DOCUSIGN, INC.

Previous wording

While we believe recent technological advances complement Docusign’s strategy and will ultimately benefit our business, AI and other technological advances are unpredictable, and there can be no assurance that our strategy will succeed. We may fail to predict or respond effectively to market demand for AI-powered solutions, or customer concerns regarding those solutions. Even if we successfully create, market and sell AI-based offerings that meet customer demand, the costs of developing and operating such solutions (including initial training costs and ongoing processing and inference costs) may reduce profitability and adversely affect our results of operations.

Current wording

While we believe recent technological advances complement Docusign’s strategy and will ultimately benefit our business, AI and other technological advances are unpredictable, and there can be no assurance that our strategy will succeed. We may fail to predict or respond effectively to market demand for AI-powered solutions, or customer concerns regarding those solutions. Even if we successfully create, market and sell AI-based offerings that meet customer demand, the costs of developing and operating such solutions (including initial training costs and ongoing processing and inference costs) may reduce profitability and adversely affect our results of operations. In addition, customer demands or expectations regarding the speed, availability, and performance of AI features may increase over time, which could require us to incur higher infrastructure and model costs that we may not be able to recover through pricing.

Previous wording

We are subject to increasingly frequent and sophisticated cyberattacks, including advanced persistent threats by state-sponsored actors, cyberattacks relying on complex social engineering or “phishing” tactics, ransomware attacks and other methods including credential stuffing and account takeover attacks, prompt injection, deepfakes, denial or degradation of service attacks, malicious code (e.g., viruses and worms), and many other techniques that may lead to the loss, theft or misuse of personal, corporate or financial information, fraudulent payments, identity theft, and disrupting or disabling our services. Bad actors, nation-states, and nation-state-supported actors engage in cyberattacks, including for geopolitical reasons and in connection with global or regional conflicts and operations. The frequency and sophistication of cybersecurity threats against us and our partners, service providers or customers may often become further heightened in connection with such geopolitical tensions. If bad actors gain improper access to our systems or databases or those of our partners, service providers, and other third parties who have access to our data, they may be able to steal, publish, delete, copy, unlawfully or fraudulently use or modify data, including personal information and/or blackmail us to pay a ransom. Additionally, bad actors have misused our platform and/or our brand name to attempt to deceive or defraud others, and may continue to do so. If our efforts to prevent these activities, or limit their impact, are unsuccessful, our reputation and brand could be harmed, we could lose customers, and our business and financial condition could be adversely affected.

Current wording

We are subject to increasingly frequent and sophisticated cyberattacks, including advanced persistent threats by state-sponsored actors, cyberattacks relying on complex social engineering or “phishing” tactics, ransomware attacks and other methods including credential stuffing and account takeover attacks, prompt injection, deepfakes, denial or degradation of service attacks, malicious code (e.g., viruses and worms), and many other techniques that may lead to the loss, theft or misuse of personal, corporate or financial information, fraudulent payments, identity theft, and disrupting or disabling our services. Bad actors, nation-states, and nation-state-supported actors engage in cyberattacks, including for geopolitical reasons and in connection with geopolitical conflicts and operations. The frequency and sophistication of cybersecurity threats against us and our partners, service providers or customers may often become further heightened in connection with such geopolitical tensions. If bad actors gain improper access to our systems or databases or those of our partners, service providers, and other third parties who have access to our data, they may be able to steal, publish, delete, copy, unlawfully or fraudulently use or modify data, including personal information and/or blackmail us to pay a ransom. Additionally, bad actors have misused our platform and/or our brand name to attempt to deceive or defraud others, and may continue to do so. If our efforts to prevent these activities, or limit their impact, are unsuccessful, our reputation and brand could be harmed, we could lose customers, and our business and financial condition could be adversely affected.

Previous wording

We currently serve our customers from third-party data center hosting facilities and cloud service providers. Our customers need to be able to access our products at any time, without interruption or degradation of performance. In some cases, third-party cloud providers run their own platforms that we access, and we are, therefore, vulnerable to their service interruptions. As a result, we depend, in part, on our providers’ ability to protect our service supply chain against damage or interruption, including from natural disasters, regional or global conflicts, power or telecommunications failures, criminal acts and similar events. In some instances, we may not be able to identify the cause or causes of these performance problems immediately, and it could take considerable time for such problems to become pronounced enough for us to detect or for our customers to detect and inform us. In the event that our data center and service arrangements are terminated, or if there are any lapses of service or damage to a data center, we could experience lengthy interruptions in our service as well as delays and additional expenses in arranging new facilities and services. Even with current and planned disaster recovery arrangements, our disaster recovery planning may not account for all eventualities and our business could be harmed.

Current wording

We currently serve our customers from third-party data center hosting facilities and cloud service providers. Our customers need to be able to access our products at any time, without interruption or degradation of performance. In some cases, third-party cloud providers run their own platforms that we access, and we are, therefore, vulnerable to their service interruptions. As a result, we depend, in part, on our providers’ ability to protect our service supply chain against damage or interruption, including from natural disasters, geopolitical conflicts, power or telecommunications failures, criminal acts and similar events. In some instances, we may not be able to identify the cause or causes of these performance problems immediately, and it could take considerable time for such problems to become pronounced enough for us to detect or for our customers to detect and inform us. In the event that our data center and service arrangements are terminated, or if there are any lapses of service or damage to a data center, we could experience lengthy interruptions in our service as well as delays and additional expenses in arranging new facilities and services. Even with current and planned disaster recovery arrangements, our disaster recovery planning may not account for all eventualities and our business could be harmed.

Previous wording

We use AI in our business, and challenges with properly governing its use could result in reputational harm, competitive harm, and legal liability, and adversely affect our results of operations.

Current wording

We use AI in our business, and challenges with properly governing and managing the development, incorporation and use of AI could result in reputational harm, competitive harm, and legal liability, and adversely affect our results of operations.

Previous wording

The development and use of AI present various intellectual property, data privacy, and security risks. Significant investment in the development and maintenance of proprietary datasets and training models and the development of appropriate protections, safeguards, and policies for handling the processing of data, including transparency of customer data extraction and usage in training models may be costly and may subject us to legal liability. Additionally, the agentic AI systems described above may inadvertently access or disclose sensitive information beyond their intended scope or be subject to “prompt injection” and other cyberattacks that could cause the agents to take unauthorized or harmful actions. Any integration of third-party AI functionality with our products and solutions relies on safeguards implemented by the third-party developers of the underlying AI models, including those related to the accuracy, bias, and other variables of the data, and these safeguards may be insufficient. The continued use of AI technology to develop our products and solutions may give rise to risks related to intellectual property infringement. If the AI technology we use generates code or materials that are similar to other proprietary code or materials, or to software that is protected by patents, we could be subject to intellectual property infringement claims. We may also not be able to anticipate and detect security vulnerabilities in such AI-generated software code, including those that could be induced by a maliciously trained AI model. To the extent we use third-party AI technology to develop software code, the terms of use of these tools may reserve rights in the generated code. We could also suffer loss of confidentiality, trade secret rights or other intellectual property rights or cause harm to privacy rights of third parties because of our use of AI technology.

Current wording

The continued use of AI technology to develop our products and solutions may give rise to risks related to intellectual property infringement. If the AI technology we use generates code or materials that are similar to other proprietary code or materials, or to software that is protected by patents, we could be subject to intellectual property infringement claims. We may also not be able to anticipate and detect security vulnerabilities in such AI-generated software code, including those that could be induced by a maliciously trained AI model. To the extent we use third-party AI technology to develop software code, the terms of use of these tools may reserve rights in the generated code. We could also suffer loss of confidentiality, trade secret rights or other intellectual property rights or cause harm to privacy rights of third parties because of our use of AI technology.

Previous wording

We also are dependent on the continued service of our existing software engineers because of the complexity of our products and solutions. In particular, we compete with many other companies for software developers with high levels of experience and skilled sales and operations professionals in a tight U.S. labor market. We also require skilled product development, marketing, sales, finance and operations professionals, and we may not be successful in attracting and retaining the professionals we need, particularly in our principal U.S. locations in the San Francisco Bay Area and Seattle. Additionally, while we currently employ a hybrid model where most employees have the flexibility to work from home, changes to our workplace arrangements could impact our ability to maintain our corporate culture or productivity, increase attrition or limit our ability to attract employees if individuals prefer to work full time at home or in the office. Competition for employees in our industry (and especially with expertise in AI technology and at our principal U.S.

Current wording

We also are dependent on the continued service of our existing software engineers because of the complexity of our products and solutions. In particular, we compete with many other companies for software developers with high levels of experience and skilled sales and operations professionals in a tight U.S. labor market. We also require skilled product development, marketing, sales, finance and operations professionals, and we may not be successful in attracting and retaining the professionals we need, particularly in our principal U.S. locations in the San Francisco Bay Area and Seattle. Additionally, while we currently employ a hybrid model where most employees have the flexibility to work from home, changes to our workplace arrangements could impact our ability to maintain our corporate culture or productivity, increase attrition or limit our ability to attract employees if individuals prefer to work full time at home or in the office. Competition for employees in our industry (and especially with expertise in AI technology and at our principal U.S. locations) is intense, and many of the companies we compete with for experienced personnel have greater resources than we do. To remain competitive, we may experience increased compensation-related expenses.

Previous wording

▪the impact of new accounting pronouncements;

Current wording

▪the impact of new or changes to accounting pronouncements;

Previous wording

▪regional or global conflicts, including sanctions or other laws and regulations prohibiting or limiting operations in certain jurisdictions;

Current wording

▪geopolitical conflicts, including sanctions or other laws and regulations prohibiting or limiting operations in certain jurisdictions;

Previous wording

A successful assertion by one or more states or foreign jurisdictions requiring us to collect taxes where we presently do not do so, or to collect more taxes in a jurisdiction in which we currently do collect some taxes, could result in substantial tax liabilities, including taxes on past sales, as well as penalties and interest. Any imposition by state or local governments or other jurisdictions of sales tax or other indirect tax collection obligations on out-of-jurisdiction sellers could also create additional administrative burdens for us, put us at a competitive disadvantage if they do not impose similar obligations on our competitors and decrease our future sales, which could have a material adverse impact on our business and operating results.

Current wording

A successful assertion by one or more states or foreign jurisdictions requiring us to collect taxes where we presently do not do so, or to collect more taxes in a jurisdiction in which we currently do collect some taxes, could result in substantial tax liabilities, including taxes on past sales, as well as penalties and interest. For example, California enacted Senate Bill 122 on June 29, 2026, which, among other changes, extends sales and use tax to digital prewritten software beginning January 1, 2027. Any imposition by state or local governments or other jurisdictions of sales tax or other indirect tax collection obligations on out-of-jurisdiction sellers could also create additional administrative burdens for us, put us at a competitive disadvantage if they do not impose similar obligations on our competitors and decrease our future sales, which could have a material adverse impact on our business and operating results.

Previous wording

▪terrorist attacks, natural disasters and the effects of climate change, regional and global conflicts, sanctions, laws and regulations that prohibit or limit operations in certain jurisdictions, public health crises or other such events impacting countries where we have operations.

Current wording

▪terrorist attacks, natural disasters and the effects of climate change, war or geopolitical conflicts, sanctions, laws and regulations that prohibit or limit operations in certain jurisdictions, public health crises or other such events impacting countries where we have operations.

Previous wording

Section 22 of the Securities Act creates concurrent jurisdiction for federal and state courts over all claims brought to enforce any duty or liability created by the Securities Act or the rules and regulations thereunder. Our amended and restated certificate of incorporation, however, provides that the U.S. federal district courts will be the exclusive forum for resolving any complaint asserting a cause of action arising under the Securities Act. In December 2018, the Delaware Chancery Court issued an opinion invalidating provisions similar to ours limiting to U.S. federal court the forum in which a stockholder is able to bring a claim under the Securities Act (“Federal Forum Provision”). On March 18, 2020, however, the Delaware Supreme Court reversed the decision of the Delaware Chancery Court and held that such provisions are facially valid. In light of that recent decision, we announced that we may in the future enforce our Federal Forum Provision. While there can be no assurance that federal courts or other state courts will follow the holding of the

Current wording

Section 22 of the Securities Act creates concurrent jurisdiction for federal and state courts over all claims brought to enforce any duty or liability created by the Securities Act or the rules and regulations thereunder. Our amended and restated certificate of incorporation, however, provides that the U.S. federal district courts will be the exclusive forum for resolving any complaint asserting a cause of action arising under the Securities Act. In December 2018, the Delaware Chancery Court issued an opinion invalidating provisions similar to ours limiting to U.S. federal court the forum in which a stockholder is able to bring a claim under the Securities Act (“Federal Forum Provision”). On March 18, 2020, however, the Delaware Supreme Court reversed the decision of the Delaware Chancery Court and held that such provisions are facially valid. In light of that recent decision, we announced that we may in the future enforce our Federal Forum Provision. While there can be no assurance that federal courts or other state courts will follow the holding of the Delaware Supreme Court or determine that the Federal Forum Provision should be enforced in a particular case, application of the Federal Forum Provision generally means that suits brought by our stockholders to enforce any duty or liability created by the Securities Act must be brought in federal court and cannot be brought in state court. While the Federal Forum Provision does not apply to suits brought to enforce any duty or liability created by the Exchange Act, Section 27 of the Exchange Act creates exclusive federal jurisdiction over all claims brought to enforce any duty or liability created by the Exchange Act or the rules and regulations thereunder. Accordingly, actions by our stockholders to enforce any duty or liability created by the Exchange Act or the rules and regulations thereunder also must be brought in federal court. Our stockholders will not be deemed to have waived our compliance with the federal securities laws and the regulations promulgated thereunder.

Previous wording

Natural catastrophic events and man-made problems such as power disruptions, computer viruses, data security breaches, regional or global conflicts, and terrorism may disrupt our business.

Current wording

Natural catastrophic events and man-made problems such as power disruptions, computer viruses, data security breaches, geopolitical conflicts, and terrorism may disrupt our business.