore, we may not execute successfully on our product development strategy, including because of challenges with regard to product planning and timing and technical hurdles that we fail to overcome in a timely fashion. We may fail to realize all the economic benefit of our investment in the development of a product which could cause an impairment of goodwill or intangibles and result in a significant charge to earnings.

Previous wording

duration and scope of the event; the governmental and business actions taken in response thereto; actions taken by the Company in response thereto and the related costs; the impact on economic activity and employment levels; the effect on our clients, prospects, suppliers and partners; our ability to sell and provide our solutions and services, including due to travel restrictions, business and facility closures, and employee remote working arrangements; the ability of our clients or prospects to pay for our services and solutions; and how quickly and to what extent normal economic and operating conditions can resume. In addition, clients or prospects may delay decision making, demand pricing and other concessions, reduce the value or duration of their orders, delay planned work or seek to terminate existing agreements. Our business is also impacted by employment levels across our clients, as we have varied contracts throughout our business that blend base fees and per-employee fees.

Current wording

Such events may create significant volatility and uncertainty and economic and financial market disruption. The extent of any such impact depends on developments which are highly uncertain and cannot be predicted, including the duration and scope of the event; the governmental and business actions taken in response thereto; actions taken by the Company in response thereto and the related costs; the impact on economic activity and employment levels; the effect on our clients, prospects, suppliers and partners; our ability to sell and provide our solutions and services, including due to travel restrictions, business and facility closures, and employee remote working arrangements; the ability of our clients or prospects to pay for our services and solutions; and how quickly and to what extent normal economic and operating conditions resume. In addition, clients or prospects may delay decision making, demand pricing and other concessions, reduce the value or duration of their orders, delay planned work or seek to terminate existing agreements. Our business is also impacted by employment levels across our clients, as we have varied contracts throughout our business that blend base fees and per-employee fees.

Previous wording

Trade, monetary and fiscal policies, and political and economic conditions may substantially change, and credit markets may experience periods of constriction and volatility. A slowdown in the economy or other negative changes, including in employment levels, the level of interest rates or the level of inflation, may have a negative impact on our businesses. In addition, as our operating costs increase due to inflationary pressure or otherwise, we may not be able to offset these increases by corresponding price increases for our products and solutions. Clients may react to worsening conditions by reducing their spending on HCM services or renegotiating their contracts with us, which may adversely affect our business and financial results.

Current wording

Trade, including the imposition of tariffs or other trade restrictions, monetary and fiscal policies, and political and economic conditions may substantially change, and credit markets may experience periods of constriction and volatility. A slowdown in the economy or other negative changes, including in employment levels (as a result of AI or otherwise), the level of interest rates or the level of inflation, may have a negative impact on our businesses. In addition, as our operating costs increase due to inflationary pressure or otherwise, we may not be able to offset these increases by corresponding price increases for our products and solutions. Clients may react to worsening conditions by reducing their spending on HCM services or renegotiating their contracts with us, which may adversely affect our business and financial results.

Previous wording

regulations, standards and reporting requirements in this respect continue to evolve, and may be inconsistent across jurisdictions, which may result in legal and regulatory uncertainty as well as increased compliance costs for our business. Our failure to achieve progress in these areas on a timely basis, or at all, our failure to fully comply with these requirements, or our failure to do so in a timely manner, or a negative perception of our initiatives could adversely impact our reputation, business, including employee recruitment and retention, financial results, and growth.

Current wording

The investment community, clients, regulators, and other stakeholders may have evolving and varied expectations regarding our business, culture, and values. Negative publicity, regardless of whether claims are accurate, about our brand, our solutions, our data, our culture and values, or our partners, vendors, or employees, could adversely affect our reputation, our business, and our financial results. We publicly share certain information about our corporate social responsibility initiatives and we may face increased scrutiny related to these initiatives. Further, regulations, standards and reporting requirements in this respect continue to evolve, and may be inconsistent across jurisdictions, which may result in legal and regulatory uncertainty as well as increased compliance costs for our business. Our failure to achieve progress in these areas on a timely basis, or at all, our failure to fully comply with these requirements, or our failure to do so in a timely manner, or a negative perception of our initiatives could adversely impact our reputation, business, including employee recruitment and retention, financial results, and growth.

Previous wording

Our ability to grow and provide our clients with competitive services is, to an important degree, dependent on our ability to attract and retain highly skilled and motivated people reflecting diverse perspectives and the diversity of our communities and clients. Competition for skilled employees in the outsourcing and other markets in which we operate is increasingly intense, making it more difficult and expensive to attract and retain highly skilled, motivated and diverse personnel. If we are unable to attract and retain highly skilled, motivated and diverse personnel, results of our operations and culture may suffer.

Current wording

Our ability to grow and provide our clients with competitive services is, to an important degree, dependent on our ability to attract and retain highly skilled and motivated people reflecting the diversity of our communities and clients. Competition for skilled employees in the outsourcing and other markets in which we operate is increasingly intense, making it more difficult and expensive to attract and retain highly skilled, motivated and diverse personnel. If we are unable to attract and retain highly skilled, motivated and diverse personnel, results of our operations and culture may suffer.