Graham Holdings Co

Changes in the methodologies or algorithms used by search engines to display results could cause WGB’s properties to receive less favorable placements in the search results. If WGB is unable to successfully modify its search engine optimization practices in response to changes regularly implemented by search engine algorithms and in search query trends, or if WGB is unable to generate increased or diversified traffic from other sources such as social media, email, direct navigation and online marketing activities, WGB could experience substantial declines in traffic to its media properties which would adversely impact WGB’s business and results of operations.

•If WGB is Unable to Effectively Distribute its Media Content on Social Media Platforms or Mobile Devices, WGB’s Business and Results of Operation Could Be Negatively Impacted.

The number of people who access the internet through mobile devices such as smartphones and tablets, rather than through desktop or laptop computers, has increased substantially in recent years. Additionally, individuals are increasingly consuming publisher content through social media platforms. If WGB cannot effectively distribute its media content, products and services on these devices or through these platforms, WGB could experience a decline in visits and traffic and a corresponding decline in revenue. Consumption of WGB’s media content on mobile devices rather than through desktop or laptop computers decreases revenue per visits. As a result of these factors, the increasing use of mobile devices and social media platforms to access WGB’s content could negatively impact its business and results of operations.

•Failure to Recruit and Retain Employees in the Company’s Restaurants Could Adversely Impact the Company’s Restaurant Business.

Historically, competition among restaurant companies for qualified management and staff has been very high. The Company’s ability to recruit and retain managers and staff to operate the Company’s restaurants is critical to a customer’s dining experience. Failure to recruit and retain employees, low levels of unemployment or high turnover levels could negatively affect the Company’s restaurant business. Tipped wage legislation is presenting new challenges to balance menu pricing, service standards, staffing levels, operating costs and public awareness as new wage laws are implemented.

•Food-Borne Illness Concerns and Damage to the Company’s Reputation Could Harm the Company’s Restaurant Business.

Historically, reports of food-borne illness or food safety issues at restaurants, even if caused by food suppliers or distributors, have had negative effects on restaurant sales. Because food safety issues could be experienced at the source by food suppliers or distributors, food safety could, in part, be out of the Company’s control. Even instances of food-borne illness at a location served by one of the Company’s competitors could result in negative publicity regarding the food service industry generally and could negatively impact restaurant revenue. Regardless of the source or cause, negative publicity about food-borne illness or other food safety issues could adversely impact the Company’s reputation. Similarly, publicity about litigation, violence, complaints, or government investigations could have a negative effect on restaurant sales.

•Concentration of the Company’s Restaurants in the Washington, D.C. Region Subjects the Company’s Restaurant Business to Regional Economic Conditions.

The concentration of the Company’s restaurants in the Washington, D.C. region subjects it to adverse economic conditions and trends in the region that are out of the Company’s control. For example, increases in the level of unemployment, a temporary government shutdown or a decrease in tourism would decrease customers’ disposable income available for discretionary spending. These and other national, regional and local economic pressures could result in decreases in customer traffic and lower sales and profits.

Risks Related to the Company’s Stock Ownership and Operations

•As a Controlled Company, the Rights of Class B Common Stockholders are Limited

The Company has two classes of shares, Class A Common Stock and Class B Common Stock. Class B Common Stock has limited voting rights, including the right to elect 30% of the Company’s Board of Directors, to vote on the reservation of shares for option grants and on the acquisition of the stock or assets of other companies under certain circumstances. The descendants of Katharine Graham and trusts for the benefit of those descendants own the majority of the shares of Class A Common Stock and have the right to vote for 70% of the Board of Directors and to vote on all other matters. As a result, control of the Company has been and is expected to remain with members of the Graham family. In addition, the Company is a “controlled company” under the corporate governance rules of the New York Stock Exchange (NYSE) and as such, the Company is exempt from certain corporate governance requirements of the NYSE.

•Pandemics or Other Outbreaks of Disease, Such as the COVID-19 Pandemic, Have Had, and Future Outbreaks, Could Have, Adverse Impacts on the Company’s Business, Results of Operations and Cash Flows.

Pandemics and other disease outbreaks, such as the COVID-19 pandemic, have materially affected, and may in the future, materially adversely affect the Company’s businesses, including the demand for its products and services. As a result of the COVID-19 pandemic, travel restrictions and school closures impeded the ability of students to travel to undertake overseas study resulting in reduced enrollments for programs offered by Kaplan International, reduced demand for student housing and delays and cancellations of standardized tests. The COVID-19 pandemic also led to plant closures and disruptions in the Company’s supply chains, declines in demand for products and advertising, closures of the Company’s restaurants and live art fairs, and increased competition for labor and absenteeism affecting the Company’s media, manufacturing, healthcare, automotive and other businesses. The adverse impact of a new health crisis could include, and in the past has included, reduced demand for the Company’s products and services, supply chain disruptions, asset impairment charges, labor disruptions and manufacturing, restaurant and other closures. Additionally, to the extent a pandemic or other health crisis adversely affects the Company’s business operations, financial condition or operating results, it may also have the effect of heightening many of the other risks described in this “Risk Factors” section.

•Failure to Comply with Environmental and Health and Safety Laws Applicable to the Company’s Operations Could Negatively Impact the Company’s Businesses.

The Company’s operations are subject to extensive federal, state and local laws and regulations relating to the environment, as well as health and workplace safety, including those set forth by the Occupational Safety and Health Administration (OSHA), the Environmental Protection Agency (EPA) and state and local regulatory authorities in the U.S. as well as similar laws and regulations internationally where the Company operates. Such laws and regulations affect operations and require compliance with various environmental registrations, licenses, permits, inspections and other approvals. In the U.K., the Company will be subject to new registration requirements under the U.K. Building Safety Act in 2022 with respect to its dormitories as well as compliance with existing U.K. and local legislation regarding licensing occupancy of such dormitories. The Company incurs substantial costs to comply with these regulations, and any failure to comply may expose the Company to civil, criminal and administrative fees, fines, penalties and interruptions in operations that could have a material adverse impact on the Company’s results of operations, financial position or cash flows.

Environmental laws and regulations to which the Company is subject include those governing discharges into the air and water, the operation and removal of above-ground and underground storage tanks, the use, handling, storage and disposal of hazardous substances and other materials, and the investigation and remediation of environmental contamination at facilities that are owned or operated. The Company may be subject to liability, for example, in the automotive business, because the business involves the generation, use, handling and contracting for recycling or disposal of hazardous or toxic substances or wastes, including environmentally sensitive materials such as motor oil, filters, transmission fluid, antifreeze, refrigerant, batteries, solvents, lubricants, tires and fuel. In addition, climate change could cause increases in hurricanes, floods, wildfires, and other risks that could produce losses affecting our businesses. Although in connection with certain acquisitions, the Company has obtained indemnification for certain environmental liabilities and insurance policies, such rights and policies may not be sufficient to reimburse the Company for all losses that it might incur. The Company has incurred, and will continue to incur, capital and operating expenditures and other costs in complying with such laws and regulations and changes to such regulations, including any new regulations related to climate change, could give rise to additional compliance or remedial costs.

•Failure to Successfully Integrate Acquired Businesses Could Negatively Affect the Company’s Business.

Acquisitions involve various inherent risks and uncertainties, including difficulties in efficiently integrating the service offerings, accounting and other administrative systems of an acquired business; the challenges of assimilating and retaining key personnel; the consequences of diverting the attention of senior management from existing operations; the possibility that an acquired business does not meet or exceed the financial projections that supported the purchase price; and the possible failure of the due diligence process to identify significant business risks or liabilities associated with the acquired business. A failure to effectively manage growth and integrate acquired businesses could have a material adverse effect on the Company’s operating results.

•Changes in Business Conditions Have Caused and May in the Future Cause Goodwill and Other Intangible Assets to Become Impaired.

Goodwill generally represents the purchase price paid in excess of the fair value of net tangible and intangible assets acquired in a business combination. Goodwill is not amortized and remains on the Company’s balance sheet indefinitely unless there is an impairment or a sale of a portion of the business. Goodwill is subject to an impairment test on an annual basis and when circumstances indicate that an impairment is more likely than not. Such circumstances include an adverse change in the business climate for one of the Company’s businesses or a decision to dispose of a business or a significant portion of a business. Each of the Company’s businesses faces uncertainty in its business environment due to a variety of factors, including challenges in operating environments created by the COVID-19 pandemic and changes in demand for products and services. In the third quarter of 2023, the Company recorded a goodwill impairment of $50.2 million at WGB and $47.8 million at Dekko. Additional declines in revenue could result in adverse changes in projections for future operating results or other key assumptions, such as projected revenue, profit margin, capital expenditures or cash flows associated with fair value estimates and could lead to additional future impairments, which could be material. The Company may experience other unforeseen circumstances that adversely affect the value of the Company’s goodwill or intangible assets and trigger an evaluation of the amount of the recorded goodwill and intangible assets. There also exists a reasonable possibility that changes to the discounted cash-flow model used to perform the quantitative goodwill impairment review, including a decrease in the assumed projected cash flows or long-term growth rate, or an increase in the discount rate assumption, could result in an impairment charge. Future write-offs of goodwill or other intangible assets as a result of an impairment in the business could materially adversely affect the Company’s results of operations and financial condition.

•Changes in International Income Tax Laws Could Subject the Company to Increased Taxes and Increased Compliance Costs

Many countries have proposed or enacted changes to their tax laws to implement a minimum 15% tax rate on certain multinational companies based on a set of rules known as Pillar Two issued by the Organization for Economic Co-operation and Development (OECD). Global tax developments, such as Pillar Two, could subject the Company to increased taxes and increased compliance costs.

Risks Related to Cybersecurity, Privacy, Artificial Intelligence and Intellectual Property

•System Disruptions and Security Threats to the Company’s Information Technology Infrastructure Could Have a Material Adverse Effect on Its Businesses and Results of Operations.

The Company relies extensively on information technology systems, networks and services, including internet sites, data hosting and processing facilities and tools and other hardware, software and technical platforms, some of which are managed, hosted, provided and/or used by third parties or their vendors, to assist in conducting the Company’s business.

The Company’s systems and the third-party systems on which it relies are subject to damage or interruption from a number of causes, including but not limited to power outages; computer and telecommunications failures; computer viruses; industry-wide software supply chain vulnerabilities, security breaches; cyberattacks, including phishing and other forms of social engineering, hacking, denial-of-service attacks, cyber extortion, including the use of ransomware and other actions or attempts to exploit vulnerabilities; catastrophic events such as fires, floods, earthquakes, tornadoes and hurricanes; infectious disease outbreaks (such as COVID-19); acts of war or terrorism; and design or usage errors by our employees, contractors or third-party service providers. The techniques used by computer hackers and cyber criminals to obtain unauthorized access to data or to sabotage computer systems change frequently, continue to grow in sophistication and volume, and may not be detected until after an incident has occurred. These techniques include using artificial intelligence (AI), including generative AI to enhance their attacks, which may increase our cybersecurity risk. Although the Company and the third-party service providers seek to maintain their respective systems effectively and to successfully address the risk of compromise of the integrity, security and consistent operations of these systems, such efforts may not be successful. As a result, the Company or its service providers could experience errors, interruptions, delays or cessations of service in key portions of the Company’s information technology infrastructure, which could significantly disrupt its operations, including manufacturing production delays, and be costly, time-consuming and resource-intensive to remedy. Any security breach or unauthorized access also could result in a misappropriation of the Company’s proprietary information or the proprietary information of the Company’s users, customers or partners, which could result in significant legal and financial exposure and damage to the Company’s reputation. If an actual or perceived breach of the Company’s security occurs, or if the Company’s consumer-facing sites become the subject of external attacks that affect or disrupt service or availability, the market perception of the effectiveness of the Company’s security measures could be harmed and the Company could lose users, customers, advertisers or partners, all of which could have a material adverse effect on the Company’s business, financial condition and results of operations. Any security breach at a company providing services to the Company or the Company’s users, including third-party payment processors, could have similar effects and the Company may not be fully indemnified for the costs it may incur as a result of any such breach. To the extent that such vulnerabilities require remediation, such remedial measures could require significant resources and may not be implemented before such vulnerabilities are exploited. As the cybersecurity landscape evolves, the Company may also find it necessary to make significant further investments to protect data and infrastructure, including continuing to evaluate control changes and investments needed to support an increased remote workforce. Any of these events could have a material adverse effect on the

Company’s businesses and results of operations. Sustained or repeated system failures or security breaches that interrupt the Company’s ability to process information in a timely manner or that result in a breach of proprietary or personal information could have a material adverse effect on the Company’s operations and reputation. In addition, minor incidents, even if dealt with promptly, could lead to severe legal, financial and reputational issues, such as investigations by authorities, enforcement, lawsuits and negative publicity, and a collection of incidents, though not considered material individually at the time they occur, may be deemed material later in the aggregate.

•Failure to Comply with Privacy Laws or Regulations Could Have an Adverse Effect on the Company’s Businesses.

Various U.S. federal, state and international laws and regulations govern the collection, use, retention, sharing and security of personal data. This area of the law is evolving, and interpretations of applicable laws and regulations differ. Legislative activity in the privacy area may result in new laws that are relevant to the Company’s operations, including restrictions on the collection, use and sharing of personal data that could limit our ability to use the data for marketing or advertising, and could result in exposure to material liability. For example, data privacy regulations adopted by the EU known as the General Data Protection Regulation (GDPR), became effective in May 2018. These regulations require certain of the Company’s operations to meet extensive requirements regarding the handling of personal data, including its use, protection and transfer. In addition, the GDPR provides the legal right for persons whose data is stored to request access to or correction or deletion of their personal data, among other rights. Failure to meet the applicable requirements in the GDPR could result in fines of up to 4% of the Company’s annual global revenues. In addition to the GDPR in Europe, new privacy laws and regulations are rapidly developing and being implemented elsewhere around the globe, including amendments to the scope, penalties and other provisions of existing data protection laws. Failure to comply with these international data protection laws and regulations could have a negative impact on the Company’s reputation and subject the Company to significant fines, penalties or other liabilities or restrict the Company’s ability to continue operating its existing business processes, all of which may increase the cost of operations, reduce customer growth, or otherwise harm the Company’s business.

The California Consumer Privacy Act of 2018 (CCPA), which became effective on January 1, 2020, provided a new private right of action for data breaches and requires companies that process personal information pertaining to California residents to make disclosures to consumers about their data collection, use and sharing practices and allows consumers to opt out of certain data sharing with third parties. The enforcement of the CCPA by the California Attorney General commenced on July 1, 2020. In November 2020, the California Privacy Rights Act (CPRA) was approved by California voters, and went into effect on January 1, 2023. The CPRA included new requirements that were not in the CCPA. Similar privacy laws also went into effect in Virginia, Colorado, Connecticut and Utah during 2023, other privacy laws have been passed that will go into effect in 2024 and 2025, and data privacy bills continue to be introduced at the state level. There are also comprehensive privacy bills that have been introduced at the U.S. federal level. In addition to the comprehensive privacy laws and bills, the recent emergence of new AI tools has raised some additional information security and privacy issues. There are currently numerous bills for new laws to regulate the use of AI both at the U.S. federal and state level, and in other locations in which the Company does business such as the EU. The passage of any additional laws could result in further uncertainty and cause the Company to incur additional costs and expenses in order to comply. Compliance with the GDPR, the CCPA, the CPRA and other applicable international and U.S. privacy laws can be costly and time-consuming. If the Company fails to properly respond to security breaches of its or its third-party’s information technology systems or fails to properly respond to an individual’s requests under these laws, the Company could experience damage to its reputation, adverse publicity, loss of consumer confidence, reduced sales and profits, complications in executing the Company’s growth initiatives and regulatory and legal risk, including criminal penalties or civil liabilities.

Claims of failure to comply with the Company’s privacy policies or applicable laws or regulations could form the basis of governmental or private party actions against the Company and could result in significant penalties. Additionally, evolving concerns regarding data privacy may cause the Company’s customers and potential customers to resist providing the data necessary to allow the Company to deliver its solutions effectively. Even the perception that personal information is not satisfactorily protected or does not meet regulatory requirements could inhibit sales and any failure to comply with such laws and regulations could lead to significant fines, penalties or other liabilities. Such claims and actions could cause damage to the Company’s reputation and could have an adverse effect on the Company’s businesses.

•Uncertainty in the Development, Deployment, and use of AI in the Company’s Products and Services, as well as its Businesses More Broadly, Could Adversely Affect the Company’s Business and Reputation.

The Company is building and expects to use systems and tools that incorporate AI-based technologies, including generative AI, for its customers and workforce. The development, adoption and use of generative AI technology remains in early stages, and effective or inadequate AI or generative AI development or deployment practices by the Company or third parties could result in unintended consequences. For example, AI algorithms that the Company uses may be flawed or may be (or perceived to be) based on datasets that are biased or insufficient. In addition there is uncertainty around the validity and enforceability of intellectual property rights related to the Company’s development, deployment and use of AI. Compliance with new or changing laws, regulations or industry standards relating to AI may impose significant operational costs and may limit the Company’s ability to develop, deploy or use AI technologies. Failure to appropriately respond to this evolving landscape may result in legal liability, regulatory action or brand and reputational harm.

•Potential Liability for Intellectual Property Infringement Could Adversely Affect the Company’s Businesses.

The Company periodically receives claims from third parties alleging that the Company’s businesses infringe on the intellectual property rights of others. It is likely that the Company will continue to be subject to similar claims, particularly as they relate to its media businesses. Other parts of the Company’s business could also be subject to such claims. Addressing intellectual property claims is a time-consuming and expensive endeavor, regardless of the merits of the claims. In order to resolve such claims, the Company may have to change its method of doing business, enter into licensing agreements with copyright holders, or incur substantial monetary liability. It is also possible that one of the Company’s businesses could be enjoined from using the intellectual property at issue, causing it to significantly alter its operations. Although the Company cannot predict the impact at this time, if any such claim is successful, the outcome would likely affect the business utilizing the intellectual property at issue and could have a material adverse effect on that business’s operating results or prospects.