ROPER TECHNOLOGIES INC

Previous wording

Acquisitions involve risks, including difficulties in the integration of the operations, technologies, services, and products of the acquired companies and the diversion of management’s attention from other business concerns. Although our management will endeavor to evaluate the risks inherent in any particular transaction, including but not limited to cybersecurity risks, there are no assurances that we will properly ascertain all such risks. Acquisitions may involve significant cash expenditures, debt incurrences, equity issuances, and expenses. Difficulties encountered with acquisitions may have a material adverse effect on our business, financial condition, and results of operations.

Current wording

Acquisitions involve risks, including difficulties in the integration of the operations, technologies, services, and products of the acquired companies and the diversion of management’s attention from other business concerns. Although our management will endeavor to evaluate the risks inherent in any particular transaction, including but not limited to cybersecurity risks and susceptibility to market disruption from AI or otherwise, there are no assurances that we will properly ascertain all such risks. Acquisitions may involve significant cash expenditures, debt incurrences, equity issuances, and expenses. Difficulties encountered with acquisitions may have a material adverse effect on our business, financial condition, and results of operations.

Previous wording

Many of our products and services rely on proprietary technology; therefore, we believe that the development and protection of intellectual property rights through patents, copyrights, trade secrets, trademarks, confidentiality agreements, and other contractual provisions are important to the future success of our business. Despite our efforts to protect proprietary rights, unauthorized parties or competitors may copy or otherwise obtain and use our products or technology. Actions to enforce these rights may result in substantial costs and diversion of resources, and we make no assurances that any such actions will be successful.

Current wording

Many of our products and services rely on proprietary technology; therefore, we believe that the development and protection of intellectual property rights through patents, copyrights, trade secrets, trademarks, confidentiality agreements, and other contractual provisions are important to the future success of our business. Despite our efforts to protect proprietary rights, unauthorized parties or competitors may copy or otherwise obtain and use our products or technology, including through misappropriation through contractors or other third parties. Actions to enforce these rights may result in substantial costs and diversion of resources, and we make no assurances that any such actions will be successful, particularly given evolving uncertainty regarding protection and ownership of AI-assisted outputs.

Previous wording

Our business operations are dependent upon information technology networks and systems to securely transmit, process, and store information and to communicate among our locations around the world and with clients, suppliers, and business partners. A shutdown of, or inability to access, one or more of our facilities, a power outage, or a failure of one or more of our information technology, telecommunications, or other systems could significantly impair our ability to perform such functions on a timely basis. Our compliance, cyber and data privacy programs, cybersecurity technology, and risk management cannot eliminate all system risk. Cybersecurity incidents, ransomware attacks, systems disruptions or interruptions, cyberattacks, configuration or human error, insider threat, and/or other external hazards or threats could result in the misappropriation of assets or information, corruption of data, or disruptions in our business strategy, results of operations, and financial condition. These disruptions may include, but are not limited to, interruptions to business operations, loss of intellectual property, release of confidential information, malicious alteration or corruption of data or systems, costs related to remediation or the payment of ransom, litigation including individual claims or consumer class actions, commercial litigation, administrative, and civil or criminal investigations or actions, regulatory intervention and sanctions or fines, investigation and remediation costs, and possible prolonged negative publicity.

Current wording

Our business operations are dependent upon information technology networks and systems to securely transmit, process, and store information and to communicate among our locations around the world and with clients, suppliers, and business partners. A shutdown of, or inability to access, one or more of our facilities, a power outage, or a failure of one or more of our information technology, telecommunications, or other systems could significantly impair our ability to perform such functions on a timely basis. Our compliance, cybersecurity and data privacy programs, cybersecurity technology, and risk management cannot eliminate all system risk. Credential compromise and identity-based attacks represent risks, and while we deploy identity threat protection and multi-factor authentication across our enterprise systems, determined attackers may still gain unauthorized access through sophisticated credential theft, session hijacking, social engineering, or privilege escalation techniques. Cybersecurity incidents including ransomware attacks, insider threats, system disruptions, and configuration errors could result in the misappropriation or corruption of data and assets, or disruptions to our business strategy, results of operations, and financial condition, and may require notification to customers and regulators with associated investigation, remediation, and monitoring obligations. These disruptions may include, but are not limited to, interruptions to business operations, loss of intellectual property, release of confidential information, alteration or corruption of data or systems, costs related to remediation or the payment of ransom, litigation (including individual claims, consumer class actions, or commercial litigation), administrative, civil, or criminal investigations or actions, regulatory intervention and sanctions or fines, investigation and remediation costs, and prolonged negative publicity. While we have experienced disruptions, and our Vertafore business was previously subject to litigation regarding the exposure of data which was dismissed, none of these matters had a significant impact on our business.

Previous wording

We rely on business partners such as third-party data centers and cloud platforms, such as Amazon Web Services, Google Cloud Platform, and Microsoft Azure to host certain enterprise and customer systems. Our ability to monitor such third parties’ security measures and the full impact of the systemic risk is limited. If any third-party system or cloud platform that we use is unavailable to us for any reason, our customers may experience service interruptions, which could significantly impact our operations, reputation, business, and financial results. Failure of our systems or those of our third-party service providers, may result in interruptions in our service and loss of data or processing capabilities, all of which may cause a loss in customers, refunds of product fees, and/or material harm to our reputation and operating results. While certain of our businesses have experienced temporary disruptions, their impact has been limited and did not have a significant impact on our businesses.

Current wording

We rely on business partners such as third-party data centers and cloud platforms, such as Amazon Web Services, Google Cloud Platform, Microsoft Azure, and Oracle Cloud to host certain enterprise and customer systems. Our software development and business operations rely on open-source components, third-party software libraries, and vendor dependencies that could contain undisclosed vulnerabilities, be subject to supply chain attacks, or become unavailable, potentially affecting our products, hosted services, and internal systems. Our ability to monitor such third parties’ security measures and the full impact of the systemic risk is limited, and concentration with a limited number of providers increases exposure to outages and pricing changes. If any third-party system or cloud platform that we use is unavailable to us for any reason, our customers may experience service interruptions, which could significantly impact our operations, reputation, business, and financial results. Failure of our systems or those of our third-party service providers, may result in interruptions in our service and loss of data or processing capabilities, all of which may cause a loss in customers, refunds of product fees, and/or material harm to our reputation and operating results. While certain of our businesses have experienced temporary disruptions, their impact has been limited and did not have a significant impact on our businesses.

Previous wording

Global cybersecurity threats are rapidly evolving and attacks to networks, platforms, systems, and endpoints can range from uncoordinated individual attempts to sophisticated and targeted measures known as advanced persistent threats, directed at the Company, its businesses, its customers, and/or its third-party service providers, including, but not limited to, cloud providers and providers of network management services. These may include such things as unauthorized access, phishing attacks, denial of service, insider threats, data exfiltration and extortion, introduction of malware or ransomware, and other disruptive problems caused by threat actors. While we have experienced and expect to continue to experience these types of cybersecurity threats and incidents, none of them to date have been material to the Company.

Current wording

Global cybersecurity threats are rapidly evolving and attacks to identities, networks, platforms, systems, and endpoints can range from uncoordinated individual attempts to sophisticated and targeted measures known as advanced persistent threats, directed at the Company, its businesses, its customers, and/or its third-party service providers, including, but not limited to, cloud providers and providers of network management services. These may include such things as unauthorized access, phishing attacks, denial of service, insider threats, data exfiltration and extortion, introduction of malware or ransomware, and other disruptive problems caused by threat actors. We face emerging risks from AI-powered attacks, including deepfakes used to impersonate executives or customers, AI-assisted social engineering, prompt injection attempts against AI systems, and data poisoning targeting machine learning models. These sophisticated attack techniques may bypass traditional security controls. Additionally, zero-day vulnerabilities, which are previously unknown security flaws with no available patches, pose risks that cannot be fully mitigated through our standard vulnerability management processes, requiring rapid detection and response capabilities to minimize potential damage. While we have experienced and expect to continue to experience these types of cybersecurity threats and incidents, none of them to date have been material to the Company.

Previous wording

We seek to deploy measures to protect, detect, respond, and recover from cybersecurity threats and incidents, including identity and access controls, employee training, data protection, vulnerability management, incident response, secure product development, continuous monitoring of our networks, platforms, endpoints, and systems, and maintenance of ransomware resilient backup and recovery capabilities. Our customers are increasingly requiring cybersecurity protections and mandating cybersecurity standards in our products and services, and we may incur additional costs to comply with such demands. Despite these efforts, we can make no assurances that we will be able to mitigate, detect, prevent, timely and adequately respond, or fully recover from the negative effects of cyberattacks, cybersecurity incidents, or other security compromises, and such attacks, compromises, or cybersecurity incidents, depending on their nature and scope, could potentially result in the misappropriation, destruction, corruption, or unavailability of critical data and confidential or proprietary information (our own or that of third parties) and the disruption of business operations. The potential consequences of a material cybersecurity incident include financial loss, reputational damage, damage to our IT systems, data loss, litigation with third parties, theft of intellectual property, fines, customer attrition, diminution in the value of our investment in research and development, and increased cybersecurity protection and remediation costs due to the increasing sophistication and proliferation of threats, which in turn could adversely affect our competitiveness and results of operations. Any imposition of liability, particularly liability that is not covered by insurance or is in excess of insurance coverage, could materially harm our operating results and financial condition.

Current wording

We seek to deploy measures to protect, detect, respond, and recover from cybersecurity threats and incidents, including identity and access controls, employee training, data protection, vulnerability management, incident response, secure product development, continuous monitoring of our networks, platforms, endpoints, and systems, and maintenance of ransomware resilient backup and recovery capabilities. Our customers are increasingly requiring cybersecurity protections and mandating cybersecurity standards in our products and services, and we may incur additional costs to comply with such demands. Despite these efforts, we can make no assurances that we will be able to mitigate, detect, prevent, timely and adequately respond, or fully recover from the negative effects of cybersecurity incidents, and such cybersecurity incidents, depending on their nature and scope, could potentially result in the misappropriation, destruction, corruption, or unavailability of critical data and confidential or proprietary information (our own or that of third parties) and the disruption of business operations. The potential consequences of a material cybersecurity incident include financial loss, reputational damage, damage to our IT systems, data loss, litigation, theft of intellectual property, regulatory fines, customer attrition, diminution in the value of our investments in research and development (“R&D”), and increased cybersecurity protection and remediation costs, which may not be fully covered by insurance and could adversely affect our competitiveness and results of operations. Any imposition of liability, particularly liability that is not covered by insurance or is in excess of insurance coverage, could materially harm our operating results and financial condition.

Previous wording

We use artificial intelligence in our business, and challenges with properly managing its use could result in reputational harm, competitive harm, and legal liability, and adversely affect our results of operations.

Current wording

We use AI in our business, and challenges with properly managing its use could result in reputational harm, competitive harm, and legal liability, and adversely affect our results of operations.

Previous wording

We are increasingly incorporating artificial intelligence (“AI”) solutions into our platforms, offerings, services, and operations, and we expect that AI will become more important to our company over time. Our competitors or other third parties may incorporate AI into their products or operations more quickly or successfully than us, or develop superior products and services with the aid of AI, which could impair our ability to compete effectively and adversely affect our results of operations. Additionally, if we use AI that is based on data, algorithms, or other inputs that are flawed, or if the AI assists in producing content, analyses, or recommendations that are or are alleged to be deficient, inaccurate, violative of third-party intellectual property, or biased, our business, financial condition, and results of operations may be adversely affected. The use of AI applications has resulted in, and may in the future result in, cybersecurity incidents that implicate the personal data of end users of such applications. Any such cybersecurity incidents related to our use of AI applications could adversely affect our reputation and results of operations. AI also presents emerging ethical issues, and if our use of AI becomes controversial we may experience brand, reputational, or competitive harm, or legal liability.

Current wording

We are increasingly incorporating AI solutions into our platforms, offerings, services, and operations, and we expect that AI will continue to become a more integral part of our business over time. Our competitors, AI companies, or other third parties may incorporate AI into their products or operations more quickly or successfully than us, or develop superior products and services with the aid of AI, which could impair our ability to compete effectively and adversely affect our results of operations. The rapid pace of AI advancement may make it difficult to maintain competitive advantages, and AI capabilities could quickly become commoditized, reducing our ability to differentiate our offerings. Additionally, we may face challenges in protecting AI-generated innovations as intellectual property protections for AI-created materials remain uncertain in many jurisdictions. Competitors may be able to reverse-engineer or replicate our AI capabilities, and questions regarding ownership of AI-generated content or inventions could create legal uncertainties. Furthermore, if we use AI that is based on data, algorithms, or other inputs that are flawed, or if the AI assists in producing content, analyses, or recommendations that are or are alleged to be deficient, inaccurate, violative of third-party intellectual property, or biased, our business, financial condition, and results of operations may be adversely affected.

Previous wording

Our business exposes us to product liability risks in the design, manufacture, and distribution of our products. Manufacturing or design defects could lead to recalls or safety alerts relating to our products (either voluntary or as required by regulatory authorities), and could result, in certain cases, in the removal of a product from the market which could result in significant costs, lost sales and customers, enforcement actions and/or investigations, as well as negative publicity and damage to our reputation. Personal injuries relating to the use of our products can also result in product liability claims being brought against us. We currently have product liability insurance; however, we may not be able to maintain our insurance at a reasonable cost or in amounts sufficient to adequately protect us against losses. We also maintain other insurance policies, including directors’ and officers’ liability insurance and cybersecurity insurance. We believe we have adequately accrued estimated losses, principally related to deductible amounts under our insurance policies, with respect to all product liability and other claims, based upon our past experience and available facts. However, a successful product liability or other claim or series of claims brought against us could have a material adverse effect on our business, financial condition, and results of operations. In addition, a significant increase in our insurance costs or the imposition of a liability that is not covered by insurance or is in excess of insurance coverage, could have an adverse impact on our operating results.

Current wording

Our business exposes us to product liability risks in the design, manufacture, and distribution of our products. Manufacturing or design defects could lead to recalls or safety alerts relating to our products (either voluntary or as required by regulatory authorities), and could result, in certain cases, in the removal of a product from the market which could result in significant costs, lost sales and customers, enforcement actions and/or investigations, as well as negative publicity and damage to our reputation. Personal injuries relating to the use of our products can also result in product liability claims being brought against us. We currently have product liability insurance; however, we may not be able to maintain our insurance at a reasonable cost or in amounts sufficient to adequately protect us against losses, and alleged defects or vulnerabilities in products may lead to claims for data loss, business interruption, or privacy violations that may not be fully covered by insurance. We also maintain other insurance policies, including directors’ and officers’ liability insurance and cybersecurity insurance. We believe we have adequately accrued estimated losses, principally related to deductible amounts under our insurance policies, with respect to all product liability and other claims, based upon our past experience and available facts. However, a successful product liability or other claim or series of claims brought against us could have a material adverse effect on our business, financial condition, and results of operations. In addition, a significant increase in our insurance costs or the imposition of a liability that is not covered by insurance or is in excess of insurance coverage, could have an adverse impact on our operating results.

Previous wording

In some of our businesses, we derive a significant amount of revenue from large customers. The loss or reduction of any significant contracts with any of these customers could reduce our net revenues and cash flows. Additionally, many of our customers are government entities. In many situations, government entities can unilaterally terminate or modify our existing contracts without cause and without penalty to the government agency.

Current wording

In some of our businesses, we derive a significant amount of revenue from large customers. The loss or reduction of any significant contracts with any of these customers could reduce our net revenues and cash flows. Additionally, many of our products support projects for government entities. In many situations, government entities can unilaterally terminate or modify existing contracts without cause and without penalty to the government agency, and government contracts may be subject to specialized compliance obligations, audits, investigations, and bid processes that can delay awards and increase costs.

Previous wording

Several of our subsidiaries have transactions and balances denominated in currencies other than the U.S. dollar. Most of these transactions and balances are denominated in British pounds, Canadian dollars, or euros. Sales by our operating companies whose functional currency is not the U.S. dollar represented 9% and 11% of our total net revenues for the years ended December 31, 2024 and 2023, respectively. Unfavorable changes in exchange rates between the U.S. dollar and those currencies could reduce our reported net revenues and net earnings.

Current wording

Several of our subsidiaries have transactions and balances denominated in currencies other than the U.S. dollar. Most of these transactions and balances are denominated in British pounds, Canadian dollars, or euros. Sales by our operating companies whose functional currency is not the U.S. dollar represented 9% of our total net revenues for both the years ended December 31, 2025 and 2024, respectively. Unfavorable changes in exchange rates between the U.S. dollar and those currencies could reduce our reported net revenues and net earnings.

Previous wording

We face intense competition from numerous competitors in our various businesses. Our products compete primarily on the basis of product quality, performance, innovation, technology, price, applications expertise, system and service flexibility, distribution channel access, and established customer service capabilities. We may not be able to compete effectively on all of these fronts or with all of our competitors. Moreover, competition may require us to adjust prices to stay competitive. In addition, new competitors may emerge, and product lines may be threatened by new technologies or market trends that reduce the value of these product lines. To remain competitive, we must develop new products, respond to new technologies, and enhance our existing products in a timely manner.

Current wording

We face intense competition from numerous competitors in our various businesses. Our products compete primarily on the basis of product quality, performance, innovation, technology, price, applications expertise, system and service flexibility, distribution channel access, and established customer service capabilities. We may not be able to compete effectively on all of these fronts or with all of our competitors. Moreover, competition may require us to adjust prices to stay competitive. In addition, new competitors may emerge, and product lines may be threatened by new technologies, including AI, or market trends that reduce the value of these product lines. To remain competitive, we must develop new products, respond to new technologies, and enhance our existing products in a timely manner.

Previous wording

As of December 31, 2024, we had $7,623.0 in total consolidated indebtedness. In addition, we had approximately $3,369 of undrawn availability under our unsecured revolving credit facility. Subject to restrictions contained in our credit facility, we may incur additional indebtedness in the future, including indebtedness incurred to finance acquisitions.

Current wording

As of December 31, 2025, our total consolidated debt excluding unamortized debt issuance costs was $9,355.9. In addition, we had approximately $2,644 of undrawn availability under our unsecured revolving credit facility. Subject to restrictions contained in our credit facility, we may incur additional indebtedness in the future, including indebtedness incurred to finance acquisitions.

Previous wording

Our total assets reflect substantial intangible assets, primarily goodwill. At December 31, 2024, goodwill totaled $19,312.9 compared to $18,867.6 of total stockholders’ equity, and represented 62% of our total assets of $31,334.7. The goodwill results from our acquisitions, representing the excess purchase price over the fair value of the net identifiable assets acquired. We assess at least annually whether there has been an impairment in the value of our goodwill and other indefinite-lived intangible assets. If future operating performance at one or more of our business units were to fall significantly below current or expected levels, if competing or alternative technologies emerge, if discount rates rise, or if business valuations decline, we could incur a non-cash charge to operating income. Any determination requiring the write-off of a significant portion of goodwill or unamortized intangible assets would negatively affect our results of operations, the effect of which could be material.

Current wording

Our total assets reflect substantial intangible assets, primarily goodwill. At December 31, 2025, goodwill totaled $21,341.2 as compared to $19,881.5 of total stockholders’ equity, and represented approximately 62% of our total assets of $34,577.0. The goodwill results from our acquisitions, representing the excess purchase price over the fair value of the net identifiable assets acquired. We assess at least annually whether there has been an impairment in the value of our goodwill and other indefinite-lived intangible assets. If future operating performance at one or more of our business units were to fall significantly below current or expected levels, if competing or alternative technologies emerge, if discount rates rise, or if business valuations decline, we could incur a non-cash charge to operating income. Any determination requiring the write-off of a significant portion of goodwill or unamortized intangible assets would negatively affect our results of operations, the effect of which could be material.

Previous wording

The future success of our business will depend, in part, on our ability to design and manufacture new competitive products, including the development of software, and to enhance existing product and software offerings. This product development may require substantial internal investment. There can be no assurance that unforeseen problems will not occur with respect to the development, performance, or market acceptance of new technologies, products, or software or that we will otherwise be able to successfully develop and market new products and software. Failure of our product or software offerings to gain market acceptance or our failure to successfully develop and market new products and software could reduce our margins, which would have an adverse effect on our business, financial condition, and results of operations.

Current wording

The future success of our business will depend, in part, on our ability to design and manufacture new competitive products, including the development of software, and to enhance existing product and software offerings, including through the development and deployment of AI. This product development may require substantial internal investment. There can be no assurance that unforeseen problems will not occur with respect to the development, performance, or market acceptance of new technologies, products, or software or that we will otherwise be able to successfully develop and market new products and software. Failure of our product or software offerings to gain market acceptance or our failure to successfully develop and market new products and software could reduce our margins, which would have an adverse effect on our business, financial condition, and results of operations.

Previous wording

The availability and prices of raw materials, parts, and components are subject to curtailment or change due to, among other things, suppliers’ allocations to other purchasers, interruptions in production by suppliers, supply chain delays and disruptions, component shortages, changes in exchange rates, and prevailing price levels. In addition, some of our products are provided by sole source suppliers and our SaaS offerings are increasingly reliant on a limited number of third-party cloud computing platforms. Any change in the supply of, or price for, these parts and components, as well as any increases in commodity prices or the price and availability of, or any decrease in the reliability of, third-party cloud computing platforms could affect our business, financial condition, and results of operations.

Current wording

The availability and prices of raw materials, parts, and components are subject to curtailment or change due to, among other things, suppliers’ allocations to other purchasers, interruptions in production by suppliers, supply chain delays and disruptions, component shortages, changes in exchange rates, and prevailing price levels. In addition, some of our products are provided by sole source suppliers and our SaaS offerings are increasingly reliant on a limited number of third-party cloud computing platforms, and transitioning to alternative suppliers or platforms may require significant time, redesign, and capital investment, or may not be feasible for certain products or services. Any changes in the supply of, or price for, these parts and components, as well as any increases in commodity prices, or the price and availability of, or any decrease in the reliability of, third-party cloud computing platforms could affect our business, financial condition, and results of operations.

Previous wording

Our operating results may be adversely impacted by the performance of Indicor, in which we own a minority interest.

Current wording

Our non-operating results may be adversely impacted by the performance of Indicor, in which we own a minority interest.

Previous wording

In 2022, we divested a majority equity stake in our industrial businesses to CD&R and retained a minority equity interest in the new parent entity, Indicor. Although we have certain limited consent, board representation, and other governance rights under existing contractual arrangements, we are a minority owner of Indicor and do not control its management, its policies, or the operation of its business, and have no further funding requirements associated with our investment. As a result, our ability to realize the ultimate anticipated benefits of the transaction depends upon the operation and management of Indicor by CD&R and the Indicor management team. In addition, Indicor is an industrial business that is subject to risks that are different than the risks associated with our existing businesses. Many of these risks are outside of CD&R’s or Indicor’s control and could materially impact Indicor’s business, financial condition, and results of operations. Moreover, CD&R may have economic or other business interests that are inconsistent with ours, and we may be unable to prevent strategic decisions that may adversely affect the value of our investment in Indicor. We have applied the fair value option to value our equity investment in Indicor. The assessment of fair value requires significant judgments to be made. Although we believe that our judgments and assumptions are reasonable, changes in estimates or the application of alternative assumptions could produce significantly different results. In the event of a decrease in fair value, we would incur a non-cash charge within non-operating income with a corresponding reduction in the balance of our equity investment. See Note 10 of the Notes to Consolidated Financial Statements included in this Annual Report for additional information on this equity investment.

Current wording

In 2022, we divested a majority equity stake in our industrial businesses to CD&R and retained a minority equity interest in the new parent entity, Indicor. Although we have certain limited consent, board representation, and other governance rights under existing contractual arrangements, we are a minority owner of Indicor and do not control its management, its policies, or the operation of its business, and have no further funding requirements associated with our investment. As a result, our ability to realize the ultimate anticipated benefits of the transaction depends upon the operation and management of Indicor by CD&R and the Indicor management team. In addition, Indicor is an industrial company that is subject to risks that are different than the risks associated with our existing businesses. Many of these risks are outside of CD&R’s or Indicor’s control and could materially impact Indicor’s business, financial condition, and results of operations. Moreover, CD&R may have economic or other business interests that are inconsistent with ours, and we may be unable to prevent strategic decisions that may adversely affect the value of our investment in Indicor. We have applied the fair value option to value our equity investment in Indicor. The assessment of fair value requires significant judgments to be made. Although we believe that our judgments and assumptions are reasonable, changes in estimates or the application of alternative assumptions could produce significantly different results. In the event of a decrease in fair value, we would incur a non-cash charge within non-operating income with a corresponding reduction in the balance of our equity investment. See Note 9 of the Notes to Consolidated Financial Statements included in this Annual Report for additional information on this equity investment.

Previous wording

There has been, and likely will continue to be, increased regulation with respect to the collection, use, and handling of an individual’s personal and financial information. Regulatory authorities around the world have passed or are considering legislative and regulatory proposals concerning data protection, privacy, and data security. In the U.S., at least 20 states have individually passed comprehensive privacy legislation in directly regulating the collection, use, and sharing of personal information. In addition, there has been an increased focus on industry-specific privacy laws, including in the financial, healthcare, and educational sectors. These statutes and regulations create civil penalties for violations, and in the case of California and some sector-specific laws, create a limited private right of action for data breaches that increase the risk of data breach litigation. Absent a preemptive Federal privacy law, as more states pass privacy legislation, there is a strong possibility that we will be required to comply with a patchwork of inconsistent privacy regulations.

Current wording

There has been, and likely will continue to be, increased regulation with respect to the collection, use, and handling of an individual’s personal and financial information. Regulatory authorities around the world have passed or are considering legislative and regulatory proposals concerning data protection, privacy, and data security. In the U.S., a growing number of states have individually passed comprehensive privacy legislation in directly regulating the collection, use, and sharing of personal information. In addition, there has been an increased focus on industry-specific privacy laws, including in the housing, financial, healthcare, and educational sectors. These statutes and regulations create civil penalties for violations, and in the case of California and some sector-specific laws, create a limited private right of action for data breaches that increase the risk of data breach litigation. Absent a preemptive Federal privacy law, as more states pass privacy legislation, there is a strong possibility that we will be required to comply with a patchwork of inconsistent privacy regulations.

Previous wording

Globally, personal information collected within the European Union and United Kingdom remains subject to the GDPR, which is a UK and European Union-wide legal framework that governs data collection, use, and sharing of an individual’s personal data and creates a range of consumer privacy rights. GDPR provides significant penalties for non-compliance (up to 4% of global annual revenue) and EU data protection authorities have already issued significant fines. Canada (Quebec) has also significantly updated its privacy laws.

Current wording

Globally, personal information collected within the European Union and the United Kingdom remains subject to the GDPR, which is a UK and European Union-wide legal framework that governs data collection, use, and sharing of an individual’s personal data and creates a range of consumer privacy rights. GDPR provides significant penalties for non-compliance (up to 4% of global annual revenue) and EU data protection authorities have already issued significant fines. Canada (Quebec) has also significantly updated its privacy laws.

Previous wording

The interpretation and application of consumer and data protection laws and industry standards in the U.S., Europe, and elsewhere can be uncertain and currently is in flux. Cloud-based solutions may be subject to further regulation, including data localization requirements and other restrictions limiting the international transfer of data. The operational and cost impact of these cannot be fully known at this time. In addition to the possibility of fines, the application of these existing laws in a manner inconsistent with our current data and privacy practices requires that we change our data and privacy practices, which could have an adverse effect on our business and results of operations. Complying with these various laws could cause us to incur substantial costs or require us to change our business practices in a manner adverse to our business. Also, any new law or regulation imposing greater fees or taxes or restriction on the collection, use, or transfer of information or data internationally or over the Internet, could result in a decline in the use of our products and services and adversely affect our sales and results of operations. Finally, as we increasingly provide technological solutions, our customers and regulators will expect that we can demonstrate compliance with current data privacy and security regulations as well as new industry-developed standards, and our inability to do so may adversely impact sales of our solutions and services to certain customers. This is particularly true for customers in highly-regulated industries, such as the healthcare industry and government contractors, and could result in regulatory actions, fines, and legal proceedings as well as negative impacts to our brand, reputation, and business.

Current wording

The interpretation and application of consumer and data protection laws and industry standards in the U.S., Europe, and elsewhere can be uncertain and currently is in flux, including standards that may require contractual updates, technical safeguards, and other measures. Cloud-based solutions may be subject to further regulations, such as the EU Data Act, including data localization requirements, restrictions on long-term contracts, and other restrictions limiting the international transfer of data. The operational and cost impact of these cannot be fully known at this time. In addition to the possibility of fines, the application of these existing laws in a manner inconsistent with our current data and privacy practices requires that we change our data and privacy practices, which could have an adverse effect on our business and results of operations. Complying with these various laws could cause us to incur substantial costs or require us to change our business practices in a manner adverse to our business. Also, any new law or regulation imposing greater fees or taxes or restriction on the collection, use, or transfer of information or data internationally or over the Internet, could result in a decline in the use of our products and services and adversely affect our sales and results of operations. Finally, as we increasingly provide technological solutions, our customers and regulators will expect that we can demonstrate compliance with current data privacy and security regulations as well as new industry-developed standards, and our inability to do so may adversely impact sales of our solutions and services to certain customers. This is particularly true for customers in highly-regulated industries, such as the healthcare industry and government contractors, and could result in regulatory actions, fines, and legal proceedings as well as negative impacts to our brand, reputation, and business.

Previous wording

For the year ended December 31, 2024, 14% of our net revenues were generated from customers outside of the U.S. and 7% of our long-lived assets, excluding goodwill and other intangibles, were attributable to operations outside of the U.S. We expect our international operations to contribute materially to our business for the foreseeable future. Our international operations are subject to varying degrees of risk inherent in doing business outside of the U.S. including, without limitation, the following:

Current wording

For the year ended December 31, 2025, 13% of our net revenues were generated from customers outside of the U.S. and 9% of our long-lived assets, excluding goodwill and other intangibles, were attributable to operations outside of the U.S. We expect our international operations to contribute materially to our business for the foreseeable future. Our international operations are subject to varying degrees of risk inherent in doing business outside of the U.S. including, without limitation, the following:

Previous wording

•trade protection measures, tariffs, and import or export requirements, including uncertainty about what actions may be taken by governments with respect to tariffs or trade relations, what products may be subject to such actions, and what actions may be taken by foreign countries in retaliation to proposed or imposed U.S. tariffs;

Current wording

•trade protection measures, tariffs, and import or export requirements, including volatility and uncertainty about what actions may be taken by governments with respect to tariffs or trade relations, what products may be subject to such actions, and what actions may be taken by foreign countries in retaliation to proposed or imposed U.S. tariffs;

Previous wording

•differing and unexpected changes in regulatory requirements, including any measures implemented to address data privacy, cybersecurity, and impacts of climate change.

Current wording

•differing and unexpected changes in regulatory requirements, including any measures implemented to address AI, data privacy, cybersecurity, and impacts of climate change.

Previous wording

If terrorist activity, armed conflict, directed cyberattacks, political instability, public health crises, such as epidemics or pandemics, or extreme weather events or other natural disasters occur in the U.S. or other locations, such events may negatively impact our operations, cause general economic conditions to deteriorate, or cause demand for our products to decline. A prolonged economic slowdown or recession could reduce the demand for our products, and therefore, negatively affect our future sales and profits. Any of these events could have a significant impact on our business, financial condition, or results of operations.

Current wording

If terrorist activity, armed conflicts, directed cyberattacks, political instability, public health crises, such as epidemics or pandemics, or extreme weather events or other natural disasters occur in the U.S. or other locations, such events may negatively impact our operations, cause general economic conditions to deteriorate, or cause demand for our products to decline. A prolonged economic slowdown or recession could reduce the demand for our products, and therefore, negatively affect our future sales and profits. Any of these events could have a significant impact on our business, financial condition, or results of operations.

Previous wording

Political and geopolitical conditions in the markets in which our products and services are sold have been and could continue to be difficult to predict, resulting in adverse effects on our business. The results of elections, geopolitical events and tensions, and wars and other military conflicts (such as the ongoing conflicts in Ukraine and the Middle East) in these markets have in the past impacted and could continue to impact how existing laws, regulations and government programs or policies are implemented or result in uncertainty as to how such laws, regulations, programs or policies may change, including with respect to the negotiation of new trade agreements, new, expanded or retaliatory tariffs against certain countries or covering certain products or materials (including recent U.S. tariffs imposed or threatened to be imposed on China, Canada, Mexico, and other countries and any retaliatory actions taken by such countries). Changes in political administrations in the U.S. and elsewhere may lead to variability in, or reallocation of, government spending priorities, or a reduction in government spend, which could have an adverse impact on our businesses that serve governmental entities or governmental contractors. In addition, certain geopolitical events have resulted in and could continue to result in, among other things, cyberattacks, supply disruptions, lower consumer demand, increase in global economic uncertainty, and changes to foreign exchange rates and financial markets, any of which may adversely affect our business and supply chain.

Current wording

Political and geopolitical conditions in the markets in which our products and services are sold have been and could continue to be difficult to predict, resulting in adverse effects on our business. The results of elections, geopolitical events and tensions, and wars and other military conflicts (such as the ongoing conflicts in Ukraine and the Middle East) in these markets have in the past impacted and could continue to impact how existing laws, regulations and government programs or policies are implemented or result in uncertainty as to how such laws, regulations, programs or policies may change, including with respect to the negotiation of new trade agreements, new, expanded or retaliatory tariffs against certain countries or covering certain products or materials (including recent U.S. tariffs imposed or threatened to be imposed on China, Canada, Mexico, the UK, and other countries and any retaliatory actions taken by such countries). Changes in political administrations or government shutdowns in the U.S. or elsewhere may lead to variability in, or reallocation of, government spending priorities, or a reduction or delay in government spending, which has had, and could continue to have an adverse impact on our businesses that serve governmental entities or governmental contractors. In addition, certain geopolitical events have resulted in and could continue to result in, among other things, cyberattacks, supply disruptions, lower consumer demand, increases in global economic uncertainty, changes to foreign exchange rates and financial markets, and expanded regulatory sanctions and export controls, any of which may adversely affect our business and supply chain.