S&P Global Inc.

Previous wording

We operate in the capital, commodity, and automotive markets. The capital markets include asset managers, investment banks, commercial banks, insurance companies, exchanges, trading firms, and issuers; the commodity markets include producers, consumers, traders and intermediaries within energy, chemicals, shipping, metals, carbon and agriculture; and the automotive markets include manufacturers, suppliers, dealerships, service shops and customers. Certain risk factors are applicable to certain of our individual segments while other risk factors are applicable Company-wide.

Current wording

We are a global, diversified, and highly differentiated provider of benchmarks, data, analytics and workflow solutions in the global capital, energy and commodity, and automotive markets. The capital markets include asset managers, investment banks, commercial banks, insurance companies, exchanges, trading firms and issuers; the energy and commodity markets include producers, consumers, traders and intermediaries within energy, chemicals, shipping, metals, carbon and agriculture; and the automotive markets include manufacturers, suppliers, dealerships, service shops and customers. Certain risk factors are applicable to certain of our individual segments while other risk factors are applicable Company-wide.

Previous wording

Our size, scale and role in the global markets increases our risk for cyber attacks and other cyber-security risks. Our information systems and networks and those of our third-party service providers are exposed to risks related to cybersecurity and protection of confidential information, including material non-public information, which could have a material adverse effect on our business, financial condition or results of operations.

Current wording

Our size, scale and role in the global markets increases our exposure to cyber attacks and other cyber-security risks. Our information systems and networks and those of our third-party service providers are exposed to risks related to cybersecurity and protection of confidential information, including material non-public information, which could have a material adverse effect on our business, financial condition or results of operations.

Previous wording

•Our operations rely on the secure processing, storage and transmission of confidential, sensitive and other types of data and information in our information systems and networks and those of our third-party service providers, including our vendors. Cyber threats continue to evolve and are increasingly difficult to detect and successfully defend against. As a result, cyber threats have in the past and may in the future defeat the measures that we or our third-party service providers take to anticipate, detect, avoid, or mitigate such threats.

Current wording

•Our operations rely on the secure processing, storage and transmission of confidential, sensitive and other types of data and information by our information systems and networks and those of our third-party service providers, including our vendors, data partners and distribution partners. Cyber threats continue to evolve and are increasingly difficult to detect and successfully defend against. As a result, cyber threats have in the past and may in the future defeat the measures that we or our third-party service providers take to anticipate, detect, avoid, or mitigate such threats.

Previous wording

•The cyber threats we and our third-party service providers (including our vendors) face are rapidly evolving and are becoming increasingly sophisticated (including through the use of generative artificial intelligence ("AI")) and include denial of service attacks, ransomware, spyware, phishing/smishing/vishing attacks, business compromise attacks, employee errors, negligence or malfeasance, the use of malicious codes or worms, payment fraud, and other unauthorized occurrences on, or conducted through, our or our third-party service providers’ (including our vendors’) information systems and networks, originating from a wide variety of sources, including criminals, terrorists, nation states, financially motivated actors, internal actors, and external service providers. The cyber risks the Company faces range from cyber attacks common to most industries, to more sophisticated and targeted attacks, including attacks carried out by state-sponsored actors, intended to obtain unauthorized access to certain information or information systems or networks due in part to our prominence in the global marketplace, such as our ratings on debt issued by sovereigns and corporate issuers, our impending methodology changes in our benchmarks businesses, or the composition of our indices. Our third-party service providers, including our vendors, are also the subject of a variety of cyber attacks, including attacks carried out by state-sponsored actors.

Current wording

•The cyber threats we and our third-party service providers (including our vendors, data partners and distribution partners) face are rapidly evolving and are becoming increasingly sophisticated and include denial of service attacks, ransomware, spyware, misinformation, phishing/smishing/vishing attacks, business compromise attacks, typosquatting, automated attacks, employee errors, negligence or malfeasance, the use of malicious codes or worms, payment fraud, and other unauthorized occurrences on, or conducted through, our or our third-party service providers’ (including our vendors’, data partners’ and distribution partners’) information systems and networks, originating from a wide variety of sources, including criminals, terrorists, state-sponsored actors, financially motivated actors, internal actors, and external service providers. The cyber risks the Company faces range from cyber attacks common to most industries, to more sophisticated and targeted attacks, including attacks carried out by state-sponsored actors, intended to obtain unauthorized access to certain information or information systems or networks due in part to our prominence in the global marketplace, such as our ratings on debt issued by sovereigns and corporate issuers, our impending methodology changes in our benchmarks businesses, or the composition of our indices. Our third-party service providers, including our vendors, data partners and distribution partners, are also the subject of a variety of cyber attacks, including attacks carried out by state-sponsored actors.

Previous wording

•We and our third-party service providers, including our vendors, experience cyber attacks, data breaches and other cyber threats of varying degrees on a regular basis. The volume of such attacks, breaches and threats has increased over the years and we expect that volume to continue to increase. Breaches of our or our third-party service providers’ (including our vendors’) information systems and networks may cause material interruptions or malfunctions in our or such third-party’s websites, applications or data processing, or may compromise the confidentiality and integrity of material information regarding us, our business or our customers. Although we have not experienced a cyber attack or data breach that has had a material adverse effect on us, we may experience such an event in the future.

Current wording

•We and our third-party service providers, including our vendors, data partners and distribution partners, experience cyber attacks, data breaches and other cyber threats of varying degrees on a regular basis. The volume of such attacks, breaches and threats has increased over the years and we expect that volume to continue to increase. Breaches of our or our third-party service providers’ (including our vendors’, data partners’ and distribution partners’) information systems and networks may cause material interruptions or malfunctions in our or such third-party’s websites, applications or data processing, or may compromise the confidentiality and integrity of material information regarding us, our business or our customers. Although we have not experienced a cyber attack or data breach that has had a material adverse effect on us to date, we may experience such an event in the future.

Previous wording

•In the ordinary course of business, we are exposed to vulnerabilities in widely deployed third-party software. While such vulnerabilities have not resulted in a material adverse effect on the Company, they require us to devote time and resources to remediation on a regular basis. Notwithstanding our efforts, we may suffer a material adverse effect resulting from such vulnerabilities in the future.

Current wording

•In the ordinary course of business, we are exposed to vulnerabilities in widely deployed third-party software. While such vulnerabilities have not resulted in a material adverse effect on the Company to date, they require us to devote time and resources to remediation on a regular basis. Notwithstanding our efforts, we may suffer a material adverse effect on our business, financial condition or results of operations resulting from such vulnerabilities in the future.

Previous wording

•Misappropriation, improper modification, destruction, corruption or unavailability of our data and information, including personal data, due to cyber incidents, attacks or other security breaches, or the perception of such an occurrence, could damage our brand and reputation, result in litigation, regulatory actions, sanctions or other statutory penalties, or lead to loss of customer confidence in our security measures and reliability. While such incidents have not had a material impact on the Company to date, future incidents could materially harm our ability to retain customers and gain new ones, result in financial losses that are either not insured against or not fully covered through any insurance maintained by us, and lead to increased expenses related to addressing or mitigating the risks associated with any such incidents. We may be required to expend significant resources to mitigate the impact of any errors, interruptions, delays or cessations of service and we may have insufficient recourse against our third-party service providers, including our vendors. Additionally, our failure to timely or accurately communicate cyber incidents to relevant parties, including as a result of a failure of our third-party service providers, including our vendors, to inform us of incidents impacting their information systems or networks in a timely manner could result in regulatory or litigation risk, and reputational harm.

Current wording

•Misappropriation, improper modification, destruction, corruption or unavailability of our data and information, including personal data, due to cyber incidents, attacks or other security breaches, or the perception of such an occurrence, could damage our brand and reputation, result in litigation, regulatory actions, sanctions or other statutory penalties, or lead to loss of customer confidence in our security measures and reliability. While such incidents have not had a material impact on the Company to date, future incidents could materially harm our ability to retain customers and gain new ones, result in financial losses that are either not insured against or not fully covered through any insurance maintained by us, and lead to increased expenses related to addressing or mitigating the risks associated with any such incidents. We may be required to expend significant resources to mitigate the impact of any errors, interruptions, delays or cessations of service and we may have insufficient recourse against our third-party service providers, including our vendors, data partners and distribution partners. Additionally, our failure to timely or accurately communicate cyber incidents to relevant parties, including as a result of a failure of our third-party service providers, including our vendors, data partners and distribution partners, to inform us of incidents impacting their information systems or networks in a timely manner could result in regulatory or litigation risk, and reputational harm.

Previous wording

•We devote significant resources to maintain and regularly update our systems and processes that are designed to protect the security of our information systems, software, networks and other technology assets and the confidentiality, integrity and availability of information belonging to the enterprise and our customers, clients and employees. However, such measures may be circumvented or become obsolete, and additional measures that we take to prevent or mitigate cyber incidents may be expensive or ineffective.

Current wording

•We devote significant resources to maintain and regularly update our systems and processes that are designed to protect the security of our information systems, software, networks and other technology assets and the confidentiality, integrity and availability of information belonging to the enterprise and our customers and employees, and we expect to continue to expend significant additional resources to bolster these protections. However, such measures cannot provide absolute security and may be circumvented or become obsolete, and additional measures that we take to prevent or mitigate cyber incidents may be expensive or ineffective. Additionally, fragmented security tooling could create visibility gaps and increase the risk of missed threats and slower response.

Previous wording

•While we conduct cyber due diligence during the acquisition process, following the completion of acquisitions, we have identified weaknesses and vulnerabilities in acquired entities’ information systems and networks, which expose us to unexpected liabilities or make our own information systems or networks more vulnerable to a cyber attack.

Current wording

•We conduct cyber due diligence during the acquisition process; however, following the completion of acquisitions, we from time to time identify weaknesses and vulnerabilities in acquired entities’ information systems and networks, which expose us to unexpected liabilities or make our own information systems or networks more vulnerable to a cyber attack.

Previous wording

The markets in which we operate continuously change to adapt to customer needs. Our inability to innovate and compete with new or enhanced products and services of our competitors could impact our profitability.

Current wording

Our inability to innovate and compete with new or enhanced products and services of our competitors could have a material adverse effect on our business, financial condition or results of operations.

Previous wording

We operate in highly competitive markets that continuously change to adapt to customer needs. We could experience material threats to our existing businesses from the rise of new competitors due to the rapidly changing environment in which we operate. For instance, new competitors are leveraging AI in their offerings in ways that could materially reduce demand for our products and services (for example, by deploying AI in ways that make processing of information relatively inexpensive or free or by leveraging AI to build indices or ETFs). In order to maintain a competitive position, we invest in innovation, new offerings and enhancements, including new ways to deliver our products and services (including through AI). These new or enhanced offerings resulting from our investments sometimes do not, and may not in the future, achieve market acceptance, profit or the level of profitability that we expect or have experienced historically.

Current wording

We operate in highly competitive markets that continuously change to adapt to customer needs. We could experience material threats to our businesses from new or existing competitors due to the rapidly changing environment in which we operate. In order to maintain a competitive position, we invest in innovation, new offerings and enhancements, including new ways to deliver our products and services. These new or enhanced offerings resulting from our investments sometimes do not, and may not in the future, achieve market acceptance, profit or the level of profitability that we expect or have experienced historically. Our inability to innovate and compete with new or enhanced products and services of our competitors could have a material adverse effect on our business, financial condition or results of operations.

Previous wording

•Innovation and constant development in support of new products and enhancements to existing products calls for the implementation of new and improved processes and technologies that require related change management efforts. While we employ a certain level of internal and external resources to mitigate the risks associated with implementing process and technology improvements, new processes and technologies that are still in development tend to be subject to more risks than established processes and technologies. For instance, we are incorporating AI in internal operations across our Company, which subjects us to a variety of risks, as further described in the risk factor entitled “Our approach to AI may not be successful, which could materially and adversely affect our business, financial condition or results of operations.” Additionally, certain of our new processes require manual data entry or collection before they can be automated, which subjects them to greater risk of human error. We may also face unexpected challenges in execution that may require more management attention than expected, thus diverting management time and energy from other businesses. The foregoing and other unforeseen factors could also result in additional commitments of financial resources and business disruptions.

Current wording

•Innovation and constant development in support of new products and enhancements to existing products calls for the implementation of new and improved processes and technologies that require related change management efforts. While we employ a certain level of internal and external resources to mitigate the risks associated with implementing process and technology improvements, new processes and technologies that are still in development tend to be subject to more risks than established processes and technologies. Additionally, certain of our new processes require manual data entry or collection before they can be automated, which subjects them to greater risk of human error. We may also face unexpected challenges in execution that may require more management attention than expected, thus diverting management time and energy from other businesses. The foregoing and other unforeseen factors could also result in additional commitments of financial resources and business disruptions.

Previous wording

•We have transitioned an important portion of our technology to a cloud-based infrastructure, which is complex, time consuming, and involves substantial expenditures. Our utilization of cloud services is critical to developing and providing products and services to our customers, scaling our business for future growth, accurately maintaining data and otherwise operating our business; any such implementation involves risks inherent in the conversion to a new system, including loss of information and potential disruption to our normal operations. We may discover material deficiencies in our design or implementation or maintenance of the new cloud-based systems that could adversely affect our business. Disruptions to either the outsourced systems or the communication links between us and the outsourced supplier negatively affect our ability to operate our data systems, and impair our ability to provide services to our customers.

Current wording

•We have transitioned an important portion of our technology to a cloud-based infrastructure, which is complex, time consuming, and involves substantial expenditures. Our utilization of cloud services is critical to developing and providing products and services to our customers, scaling our business for future growth, maintaining data and otherwise operating our business; any such implementation involves risks inherent in the conversion to a new system, including loss of information and potential disruption to our normal operations. We may discover material deficiencies in our design or implementation or maintenance of the new cloud-based systems that could adversely affect our business. Disruptions to either the outsourced systems or the communication links between us and the outsourced supplier negatively affect our ability to operate our data systems, and impair our ability to provide services to our customers.

Previous wording

Increased availability of free or relatively inexpensive information sources may materially reduce demand for our products and could have a material adverse effect on our business, financial condition or results of operations.

Current wording

Increased availability of free or relatively inexpensive information sources may materially reduce demand for our products and services and could have a material adverse effect on our business, financial condition or results of operations.

Previous wording

In recent years, more public sources of free or relatively inexpensive information have become available, particularly through the Internet, and advances in public cloud computing and open source software are expected to continue. Moreover, AI is being used in a way that is significantly increasing access to publicly available free or relatively inexpensive information. Given the importance of data to our products and services, the continued growth of publicly available free or relatively inexpensive information could materially reduce demand for our products and services. Demand could also be materially reduced as a result of cost-cutting initiatives at certain companies and organizations that choose to use publicly available free or relatively inexpensive information rather than pay for our products and services. Although we believe our products are enhanced by our analysis, tools, delivery mechanisms and applications, if a large number of smaller customers or a critical number of larger customers choose to use public sources of free or relatively inexpensive information as a substitute for our products or services, it could have a material adverse effect on our business, financial condition or results of operations.

Current wording

In recent years, more public sources of free or relatively inexpensive information have become available, and advances in public cloud computing and open source software are expected to continue. Given the importance of data to our products and services, the continued growth of publicly available free or relatively inexpensive information could materially reduce demand for our products and services. Demand could also be materially reduced as a result of cost-cutting initiatives at certain companies and organizations that choose to use publicly available free or relatively inexpensive information over our products and services. Although we believe our products and services are enhanced by our analysis, tools, delivery mechanisms and applications, if a large number of smaller customers or a critical number of larger customers choose to use public sources of free or relatively inexpensive information as a substitute for our products or services, it could have a material adverse effect on our business, financial condition or results of operations.

Previous wording

Our approach to AI may not be successful, which could materially and adversely affect our business, financial condition or results of operations.

Current wording

Artificial Intelligence ("AI") presents new and evolving risks, and our approach to AI may not be successful, which could materially and adversely affect our business, financial condition or results of operations.

Previous wording

AI is an emerging technology that is fundamentally changing the way data is gathered, produced, protected, licensed, processed, and consumed. Given the importance of data to our products and services, AI continues to be an increasingly important part of our business and industry. We have established a Company-wide AI strategy to drive our approach to data protection, licensing and AI integration in our processes, products and services. We have made significant investments in various AI initiatives. However, the AI landscape is complex and rapidly evolving, and new and enhanced laws and regulations (or inadequate laws or regulations), governmental or regulatory scrutiny, competition from established or emerging companies, litigation, ethical concerns, cybersecurity concerns, intellectual property concerns, or other complications could materially and adversely impact our ability to protect our data and intellectual property, to develop and offer products and services that effectively use AI, to compete with other AI products or services, to improve efficiency of existing products or services through the effective use of AI to remain competitive, or to incorporate AI in our internal operations, or could materially increase our burden and cost of research, development and regulatory compliance. As discussed in the risk factor entitled “The markets in which we operate continuously change to adapt to customer needs. Our inability to innovate and compete with new or enhanced products and services of our competitors could impact our profitability,” competitors are deploying AI in ways that could materially reduce demand for our products and services. Additionally, we may be unable to protect our data from unintended use or access by third-party AI systems. For additional risks related to intellectual property rights, see the risk factor entitled “Our ability to protect our intellectual property rights could impact our competitive position.” The development, testing and deployment of AI systems requires continued investment and may materially increase the cost profile of our offerings due to the nature of the computing cost involved in such systems. In addition, the number of approaches to integrating and commercializing AI is currently large, and many of those approaches may fail to gain market acceptance or become obsolete as AI continues to evolve. At this time, we are unable to predict which offerings will ultimately be successful. Notwithstanding our investments, our products and services may become less marketable or less competitive, or potentially obsolete if either our approach to integrating AI into our products and services fails to gain market acceptance or our approach to protecting our data and intellectual property is ultimately inadequate. Any of these factors could materially and adversely affect our business, financial condition or results of operations.

Current wording

AI is a rapidly evolving technology that is fundamentally changing the way data is gathered, produced, protected, licensed, processed, and consumed. Given the importance of data to our products and services, AI continues to be an increasingly important part of our business and industry. While we have established a Company-wide AI strategy to drive our approach to data protection, licensing and AI integration in our processes, products and services, AI creates a number of evolving risks and opportunities and can exacerbate other risks, including those described herein:

Previous wording

Many of our offerings use new and evolving technologies, such as AI. These new and evolving technologies often present social and ethical risks and challenges that could affect their adoption, and therefore our business. For example, the use of AI could lead to harmful consequences such as accuracy issues, unintended biases or discriminatory outputs. Enabling or offering solutions that draw controversy due to their perceived or actual impact on society or failing to properly remediate any social or ethical issues that may arise in our offerings may result in material brand or reputational harm, competitive harm, legal liability or loss of public confidence, or a material reduction to the marketability or competitiveness of our products and services. For our AI products and services to be competitive in the evolving and continually developing AI landscape, we must apply resources and make investments to secure such competitiveness and to ensure that our AI products and services are developed and implemented in a way to minimize unintended and harmful impacts. In addition, our failure to continue development and adoption of ethical and transparent policies and procedures related to AI could negatively impact our reputation and customer confidence. Any of these social, ethical or operational issues could materially and adversely affect our business, financial condition or results of operations.

Current wording

•AI presents risks and challenges that could affect its adoption, including social and ethical risks. For example, our products and services with AI capabilities may contain errors or defects that lead to privacy concerns, accuracy issues, unintended biases or discriminatory outputs. Errors or defects may exist during any part of a product’s life cycle and may persist notwithstanding testing and/or other quality assurance practices. Inadequate internal oversight or testing within the Company increases the risk that such errors or defects may not be detected or mitigated. Failing to properly remediate any social or ethical issues that may arise in our offerings may result in material brand or reputational harm, competitive harm, legal liability or loss of public confidence, or a material reduction to the marketability or competitiveness of our products and services. In addition, our failure to continue development and adoption of ethical and transparent policies and procedures related to AI could negatively impact our reputation and customer confidence. Any of these social, ethical or operational issues could materially and adversely affect our business, financial condition or results of operations.

Previous wording

We use open source software in our technology, most often as small components within a larger product or service. Open source code is also contained in some third-party software we rely on. The terms of many open source licenses are ambiguous and have not been interpreted by United States (“U.S.”) or other courts. These licenses could be construed in a manner that imposes unanticipated conditions or restrictions on our ability to commercialize our products and services, licenses the software on unfavorable terms, or requires us to re-engineer our products and services or take other remedial actions, any of which could have a material adverse effect on our business. We could also be subject to suits by parties claiming breach of the terms of licenses, which could be costly for us to defend.

Current wording

We use open source software in our technology, most often as small components within a larger product or service. Open source code is also contained in some third-party software we rely on. The terms of many open source licenses are ambiguous and have not been interpreted by United States (“U.S.”) or other courts. These licenses could be construed in a manner that imposes unanticipated conditions or restrictions on our ability to commercialize our products and services, licenses the software on unfavorable terms or requires us to seek licenses from third parties to offer our products and services, or requires us to re-engineer our products and services or take other remedial actions, any of which could have a material adverse effect on our business, financial condition or results of operations. We could also be subject to suits by parties claiming breach of the terms of licenses, which could be costly for us to defend.

Previous wording

Our ability to protect our intellectual property rights could impact our competitive position.

Current wording

Our inability to adequately obtain, protect and maintain our intellectual property and other proprietary rights could impact our competitive position.

Previous wording

•Our products contain intellectual property delivered through a variety of digital and other media. Our ability to achieve anticipated results depends in part on our ability to defend our intellectual property rights against infringement and misappropriation. Our business, financial condition or results of operations could be materially and adversely affected by inadequate or changing legal and technological protections for intellectual property and proprietary rights in some jurisdictions and markets. For example, the legal landscape with respect to AI is rapidly evolving, and we do not yet know whether intellectual property laws and regulations in the jurisdictions in which we operate will enable us to effectively protect our intellectual property rights from unintended use by AI. Additionally, we do business in a number of countries included on the Priority Watch List maintained by the Office of the United States Trade Representative which are currently thought to afford less protection to intellectual property rights generally than some other jurisdictions. The lack of strong patent and other intellectual property protection in jurisdictions in which we operate increases our vulnerability regarding unauthorized disclosure or use of our intellectual property and undermines our competitive position. In addition, even in jurisdictions where there are strong protections for intellectual property rights, our ability to enforce our intellectual property rights may be impacted by the number of competitors attempting to infringe or misappropriate our intellectual property.

Current wording

•We have filed for patents in the U.S. and in certain international jurisdictions, but such protections can be expensive and may not be available in all countries in which we operate or in which we seek to enforce such rights, or may be difficult to enforce in practice. We have filed for trademark registrations and participated in trademark enforcement and trademark oppositions in the U.S. and certain international jurisdictions to protect our brand, good will and reputation. These efforts cannot ensure registrations will be issued, our trademark rights will be enforced, or violations of our trademark rights will be appropriately resolved. We do business in a number of countries included on the Priority Watch List and/or Watch Lists maintained by the Office of the United States Trade Representative which are currently thought to afford less protection to intellectual property rights generally than some other jurisdictions. The lack of strong patent and other intellectual property protection in jurisdictions in which we operate increases our vulnerability regarding unauthorized disclosure or use of our intellectual property and undermines our competitive position. In addition, even in jurisdictions where there are strong protections for intellectual property rights, our ability to enforce our intellectual property rights may be impacted by the number of competitors or other third parties attempting to infringe or misappropriate our intellectual property, and the time and resources required to defend against such unauthorized uses.

Previous wording

•We consider many of our products and services to be proprietary. Failure to protect our intellectual property adequately could harm the value of and revenue generated by such assets as well as our reputation and affect our ability to compete effectively. Businesses we acquire may also have intellectual property portfolios which increase the complexity of managing our intellectual property portfolio and protecting our competitive position.

Current wording

•There can be no assurance that any future patent, trademark, or other intellectual property registrations will be issued for our pending or future applications or that any of our current or future patents, trademarks or other intellectual property rights will be valid, enforceable, sufficiently broad in scope, provide adequate protection of our technology or other proprietary rights, or provide us with any competitive advantage. Any additional investment in protecting our intellectual property rights through additional trademark, patent or other intellectual property filings could be time consuming and expensive, both in terms of application and maintenance costs. We make business decisions about whether and where to seek patent, copyright, and trademark protection for a particular technology and when to rely upon trade secret protection, and the approach we select may ultimately prove to be inadequate. Businesses we acquire may also have intellectual property portfolios which increase the complexity of managing our intellectual property portfolio and protecting our competitive position. Failure to obtain, protect and maintain our intellectual property adequately could harm the value of, and revenue generated by, such assets as well as harm our reputation and affect our ability to compete effectively.

Previous wording

•Our products also contain intellectual property of third-party sources. Any claims by third parties that we violated their intellectual property rights could result in termination of the relevant source agreement, litigation or reputational damage, or may require us to enter into royalty and licensing agreements on unfavorable terms or to stop selling or redesign affected products, which could materially and adversely affect our business, financial condition or results of operations.

Current wording

•Our products also contain intellectual property of third-party sources. From time to time, we face claims by third parties that we violated their intellectual property rights, which may result in termination of the relevant source agreement, litigation or reputational damage, or may require us to enter into royalty and licensing agreements on unfavorable terms or to stop selling or redesign affected products.

Previous wording

•Our products and services are delivered electronically, and our customers rely on our ability to process transactions rapidly and deliver substantial quantities of data on computer-based networks. Our customers also depend on the continued capacity, reliability and security of our electronic delivery systems, our websites and the Internet.

Current wording

•Our products and services are delivered electronically, and our customers rely on our ability to process transactions rapidly and deliver substantial quantities of data on computer-based networks. Our customers also depend on the continued capacity, reliability, resiliency, and security of our electronic delivery systems, our websites and the Internet.

Previous wording

•Our ability to deliver our products and services electronically may be impaired due to infrastructure or network failures, malicious or defective software, human error, natural disasters, service outages at third-party Internet providers or increased government regulation. Delays in our ability to deliver our products and services electronically may harm our reputation and result in the loss of customers.

Current wording

•Our ability to deliver our products and services electronically may be impaired due to infrastructure or network failures, malicious or defective software, human error, natural disasters, service outages at cloud or third-party Internet providers or increased government regulation. Delays in our ability to deliver our products and services electronically may harm our reputation and result in the loss of customers.

Previous wording

•Our ability to conduct business may be materially and adversely impacted by a disruption in the infrastructure that supports our businesses and the communities in which we are located, including New York City, the location of our headquarters, and major cities worldwide in which we have offices.

Current wording

•Our ability to conduct business may be materially and adversely impacted by a disruption in the infrastructure that supports our businesses and the communities in which we are located, including New York City, the location of our headquarters, and major cities worldwide in which we have offices and operations.

Previous wording

•This may include a disruption involving physical or technological infrastructure used by us or third parties with or through whom we conduct business, whether due to human error, natural disasters, power loss, telecommunication failures, cyber attacks, data breaches, break-ins, sabotage, intentional acts of vandalism, acts of terrorism, political unrest, war or otherwise. Our efforts to secure and plan for potential disruptions of our major operating systems are not always successful, and future disruptions could have a material adverse effect on the Company.

Current wording

•This may include a disruption involving physical or technological infrastructure used by us or third parties with or through whom we conduct business, whether due to human error, natural disasters, power loss, telecommunication failures, cyber attacks, data breaches, break-ins, sabotage, intentional acts of vandalism, acts of terrorism, political unrest, war or otherwise. Technology failures could also result from inadequate implementation or poor governance. Our efforts to secure and plan for potential disruptions of our major operating systems are not always successful, and future disruptions could have a material adverse effect on our business, financial condition or results of operations.

Previous wording

•We also do not have fully redundant systems for most of our smaller office locations and low-risk systems, and our disaster recovery plan does not include restoration of non-essential services. If a disruption occurs in one of our locations or systems and our personnel in those locations or those who rely on such systems are unable to utilize other systems or communicate with or travel to other locations, such persons’ ability to service and interact with our clients and customers may suffer.

Current wording

•We also do not have fully redundant systems for most of our smaller office locations and low-risk systems, and our disaster recovery plan does not include restoration of non-essential services. If a disruption occurs in one of our locations or systems and our personnel in those locations or those who rely on such systems are unable to utilize other systems or communicate with or travel to other locations, such persons’ ability to service and interact with our customers may suffer.

Previous wording

Exposure to litigation and government and regulatory proceedings, investigations and inquiries (including market studies) could have a material adverse effect on our business, financial condition or results of operations.

Current wording

Exposure to litigation and government and regulatory proceedings, investigations and inquiries could have a material adverse effect on our business, financial condition or results of operations.

Previous wording

•In the normal course of business, both in the U.S. and abroad, we and our subsidiaries are defendants in numerous legal proceedings and are often the subject of government and regulatory proceedings, investigations and inquiries (including market studies), as discussed under Item 7, Management’s Discussion and Analysis of Financial Condition and Results of Operations, in this Annual Report on Form 10-K and in Note 13 –Commitments and Contingencies to the consolidated financial statements under Item 8, Consolidated Financial Statements and Supplementary Data, in this Annual Report on Form 10-K, and we face the risk that additional proceedings, investigations and inquiries (including market studies) will arise in the future.

Current wording

•In the normal course of business, both in the U.S. and abroad, we and our subsidiaries are defendants in numerous legal proceedings and are often the subject of government and regulatory proceedings, investigations and inquiries, as discussed under Item 7, Management’s Discussion and Analysis of Financial Condition and Results of Operations, in this Annual Report on Form 10-K and in Note 13 –Commitments and Contingencies to the consolidated financial statements under Item 8, Consolidated Financial Statements and Supplementary Data, in this Annual Report on Form 10-K, and we face the risk that additional proceedings, investigations and inquiries will arise in the future.

Previous wording

•Many of these proceedings, investigations and inquiries (including market studies) regularly relate to the activity of our Ratings, Indices, and Commodity Insights businesses. In addition, various government and self-regulatory agencies frequently make inquiries and conduct investigations into our compliance with applicable laws and regulations, including those related to our regulated products and services, antitrust matters, and other matters, such as environmental, social and governance (“ESG”) matters. From time to time, we also face proceedings, investigations or inquiries related to tax matters. Enhancements to our products and services combined with evolving regulation requires us to continuously evaluate our regulatory and compliance obligations, and government and self-regulatory agencies may conduct investigations to determine whether our products and services subject us to additional regulations. Any of these proceedings, investigations or inquiries (including market studies) impose additional expenses on the Company, require the attention of senior management, and could ultimately result in adverse judgments, damages, fines, penalties, activity restrictions, reduced demand for our products and services, or negative impacts on our cash flows, which could have a material adverse effect on our business, financial condition or results of operations.

Current wording

•Many of these proceedings, investigations and inquiries regularly relate to the activity of our Ratings, Indices, and Energy businesses. In addition, various government and self-regulatory agencies frequently make inquiries and conduct investigations into our compliance with applicable laws and regulations, including those related to our regulated products and services, antitrust matters, and other matters, such as environmental, social and governance (“ESG”) matters. From time to time, we also face proceedings, investigations or inquiries related to tax matters. Enhancements to our products and services combined with evolving regulation requires us to continuously evaluate our regulatory and compliance obligations, and government and self-regulatory agencies may conduct investigations to determine whether our products and services subject us to additional regulations. Any of these proceedings, investigations or inquiries impose additional expenses on the Company, require the attention of senior management, and could ultimately result in adverse judgments, damages, fines, penalties, activity restrictions, reduced demand for our products and services, or negative impacts on our cash flows, which could have a material adverse effect on our business, financial condition or results of operations.

Previous wording

Changes in the global privacy, data localization and data protection legislative, regulatory, and commercial environments in which we operate may materially and adversely impact our ability to collect, compile, use, and publish data and may impact our financial results.

Current wording

Changes and increased enforcement in the global privacy, data localization, operational resilience, and data protection legislative, regulatory, and commercial environments in which we operate may materially and adversely impact our ability to collect, compile, use, and publish data, require us to disclose information about our security environment, and could have a material adverse effect on our business, financial condition or results of operations.

Previous wording

•We, and certain types of information we collect, compile, use, and publish, are subject to numerous U.S. federal and state laws and non-U.S. regulations governing the protection of personal and confidential information of our clients, employees and products in the jurisdictions in which we operate. Further, global privacy, data localization, data maintenance, data transfer and data protection legislation, regulatory, enforcement, and policy activity are rapidly and continually evolving and creating a complex regulatory compliance environment. There is also increasing concern among certain privacy and data protection advocates, government regulators, litigators, and the press regarding marketing and privacy matters as well as data protection, particularly as they relate to individual privacy, threats to personal information, and perceived national security interests. Costs and adaptation of our business practices to comply with and implement the increasing privacy-related and data protection, data maintenance and transfer restriction measures have been, and we expect will continue to be, significant, particularly as the laws and regulations across jurisdictions change frequently and sometimes conflict. In addition, such measures, as well as any associated inquiries or investigations or any other government actions, increase our operating costs and require significant management time and attention, and may result in negative publicity and subject us to costs that may harm our business, including fines or damages as well as demands or orders that we modify or cease existing business practices.

Current wording

•We, and certain types of information we collect, compile, store, use, process, transfer, publish and sell, are subject to laws and regulations governing the protection of personal and sensitive information in the various jurisdictions in which we operate. We move data across national borders to conduct our operations, and consequently, are subject to a variety of evolving laws and regulations regarding privacy, data protection, and data security in an increasing number of jurisdictions. Further, global privacy, data localization, data maintenance, data transfer, operational resilience (e.g., the E.U. Digital Operational Resilience Act), data protection legislation, regulatory, enforcement, and policy activity are rapidly and continually evolving and creating a complex regulatory compliance environment. There is also increasing public concern among certain privacy and data protection advocates, government regulators, litigators, and the press regarding, and resulting increasing regulations of, privacy, data, and consumer protection issues. Certain laws and regulations to which we are subject pertain to personally identifiable information (“PII”) relating to individuals. Such laws and regulations constrain the collection, use, processing, storage, and transfer of PII, and impose other obligations with which we must comply. Costs and adaptation of our business practices to comply with evolving laws and regulations governing and restricting the processing and transfer of certain data is, and we expect will continue to be, significant. In addition, such measures, as well as any associated inquiries or investigations or any other government actions, increase our operating costs and require significant management time and attention, and may result in negative publicity and subject us to significant costs that may harm our business, including fines or damages as well as demands or orders that we modify or cease existing business practices. The risks of inadvertent disclosure of personal data can increase with the introduction of new and complex technologies, further exacerbating such risks.

Previous wording

•There has been increased public attention regarding the use and transfer of personal information, accompanied by examinations of regulated entities, and legislation and regulations intended to strengthen data protection, information security and consumer and personal privacy. The law in these areas continues to develop and the changing nature and interpretations by courts of privacy and data protection laws around the world, including in jurisdictions such as the U.S. (including in an increasing number of U.S. states), the European Union (the “EU”), the People’s Republic of China and India, could have a significant impact on our processing of personal and sensitive information of our employees, vendors and customers and other data, and in turn, our business practices.

Current wording

•There has been increased public attention regarding the use and transfer of personal information and regulations intended to strengthen data protection, information security and consumer and personal privacy. The law in these areas continues to develop and the changing nature and interpretation of these laws by courts and enforcement actions, including in jurisdictions such as the U.S. (including in an increasing number of U.S. states), the European Union (the “EU”), the People’s Republic of China and India, could have a significant impact on our processing of employee, commercial, vendor, and customer data, and in turn, our business practices.

Previous wording

•We devote meaningful time and financial resources to compliance with current and future applicable international and U.S. privacy, cybersecurity, data protection and related laws and regulations. We have made, and expect to continue to make, capital investments and other expenditures to address cybersecurity preparedness and prevent future cyber incidents and breaches, including costs associated with additional security technologies, personnel, experts and credit monitoring services for those whose data has been breached. Any such expenses that we incur in the future, which could be material, will impact our results of operations in the period in which they are incurred, but may not meaningfully limit the success of future attempts to compromise our information or information technology systems.

Current wording

•We devote meaningful time and financial resources to compliance with current and future applicable international and U.S. privacy, cybersecurity, data protection and related laws and regulations. We have made, and expect to continue to make, capital investments and other expenditures to enhance cybersecurity preparedness and prevent future cyber incidents and breaches, including costs associated with additional security technologies, personnel, and experts. Any such expenses that we incur in the future, which could be material, will impact our results of operations in the period in which they are incurred, but may not meaningfully limit the success of future attempts to compromise our information or information technology systems.

Previous wording

•Continued privacy and data protection concerns may result in new or amended laws and regulations. Future laws and regulations with respect to the collection, compilation, use, and publication of information and consumer privacy could result in limitations on our operations, increased compliance or litigation expense, adverse publicity, or loss of revenue, which could have a material adverse effect on our business, financial condition, and results of operations. It is also possible that we could be prohibited from collecting or disseminating certain types of data, which could affect our ability to meet our customers’ needs or require changes in our processes, technologies, and data management.

Current wording

•Continued privacy and data protection concerns may result in new or amended laws and regulations. Future laws and regulations with respect to the collection, compilation, use, and publication of information could result in limitations on our operations or data processing, leading to increased compliance or litigation expense and/or adverse publicity or loss of revenue, which could have a material adverse effect on our business, financial condition, or results of operations. It is also possible that we could be prohibited from collecting or disseminating certain types of data, which could affect our ability to meet our customers’ needs or require changes in our processes, technologies, and data management.

Previous wording

•We are also from time to time subject to, or face assertions that we are subject to, additional obligations relating to personal and other data by contract or due to assertions that self-regulatory obligations or industry standards apply to our practices.

Current wording

•We are also from time to time subject to, or face assertions that we are subject to, additional obligations relating to personal and other data by contract or due to assertions that self-regulatory obligations or industry standards apply to our practices. We are also subject to the terms of our privacy policies and privacy-related obligations to third parties, and could face claims or allegations that we are not in compliance with such terms, which could result in costly litigation and could have a material adverse effect on our business, financial condition or results of operations.

Previous wording

Future legislation, regulatory reform or policy changes, especially abrupt changes, could have a material adverse effect on our business and results of operations.

Current wording

Future legislation, regulatory reform or policy changes, especially abrupt changes, could have a material adverse effect on our business, financial condition or results of operations.

Previous wording

Future legislation, regulatory reform or policy changes, such as financial services regulatory reform, energy or commodity-specific regulation, including oil, regulations related to pricing providers, credit rating data, data privacy, operational resilience and cybersecurity, tax regulations, AI, ESG (including matters of diversity, equity and inclusion (“DEI”)), government-sponsored enterprise reform and increased infrastructure spending and significant changes in trade policy (including sanctions and tariffs), could impact our business. There are currently a number of laws and regulations in jurisdictions in which we operate around the world that have recently been adopted but not yet implemented or have been proposed or are being considered to which we or our clients will or may become subject, but at this time their impact on our business and results of operations remains uncertain. Changes in legislation, regulation or policy increase the likelihood that we will fail to appropriately adapt to changes in our compliance obligations, particularly when such changes happen abruptly, such as following a change in government. Any of the foregoing changes could increase our litigation and regulatory exposure, directly impact our results of operations and cash flows, adversely affect our ability to provide our products and services, or adversely impact the demand for our products and services. Such changes may also impact our business by creating increased volatility and uncertainty in the markets in which we operate. At this time, we cannot predict the scope or nature of these changes or assess what the overall effect of such potential changes could be on our results of operations or cash flows.

Current wording

Future legislation, regulatory reform or policy changes, such as financial services regulatory reform, energy- or commodity-specific regulation, including oil, regulations related to pricing providers, credit rating data, sustainability or corporate responsibility matters, data privacy, operational resilience and cybersecurity, tax regulations, government-sponsored enterprise reform and increased infrastructure spending and significant changes in trade policy (including sanctions and tariffs), could impact our business. There are currently a number of laws and regulations in jurisdictions in which we operate around the world that have recently been adopted but not yet implemented or have been proposed or are being considered to which we or our clients will or may become subject, but at this time their impact on our business and results of operations remains uncertain. Changes in legislation, regulation or policy increase the likelihood that we will fail to appropriately adapt to changes in our compliance obligations, particularly when such changes happen abruptly, such as following a change in government. Any of the foregoing changes could increase our litigation and regulatory exposure, directly impact our results of operations and cash flows, adversely affect our ability to provide our products and services, or adversely impact the demand for our products and services and could have a material adverse effect on our business, financial condition or results of operations. Such changes may also impact our business by creating increased volatility and uncertainty in the markets in which we operate. At this time, we cannot predict the scope or nature of these changes or assess what the overall effect of such potential changes could be on our results of operations or cash flows.

Previous wording

•The U.S. Congress, the International Organization of Securities Commissions ("IOSCO"), the SEC, the European Commission, including through the European Securities Market Authority (“ESMA”) and the U.K. Financial Conduct Authority (“FCA”), as well as regulators in other countries in which Ratings operates, have reviewed the role of rating agencies and their processes and the need for greater oversight or regulations concerning the issuance of credit ratings or the activities of credit rating agencies, and they may conduct such reviews in the future. Other laws, regulations and rules relating to credit rating agencies are from time to time considered by local, national and multinational bodies and are likely to continue to be considered in the future, including, for example, provisions seeking to reduce regulatory and investor reliance on credit ratings or to increase competition among credit rating agencies, provisions regarding remuneration and rotation of credit rating agencies, and liability standards applicable to credit rating agencies. Other laws, regulations and rules are being considered or are likely to be considered in the future that may impact ancillary and other services provided by Ratings in addition to its credit rating products and services. Examples include regulatory oversight regimes for ESG ratings providers which may impose new regulatory requirements regarding some of Ratings’ ancillary and other services, such as the EU regulation on the transparency and integrity of ESG rating activities adopted by the European Parliament and Council in November 2024, or draft legislation published by the U.K. in 2024 to empower the FCA to supervise ESG ratings providers.

Current wording

•The U.S. Congress, the International Organization of Securities Commissions ("IOSCO"), the SEC, the European Commission, including through the European Securities Market Authority (“ESMA”) and the U.K. Financial Conduct Authority (“FCA”), as well as regulators in other countries in which Ratings operates, have reviewed the role of rating agencies and their processes and the need for greater oversight or regulations concerning the issuance of credit ratings or the activities of credit rating agencies, and they may conduct such reviews in the future. Other laws, regulations and rules relating to credit rating agencies are from time to time considered by local, national and multinational bodies and are likely to continue to be considered in the future, including, for example, provisions seeking to reduce regulatory and investor reliance on credit ratings or to increase competition among credit rating agencies, provisions regarding remuneration and rotation of credit rating agencies, and liability standards applicable to credit rating agencies. Other laws, regulations and rules are being considered or are likely to be considered in the future that may impact ancillary and other services provided by Ratings in addition to its credit rating products and services. Examples include regulatory oversight regimes for ESG ratings providers which may impose new regulatory requirements regarding some of Ratings’ ancillary and other services, such as the EU regulation on the transparency and integrity of ESG rating activities adopted by the European Parliament and Council in November 2024, or legislation and draft rules published by the FCA in 2025 to supervise ESG ratings providers from June 2028.